Re: Bug#657853: Building perl with hardened build flags
On Tue, Feb 21, 2012 at 10:37:48PM +0000, Dominic Hargreaves wrote:
> Trying to pull a few of the subthreads together:
>
> On Sun, Feb 12, 2012 at 09:24:40PM +0100, Moritz Mühlenhoff wrote:
> > On Sun, Feb 12, 2012 at 02:54:59PM +0200, Niko Tyni wrote:
>
> > > That's a good point about the timeframe. So there's no real hurry with
> > > the proposed debhelper changes in option A, they can be done after wheezy.
> >
> > Yep. The release goal for Wheezy is "fix as many as possible, but make
> > a concentrated effort for all packages of priority >= important and
> > which had a DSA since 2006. perl itself matches both conditions :-)
>
> On Thu, Feb 16, 2012 at 06:46:36PM -0400, Joey Hess wrote:
> > gregor herrmann wrote:
> > > Assuming they are all uploaded and all arch:any (and only looking at
> > > packages in the Debian perl Group):
> > >
> > > % grep 9 */debian/compat | wc -l
> > > 31
> >
> > Well, it seems easy enough to test 30 packages. It would help if someone
> > developed a patch before there are too many more.
>
> On Fri, Feb 17, 2012 at 12:36:21PM +0200, Niko Tyni wrote:
> > On Sun, Feb 12, 2012 at 09:24:40PM +0100, Moritz Mühlenhoff wrote:
> > > On Sun, Feb 12, 2012 at 02:54:59PM +0200, Niko Tyni wrote:
> > > > > On Fri, Feb 10, 2012 at 11:29:09PM +0200, Niko Tyni wrote:
> >
> > > > > > A. make debhelper pass all of CFLAGS, CPPFLAGS, and LDFLAGS down to
> > > > > > ExtUtils::MakeMaker and ExtUtils::CBuilder via suitable command line
> > > > > > invocations (it currently passes only CFLAGS, starting with compat
> > > > > > level 9)
> > >
> > > I would prefer this strategy.
> >
> > I think it's my preferred alternative as well.
> >
> > If we have consensus on that, the way forward as I see it:
> >
> > - prepare a perl upload in unstable that is built with the hardened flags
> > but doesn't export them through Config.pm
>
> (for which you've submitted a patch separately; thanks)
>
> > - preferably fix #660195 (recursive Makefile.PL arguments) while at it
>
> Yeah, this does looks like it needs to be fixed soon (otherwise the
> release goal packages won't be completely hardened; it's also possible
> that some of the dual-lived modules in perl itself are affected in this
> way).
>
> From a review of the upstream bug, it doesn't looks like it should
> be very hard to fix...
>
> > - find the optimal invocations of Makefile.PL and Build.PL
> > that honour all of CFLAGS, CPPFLAGS, and LDFLAGS
> > - either
> > + change the handful of release goal packages to use those invocations
> > instead of the debhelper v9 defaults, and make debhelper v10 to use
> > them by default after wheezy
> > or
> > + test the 30 or so affected packages and change debhelper v9
> > for wheezy
>
> Given the messages I've quoted above, deferring debhelper changes until
> v10 makes most sense. This means we can file bugs on the release goal
> packages to use the invocations manually in the meantime, as well as
> a wishlist bug on debhelper for v10 (so we don't forget).
If it's only 30 packages we should rather push it into debhelper 9 now
if that's okay with Joey.
I'll make sure the 30 packages get rebuilt.
Cheers,
Moritz
Reply to: