Hi Dave-- thanks for this report!
On Sat 2016-12-03 18:12:41 -0500, John David Anglin wrote: > > make[2]: Entering directory '/<<PKGBUILDDIR>>/build-gpgv-static/g10' > gcc -Wall -Wno-pointer-sign -Wpointer-arith -g -O2 > -fdebug-prefix-map=/<<PKGBUILDDIR>>=. -Wformat -Werror=format-security -pie > -static -o gpgv gpgv.o build-packet.o compress.o free-packet.o getkey.o > keydb.o keyring.o seskey.o kbnode.o mainproc.o armor.o mdfilter.o > textfilter.o progress.o misc.o rmd160.o openfile.o keyid.o parse-packet.o > cpr.o plaintext.o sig-check.o keylist.o pkglue.o ecdh.o verify.o > ../kbx/libkeybox.a ../common/libcommon.a ../common/libgpgrl.a -lz -lgcrypt > -L/usr/lib/hppa-linux-gnu -lgpg-error > /usr/bin/ld: /usr/lib/gcc/hppa-linux-gnu/6/crtbeginT.o: relocation > R_PARISC_DPREL21L can not be used when making a shared object; recompile with > -fPIC > /usr/lib/gcc/hppa-linux-gnu/6/crtbeginT.o: error adding symbols: Bad value > collect2: error: ld returned 1 exit status > Makefile:788: recipe for target 'gpgv' failed > > Full log is here: > https://buildd.debian.org/status/fetch.php?pkg=gnupg2&arch=hppa&ver=2.1.16-2&stamp=1479760527 > > The build will complete successfully if "-pie" is removed from the following > line in debian/rules: > cd build-gpgv-static/g10 && $(MAKE) LDFLAGS="$$LDFLAGS -pie -static" > gpgv > > PIE support is not well tested on hppa. Further, gcc on hppa is not built > with --enable-pie-default. So, archive libraries and executable code are > not built by default with -fPIE. So, in general, linking with -pie and > -static > isn't going to work. that's a bummer, since it means that ASLR isn't going to work for hppa, which leaves hppa users more vulnerable to certain kinds of attack. I plan on resolving this in the next upload with a change like the following: --- a/debian/rules +++ b/debian/rules @@ -14,6 +14,12 @@ include /usr/share/dpkg/architecture.mk export DEB_BUILD_MAINT_OPTIONS = hardening=+all +ifeq ($(DEB_HOST_ARCH),hppa) + GPGV_STATIC_HARDENING = "" +else + GPGV_STATIC_HARDENING = "-pie" +endif + %: dh $@ --with=autoreconf --builddirectory=build @@ -36,7 +42,7 @@ override_dh_auto_build-arch: dh_auto_build --builddirectory=build cp -a build-gpgv-udeb build-gpgv-static rm -f build-gpgv-static/g10/gpgv - cd build-gpgv-static/g10 && $(MAKE) LDFLAGS="$$LDFLAGS -pie -static" gpgv + cd build-gpgv-static/g10 && $(MAKE) LDFLAGS="$$LDFLAGS $(GPGV_STATIC_HARDENING) -static" gpgv mv build-gpgv-static/g10/gpgv build-gpgv-static/g10/gpgv-static override_dh_auto_build-indep: Please let me know if you think this could be improved. --dkg
signature.asc
Description: PGP signature
