]> git.ipfire.org Git - people/stevee/ipfire-3.x.git/blobdiff - gcc/gcc.nm
gcc: Harden this package
[people/stevee/ipfire-3.x.git] / gcc / gcc.nm
index 84243e48eebc5a76e5c688364bbd1923f1d84531..011329e66fac6914b0e702ead7577cc5515afd1a 100644 (file)
@@ -8,7 +8,7 @@ build_graphite = 1
 
 name       = gcc
 version    = 12.2.0
-release    = 3
+release    = 4
 
 maintainer = Michael Tremer <michael.tremer@ipfire.org>
 groups     = Development/Compilers
@@ -65,15 +65,9 @@ build
        # Build libubsan
        build_libubsan = 0
 
-       # A couple of configure arguments depending on the architecture and
-       # configuration.
-       configure_options =
-
-       #make_bootstrap = profiledbootstrap
+       DIR_BUILD = %{DIR_SRC}/gcc-build
 
        if "%{DISTRO_ARCH}" == "x86_64"
-               configure_options = --disable-multilib
-
                build_libquadmath = 1
                build_liblsan = 1
                build_libtsan = 1
@@ -84,14 +78,7 @@ build
                build_libubsan = 1
        end
 
-       if "%{build_graphite}" == "1"
-               configure_options += \
-                       --with-isl
-       end
-
        prepare_cmds
-               mkdir -v %{DIR_SRC}/gcc-build
-
                # Remove unneeded features that will save some compile time
                rm -rf lib{gfortran,java,objc} gcc/{fortran,java,objc,objcp}
 
@@ -103,108 +90,82 @@ build
                # Branding gcc
                echo "%{DISTRO_NAME} %{version}-%{release}" > gcc/DEV-PHASE
 
-               # Libgomp uses -Werror regardless of --disable-werror, and this will cause a
-               # build failure when -D_FORTIFY_SOURCE=2 causes build time warnings:
-               sed -e "s/-Werror//" -i libgomp/configure
-
                # The fixincludes script is known to occasionally erroneously attempt to
                # "fix" the system headers installed so far. As the headers up to this point
                # are known to not require fixing, issue the following command to prevent
                # the fixincludes script from running:
                sed -i 's@\./fixinc\.sh@-c true@' gcc/Makefile.in
-
-               sed -i gcc/Makefile.in \
-                       -e "s/-fno-exceptions/& -fno-asynchronous-unwind-tables/"
-
-               #./contrib/gcc_update --touch
        end
 
-       export CC=gcc
-       export CXX=g++
-
        # Disable LTO
        LTO_CFLAGS =
 
