Hi, Ben Cotton <bcotton@xxxxxxxxxx> writes: > The annobin package provides two components, a plugin for gcc that > records details about how a program was compiled and an analyser that > uses this information to produce a report on the security hardening > status of the compiled program. Currently the plugin is being used as > part of the build process for Fedora packages (when they are built > using gcc), but the analysing program is not being run. This proposal > is to have the analyser (called annocheck) run when creating > information for review by the Bodhi update process, possibly allowing > an update to be delayed until the security issues are addressed. I currently run annocheck manually on my builds, so I am a fan of this change. But I think it's worth calling out one limitation: this currently mostly works with gcc. clang is a bit behind in implementing some of the features that annocheck looks at. With Fedora 30, annocheck would cleanly skip most of clang-produced binaries. With Fedora 31, clang seems to insert some of the meta-data that annocheck looks for, but doesn't quite implement to match the gcc standard. I have recently run into failures flagged by annocheck that I need to dig into on Fedora 31. > It is desirable that the packaging guidelines be updated to describe > the security hardening features examined by annocheck. (If they are > not already mentioned in the guidelines). https://docs.fedoraproject.org/en-US/packaging-guidelines/#_compiler_flags has some of this, but not all. It seems to me like annocheck is more strict than the current packaging guidelines. Thanks, Omair -- PGP Key: B157A9F0 (http://pgp.mit.edu/) Fingerprint = 9DB5 2F0B FD3E C239 E108 E7BD DF99 7AF8 B157 A9F0 _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
