Bug#804254: publib-dev: publib does not provide a .a file with PIC objects

[Balint Reczey <balint@balintreczey.hu>]

Control: severity -1 important

On Fri, 06 Nov 2015 16:05:03 +0000 Daniel Silverstone
<dsilvers@digital-scurf.org> wrote:
...

> 
> Dear Maintainer,
> 
> It would be super-useful if publib-dev provided a PIC compiled variant of the
> ar file.  This would allow the use of publib functions when preparing shared
> objects such as modules to be loaded into interpreters.
...


During a rebuild of all packages in sid, several packages
failed to build on amd64 with patched GCC and dpkg. The root
cause seems to be that libpub.a is shipped as a non-PIC library.

The rebuild tested if packages are ready for a transition
enabling PIE and bindnow for amd64.

For more information about the changes to sid's dpkg and GCC please
visit:
 https://wiki.debian.org/Hardening/PIEByDefaultTransitio

Relevant part of falselogin's build log:
...
make[1]: Entering directory '/<<PKGBUILDDIR>>'
gcc -W -Wall -g -O2 -c falselogin.c
gcc -o falselogin falselogin.o -lpub
/usr/bin/ld:
/usr/lib/gcc/x86_64-linux-gnu/6/../../../x86_64-linux-gnu/libpub.a(strgsub.o):
relocation R_X86_64_32 against `.rodata' can not be used when making a
shared object; recompile with -fPIC
/usr/bin/ld:
/usr/lib/gcc/x86_64-linux-gnu/6/../../../x86_64-linux-gnu/libpub.a(strsub.o):
relocation R_X86_64_32 against `.rodata' can not be used when making a
shared object; recompile with -fPIC
/usr/bin/ld: final link failed: Nonrepresentable section on output
...

The full build log is available from:
https://people.debian.org/~rbalint/build-logs/pie-bindnow-20160906/falselogin_0.3-4_amd64.build.gz

Thanks,
Balint