-       build
-               cd %{DIR_SRC}/gcc-build
-
-               # Modify CFLAGS
-               CFLAGS="%{CFLAGS}"
-               CFLAGS=$(echo ${CFLAGS} | sed -e 's/\(-Wp,\)\?-D_FORTIFY_SOURCE=[12]//g')
-               CFLAGS=$(echo ${CFLAGS} | sed -e 's/-Werror=format-security//g')
-               CFLAGS=$(echo ${CFLAGS} | sed -e 's/-m64//g;s/-m32//g;s/-m31//g')
-               CFLAGS=$(echo ${CFLAGS} | sed -e 's/-mfpmath=sse/-mfpmath=sse -msse2/g')
-               CFLAGS=$(echo ${CFLAGS} | sed -e 's/-march=i.86//g')
-               CFLAGS=$(echo ${CFLAGS} | sed -e 's/ -pipe / /g')
-               CFLAGS=$(echo "${CFLAGS}" | sed -e 's/[[:blank:]]\+/ /g')
-               CXXFLAGS=$(echo  ${CFLAGS} | sed -e 's/ -Wall//g')
-               CXXFLAGS=$(echo  ${CXXFLAGS} | sed -e 's/ -fexceptions / /g')
-               #CXXFLAGS=$(echo  ${CXXFLAGS} | sed -e 's/ -Werror=format-security / -Wformat -Werror=format-security /g')
-
-               case "${CFLAGS}" in
-                       *-fasynchronous-unwind-tables*)
-                               sed -i -e "s/-fno-exceptions /-fno-exceptions -fno-asynchronous-unwind-tables/" \
-                                       ../%{thisapp}/Makefile.in
-                               ;;
-               esac
-
-               CFLAGS="${CFLAGS}" \
-               CXXFLAGS="${CXXFLAGS}" \
-               XCFLAGS="${CFLAGS}" \
-               TCFLAGS="${CFLAGS}" \
-               ../%{thisapp}/configure \
-                       --build=%{DISTRO_BUILDTARGET} \
-                       --prefix=/usr \
-                       --libdir=%{libdir} \
-                       --libexecdir=%{libdir} \
-                       --mandir=%{mandir} \
-                       --with-boot-ldflags="%{LDFLAGS}" \
-                       --enable-esp \
-                       --enable-shared \
-                       --enable-threads=posix \
-                       --enable-__cxa_atexit \
-                       --enable-clocale=gnu \
-                       --enable-languages=c,c++,lto \
-                       --disable-bootstrap \
-                       --enable-checking=release \
-                       --enable-default-pie \
-                       --enable-default-ssp \
-                       --disable-werror \
-                       --disable-libssp \
-                       --with-system-zlib \
-                       --with-bugurl=https://bugzilla.ipfire.org/ \
-                       --disable-libunwind-exceptions \
-                       --enable-gnu-unique-object \
-                       --enable-linker-build-id \
-                       --with-linker-hash-style=gnu \
-                       --enable-plugin \
-                       --enable-initfini-array \
-                       --disable-libgcj \
-                       --enable-gnu-indirect-function \
-                       %{configure_options}
-
-               # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58012
-               # XXX disabled flags: --disable-static
-
-               # GCC does not support a parallel build.
-               make %{make_bootstrap} BOOT_CFLAGS="${CFLAGS}" %{PARALLELISMFLAGS}
-
-               # Generate man pages.
-               perl -pi -e 's/head3/head2/' ../contrib/texi2pod.pl
-               for i in %{DIR_APP}/gcc/doc/*.texi; do
-                       cp -a $i $i.orig; sed 's/ftable/table/' $i.orig > $i
-               done
-               make -C gcc generated-manpages
-               for i in %{DIR_APP}/gcc/doc/*.texi; do mv -f $i.orig $i; done
+       # Disable any string format security checks
+       STRING_FORMAT_SECURITY_CFLAGS =
+
+       configure_options = \
+               CFLAGS="%{CFLAGS}" \
+               CXXFLAGS="%{CXXFLAGS}" \
+               XCFLAGS="%{CFLAGS}" \
+               TCFLAGS="%{CFLAGS}" \
+               --build=%{DISTRO_BUILDTARGET} \
+               --prefix=%{prefix} \
+               --libdir=%{libdir} \
+               --libexecdir=%{libdir} \
+               --mandir=%{mandir} \
+               --disable-static \
+               --enable-shared \
+               --enable-threads=posix \
+               --enable-__cxa_atexit \
+               --enable-languages=c,c++,lto \
+               --enable-bootstrap \
+               --with-build-config=bootstrap-lto \
+               --enable-link-serialization=1 \
+               --enable-checking=release \
+               --enable-default-pie \
+               --enable-default-ssp \
+               --disable-werror \
+               --disable-libssp \
+               --with-system-zlib \
+               --with-bugurl=https://bugzilla.ipfire.org/ \
+               --enable-libstdcxx-backtrace \
+               --disable-libstdcxx-pch \
+               --with-libstdcxx-zoneinfo=%{datadir}/zoneinfo \
+               --disable-libunwind-exceptions \
+               --enable-gnu-unique-object \
+               --enable-linker-build-id \
+               --with-linker-hash-style=gnu \
+               --enable-decimal-float \
+               --enable-plugin \
+               --enable-initfini-array \
+               --disable-libgcj \
+               --enable-gnu-indirect-function
+
+       if "%{build_graphite}" == "1"
+               configure_options += \
+                       --with-isl
        end
 
+       if "%{DISTRO_ARCH}" == "x86_64"
+               configure_options += \
+                       --with-arch_64=x86-64-v2 \
+                       --with-arch_32=x86-64 \
+                       --enable-cet \
+                       --with-tune=generic
+       end
+
+       make_build_targets += \
+               profiledbootstrap \
+               BOOT_CFLAGS="%{CFLAGS}" \
+               BOOT_LDFLAGS="%{LDFLAGS}" \
+               LDFLAGS_FOR_TARGET="%{LDFLAGS}"
+
        #test
        #       cd %{DIR_SRC}/gcc-build && make -k check || true
        #       cd %{DIR_APP} && ./contrib/test_summary
        #end
 
        install
-               cd %{DIR_SRC}/gcc-build
                make install DESTDIR=%{BUILDROOT}
 
