On 10/09/2016 23:27, Balint Reczey wrote:
During a rebuild of all packages in sid, many ocaml packages failed to build on amd64 with patched GCC and dpkg. The root cause seems to be that libasmrun.a is shipped as a non-PIC library.
There is already a version of libasmrun.a compiled with -fPIC: libasmrun_pic.a. But to use it, a specific option (-runtime-variant _pic) must be used. This is done in sks, for example.
The rebuild tested if packages are ready for a transition enabling PIE and bindnow for amd64. [...] The attached patch fixed the problem.
Your patch injects -fPIC in all calls to gcc. Is that what we want from now on? Why isn't that done inside gcc itself, then?
I read on https://lintian.debian.org/tags/hardening-no-pie.html that -fPIC is not compatible with -fPIE. Then, I don't understand why you talk about adding -fPIC in this bugreport which is about enabling PIE.
Cheers, -- Stéphane