Re: Enabling -fstack-clash-protection for trixie [armhf rebuild]

2024-01-12 Thread Lucas Nussbaum
Hi, I finally got time to perform those archive rebuilds. Results are available at http://qa-logs.debian.net/2024/01/11/ I did a first archive rebuild (all packages on arm64, armhf, armel), and then did a second one, restricted to packages that failed at on at least one architecture. Results in

Re: Enabling -fstack-clash-protection for trixie [armhf rebuild]

2023-11-25 Thread Emanuele Rocca
Hello Lucas! On 2023-10-25 08:55, Lucas Nussbaum wrote: > On 14/08/23 at 14:53 +0200, Emanuele Rocca wrote: > > I'm not sure how the deal with AWS is (how many credits we have > > available and such) but would it be possible to repeat the experiment > > for armhf too? The Neoverse cpus can run 32

Re: Enabling -fstack-clash-protection for trixie [armhf rebuild]

2023-11-02 Thread Emanuele Rocca
Hi Lucas! On 2023-10-25 08:55, Lucas Nussbaum wrote: > Is this still of interest? Not really, we've flipped the switch now. Thanks nonetheless. :-) Emanuele

Re: Enabling -fstack-clash-protection for trixie [armhf rebuild]

2023-10-25 Thread Lucas Nussbaum
On 14/08/23 at 14:53 +0200, Emanuele Rocca wrote: > Hi Lucas, > > On 2023-08-12 08:18, Lucas Nussbaum wrote: > > Results: > > http://qa-logs.debian.net/2023/08/11.stackclash-arm/ > > > > I only included logs for builds that succeeded in a vanilla build, > > but failed with the custom build. > >

Re: Enabling -fstack-clash-protection for trixie

2023-08-27 Thread Guillem Jover
Hi! On Sun, 2023-08-06 at 23:25:23 +0200, Moritz Mühlenhoff wrote: > Following the procedure to modify default dpkg-buildflags I propose to > enable -fstack-clash-protection on amd64. The bug for dpkg tracking this > is #918914. > > | -fstack-clash-protection > | Generate code to prevent stack cl

Re: Enabling -fstack-clash-protection for trixie

2023-08-14 Thread Emanuele Rocca
Hi Lucas, On 2023-08-12 08:18, Lucas Nussbaum wrote: > Results: > http://qa-logs.debian.net/2023/08/11.stackclash-arm/ > > I only included logs for builds that succeeded in a vanilla build, > but failed with the custom build. Thank you so much, this is great! There's not much fallout. I'm not s

Re: Enabling -fstack-clash-protection for trixie

2023-08-11 Thread Lucas Nussbaum
Hi Emanuele, On 10/08/23 at 16:57 +0200, Emanuele Rocca wrote: > Hi, > > On 2023-08-10 02:43, Lucas Nussbaum wrote: > > What I would need is a script that customizes a chroot. > > This is what I'm passing to sbuild --chroot-setup-commands for my > builds: > > sbuild --chroot-setup-commands='p

Re: Enabling -fstack-clash-protection for trixie

2023-08-10 Thread Emanuele Rocca
Hi, On 2023-08-10 02:43, Lucas Nussbaum wrote: > What I would need is a script that customizes a chroot. This is what I'm passing to sbuild --chroot-setup-commands for my builds: sbuild --chroot-setup-commands='printf "APPEND CFLAGS -fstack-clash-protection\nAPPEND CXXFLAGS -fstack-clash-prot

Re: Enabling -fstack-clash-protection for trixie

2023-08-10 Thread Lucas Nussbaum
On 10/08/23 at 10:49 +0200, Emanuele Rocca wrote: > Hi, > > On 2023-08-06 11:25, Moritz Mühlenhoff wrote: > > I worked with Lucas a while back and he made an archive rebuild on amd64, > > only a minimal list of packages will need to be adapted: > > http://qa-logs.debian.net/2023/05/24/ > > Can we

Re: Enabling -fstack-clash-protection for trixie

2023-08-10 Thread Emanuele Rocca
Hi, On 2023-08-06 11:25, Moritz Mühlenhoff wrote: > I worked with Lucas a while back and he made an archive rebuild on amd64, > only a minimal list of packages will need to be adapted: > http://qa-logs.debian.net/2023/05/24/ Can we do the same for arm64? As far as I understand the archive rebuild

Enabling -fstack-clash-protection for trixie

2023-08-06 Thread Moritz Mühlenhoff
Following the procedure to modify default dpkg-buildflags I propose to enable -fstack-clash-protection on amd64. The bug for dpkg tracking this is #918914. | -fstack-clash-protection | Generate code to prevent stack clash style attacks. When this option | is enabled, the compiler will only allocat