Mark H Weaver <m...@netris.org> writes: > Mark H Weaver <m...@netris.org> writes: > >> I just followed this up with a Spectre mitigation for WebKitGTK+ >> backported from upstream WebKit: >> >> >> https://git.savannah.gnu.org/cgit/guix.git/commit/?id=56804398a94bea941183ae4ed29d2a9f82069a6f > > FYI, adding a patch to 'webkitgtk' seems to have greatly exacerbated an > existing race condition in webkitgtk's build system, presumably due to > the zeroing of time stamps in the repacked tarball. I believe that > *any* patch would have had this effect. I filed the following bug to > track this issue: > > https://bugs.gnu.org/30015 > > Mark
Thanks for all the help and quick fixes. I have an idea. Should we add a news entry to Guix blog[0] summarizing all the above? For example, we can advice users to install noscript and turn off javascript by default and only enable it on trusted site when necessary. About the "Retpoline" mitigation technique[1]. Right now only GCC 7.2.0 is patched, but our default gcc version is 5.4.0 in master and 5.5.0 in core-updates. So I tried to apply the patches apply the patches to 5.5.0. There are totally 17 commits/patches. The first 3 patch can be modified to work while the 4th patch cannot be easily modified to work because the function ``ix86_nopic_noplt_attribute_p'' is not present on 5.5.0. Perhaps discarding the hunk would be fine, but we need to be careful about it (maybe running tests make sure the fix really works). Do you think we should modify the patch to make it work on GCC 5 or update core-updates to GCC 7 instead? [0]: https://www.gnu.org/software/guix/blog/ [1]: http://git.infradead.org/users/dwmw2/gcc-retpoline.git/shortlog/refs/heads/retpoline
