Il 20/02/22 19:10, Peter Robinson ha scritto: >> I'm running a package review request for a package which uses suid and >> rpmlint complaints that it is not using hardened build flags. However, >> the specfile doesn't explicitly disable them with %undefine _hardened_build. >> >> Looking at the build log of this one [1] I see that export CFLAGS and >> other flags are missing -fPIE/-fPIC, so the hardened build flags seems >> to not be truly applied by default to builds... this is a Golang >> package, but I see the same to other Koji builds made with cmake, rust, etc. >> >> So, where -fPIE/-fPIC are supposed to be injected in build flags? > Via the various rpm macros like %configure > >> [1] https://koji.fedoraproject.org/koji/taskinfo?taskID=82863274 > You're probably better off referencing the review as opposed to a build. https://bugzilla.redhat.com/show_bug.cgi?id=2034758 As I later realized and commented in the review, the hardened flags are applied (I've checked the produced executables via 'hardening-check' script). I think fedora-review expects an explicit declaration of '%global _hardened_build' when it detects that a suid executable is packaged, but this is no more relevant as hardened_build is now the default. Mattia _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