                # Check if the installation path exists.
@@ -223,7 +184,8 @@ build
 
                OUTPUT_FORMAT('`gcc -Wl,--print-output-format -nostdlib -r -o /dev/null`')
                GROUP ( /%{libdir}/libgcc_s.so.1 libgcc.a )' > ${FULLPATH}/libgcc_s.so
-               chmod 755 %{BUILDROOT}%{libdir}/libgcc_s.so.1
+               chmod -v 755 ${FULLPATH}/libgcc_s.so
+               chmod -v 755 %{BUILDROOT}%{libdir}/libgcc_s.so.1
 
                # Remove some GNU debugger stuff.
                rm -vf %{BUILDROOT}%{libdir}/lib*.py
@@ -231,48 +193,40 @@ build
                # libgomp
                mv -vf %{BUILDROOT}%{libdir}/libgomp.spec ${FULLPATH}/
                ln -svf ../../../libgomp.so.1.0.0 ${FULLPATH}/libgomp.so
-               chmod 755 %{BUILDROOT}%{libdir}/libgomp.so.1.*
+               chmod -v 755 %{BUILDROOT}%{libdir}/libgomp.so.1.*
 
                # libstdc++
                ln -svf ../../../libstdc++.so.6.0.30 ${FULLPATH}/libstdc++.so
-               mv -vf %{BUILDROOT}%{libdir}/lib{std,sup}c++.a ${FULLPATH}
 
                # libquadmath
                if [ "%{build_libquadmath}" = "1" ]; then
                        ln -svf ../../../libquadmath.so.0.0.0 ${FULLPATH}/libquadmath.so
-                       chmod 755 %{BUILDROOT}%{libdir}/libquadmath.so.0.*
+                       chmod -v 755 %{BUILDROOT}%{libdir}/libquadmath.so.0.*
                fi
 
                # libitm
                mv -vf %{BUILDROOT}%{libdir}/libitm.spec ${FULLPATH}/
                ln -svf ../../../libitm.so.1.0.0 ${FULLPATH}/libitm.so
-               chmod 755 %{BUILDROOT}%{libdir}/libitm.so.1.*
+               chmod -v 755 %{BUILDROOT}%{libdir}/libitm.so.1.*
 
                # liblsan
                if [ "%{build_liblsan}" = "1" ]; then
                        ln -svf ../../../liblsan.so.0.0.0 ${FULLPATH}/liblsan.so
-                       chmod 755 %{BUILDROOT}%{libdir}/liblsan.so.*
+                       chmod -v 755 %{BUILDROOT}%{libdir}/liblsan.so.*
                fi
 
                # libtsan
                if [ "%{build_libtsan}" = "1" ]; then
                        ln -svf ../../../libtsan.so.2.0.0 ${FULLPATH}/libtsan.so
-                       chmod 755 %{BUILDROOT}%{libdir}/libtsan.so.*
+                       chmod -v 755 %{BUILDROOT}%{libdir}/libtsan.so.*
                fi
 
                # libubsan
                if [ "%{build_libubsan}" = "1" ]; then
                        ln -svf ../../../libubsan.so.1.0.0 ${FULLPATH}/libubsan.so
-                       chmod 755 %{BUILDROOT}%{libdir}/libubsan.so.*
+                       chmod -v 755 %{BUILDROOT}%{libdir}/libubsan.so.*
                fi
        end
-
-       keep_libraries
-               %{libdir}/gcc/%{DISTRO_BUILDTARGET}/%{version}/libgcc.a
-               %{libdir}/gcc/%{DISTRO_BUILDTARGET}/%{version}/libgcc_eh.a
-               %{libdir}/gcc/%{DISTRO_BUILDTARGET}/%{version}/libstdc++.a
-               %{libdir}/gcc/%{DISTRO_BUILDTARGET}/%{version}/libsupc++.a
-       end
 end
 
 packages