Bug#796166: qtbase-opensource-src: -reduce-relocations breaks build when all hardening build flags are enabled

[Markus Koschany <apo@gambaru.de>]

Package: src:qtbase-opensource-src
Version: 5.4.2+dfsg-8
Severity: normal

Hi,

I discovered that freeciv, particularly the freeciv-qt client, fails to build
from source when I enable all hardening build flags including
-fPIE,-pie (position independent executable). This has never been an
issue before and it seems this regression surfaced with the
introduction of GCC-5.

I think Qt's -reduce-relocation option reduces our ability to harden
our binaries. To workaround this bug I had to change from

 export DEB_BUILD_MAINT_OPTIONS = hardening=+all

to

 export DEB_BUILD_MAINT_OPTIONS = hardening=+all,-pie

This appears to be not the best solution and Freeciv is not the only affected package:

https://bugs.debian.org/792592

There are similar bug reports for other distributions:

https://bugs.archlinux.org/task/45283

and there is also a related GCC-5 bug report

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65886

According to the changelog this regression might have been introduced
on 24 July 2015 by Rohan Garg. I'm not sure about the severity but I
would really like to see the old behaviour again.

Regards,

Markus



-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.1.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: unable to detect