Re: Enabling branch protection on amd64 and arm64

[Moritz Mühlenhoff <jmm@inutil.org>]

Wookey wrote:
> So the immediate issue now is whether or not to enable this by default
> in bookworm?

The majority of packages will not be rebuilt until the release, so
if we add this now it means that packages pick up the change when
they are rebuilt in stable via a security update or point release.
That's not very appealing, independent of the supposed low risk
factor.

I think this should rather be applied early after the Bookworm
release (and ideally we can also finish off the necessary testing
and add -fstack-clash-protection at least for amd64 and other archs
which are ready for it (#918914)).

Cheers,
        Moritz