Hello, Marius Bakke <mba...@fastmail.com> skribis:
> Alex Vong <alexvong1...@gmail.com> writes: > >> Besides, I remember we have discuss about hardening before. Should I >> start a new hardening branch? (although I don't time to work on it right >> now). I think this is something we can do now. >> >> My idea is to create a new guix module (guix build hardening) which >> should contains various build flags. Then we should modifiy each build >> system to import from this new module and fix any build error caused by >> it. We can ask the build farm to evaluate this new branch, right? >> >> >> What do you think? > > Thank you for taking the initiative! This sounds great to me. I > imagine the build systems could get an argument along the lines of > #:hardening-flags '(pie fortify stack-protector ...). > > For gnu-build-system, I suppose we'd build up CFLAGS, LDFLAGS and > friends? We'll also have to modify all packages that override those > variables. Sounds like a plan. I think Alex proposed something along these lines long ago. The difficulty will lie in finding a way to pass those flags reliably through the build system… Ludo’.
