Skip to content

Commit fe1b325

Browse files
fanquakefanquake
committed
Merge bitcoin#27029: guix: consolidate to glibc 2.27 for Linux builds
d5d4b75 guix: combine glibc hardening options into hardened-glibc (fanquake) c49f2b8 guix: remove no-longer needed powerpc workaround (fanquake) 74c9893 guix: use glibc 2.27 for all Linux builds (fanquake) Pull request description: Build against glibc 2.27 for all Linux builds (previously only used for RISC-V), and at the same time, increase our minimum required glibc to 2.27 (2018). This would drop support for Ubuntu Xenial (16.04) & Debian Stretch (9), from the produced release binaries. Compiling from source on those systems may be possible, assuming you can install a recent enough compiler/toolchain etc. ACKs for top commit: hebasto: ACK d5d4b75, I have reviewed the code and it looks OK, I agree it can be merged. Tree-SHA512: 910f0ef45b4558f2a45d35a5c1c39aaac97e8aff086dc4fc1eddbb80c0b6e4bd23667d64e21d0fd42e4db37b6f26f447ca5d1150bb861128af7e71fb42835cf8
2 parents bc35c4f + d5d4b75 commit fe1b325

12 files changed

+33
-365
lines changed

‎contrib/devtools/symbol-check.py

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,30 +15,30 @@
1515

1616
import lief #type:ignore
1717

18-
# Debian 9 (Stretch) EOL: 2022. https://wiki.debian.org/DebianReleases#Production_Releases
18+
# Debian 10 (Buster) EOL: 2024. https://wiki.debian.org/LTS
1919
#
20-
# - g++ version 6.3.0 (https://packages.debian.org/search?suite=stretch&arch=any&searchon=names&keywords=g%2B%2B)
21-
# - libc version 2.24 (https://packages.debian.org/search?suite=stretch&arch=any&searchon=names&keywords=libc6)
20+
# - libgcc version 8.3.0 (https://packages.debian.org/search?suite=buster&arch=any&searchon=names&keywords=libgcc1)
21+
# - libc version 2.28 (https://packages.debian.org/search?suite=buster&arch=any&searchon=names&keywords=libc6)
2222
#
23-
# Ubuntu 16.04 (Xenial) EOL: 2026. https://wiki.ubuntu.com/Releases
23+
# Ubuntu 18.04 (Bionic) EOL: 2028. https://wiki.ubuntu.com/ReleaseTeam
2424
#
25-
# - g++ version 5.3.1
26-
# - libc version 2.23
25+
# - libgcc version 8.4.0 (https://packages.ubuntu.com/bionic/libgcc1)
26+
# - libc version 2.27 (https://packages.ubuntu.com/bionic/libc6)
2727
#
2828
# CentOS Stream 8 EOL: 2024. https://wiki.centos.org/About/Product
2929
#
30-
# - g++ version 8.5.0 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
30+
# - libgcc version 8.5.0 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
3131
# - libc version 2.28 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
3232
#
3333
# See https://gcc.gnu.org/onlinedocs/libstdc++/manual/abi.html for more info.
3434

3535
MAX_VERSIONS = {
3636
'GCC': (4,8,0),
3737
'GLIBC': {
38-
lief.ELF.ARCH.x86_64: (2,18),
39-
lief.ELF.ARCH.ARM: (2,18),
40-
lief.ELF.ARCH.AARCH64:(2,18),
41-
lief.ELF.ARCH.PPC64: (2,18),
38+
lief.ELF.ARCH.x86_64: (2,27),
39+
lief.ELF.ARCH.ARM: (2,27),
40+
lief.ELF.ARCH.AARCH64:(2,27),
41+
lief.ELF.ARCH.PPC64: (2,27),
4242
lief.ELF.ARCH.RISCV: (2,27),
4343
},
4444
'LIBATOMIC': (1,0),

‎contrib/devtools/test-symbol-check.py

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -38,31 +38,6 @@ def test_ELF(self):
3838
executable = 'test1'
3939
cc = determine_wellknown_cmd('CC', 'gcc')
4040

41-
# there's no way to do this test for RISC-V at the moment; we build for
42-
# RISC-V in a glibc 2.27 environment and we allow all symbols from 2.27.
43-
if 'riscv' in get_machine(cc):
44-
self.skipTest("test not available for RISC-V")
45-
46-
# nextup was introduced in GLIBC 2.24, so is newer than our supported
47-
# glibc (2.18), and available in our release build environment (2.24).
48-
with open(source, 'w', encoding="utf8") as f:
49-
f.write('''
50-
#define _GNU_SOURCE
51-
#include <math.h>
52-
53-
double nextup(double x);
54-
55-
int main()
56-
{
57-
nextup(3.14);
58-
return 0;
59-
}
60-
''')
61-
62-
self.assertEqual(call_symbol_check(cc, source, executable, ['-lm']),
63-
(1, executable + ': symbol nextup from unsupported version GLIBC_2.24(3)\n' +
64-
executable + ': failed IMPORTED_SYMBOLS'))
65-
6641
# -lutil is part of the libc6 package so a safe bet that it's installed
6742
# it's also out of context enough that it's unlikely to ever become a real dependency
6843
source = 'test2.c'

‎contrib/guix/libexec/build.sh

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -238,13 +238,6 @@ case "$HOST" in
238238
*mingw*) HOST_LDFLAGS="-Wl,--no-insert-timestamp" ;;
239239
esac
240240

241-
# Using --no-tls-get-addr-optimize retains compatibility with glibc 2.18, by
242-
# avoiding a PowerPC64 optimisation available in glibc 2.22 and later.
243-
# https://sourceware.org/binutils/docs-2.35/ld/PowerPC64-ELF64.html
244-
case "$HOST" in
245-
*powerpc64*) HOST_LDFLAGS="${HOST_LDFLAGS} -Wl,--no-tls-get-addr-optimize" ;;
246-
esac
247-
248241
# Make $HOST-specific native binaries from depends available in $PATH
249242
export PATH="${BASEPREFIX}/${HOST}/native/bin:${PATH}"
250243
mkdir -p "$DISTSRC"

‎contrib/guix/manifest.scm

Lines changed: 14 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ chain for " target " development."))
147147
#:key
148148
(base-gcc-for-libc base-gcc)
149149
(base-kernel-headers base-linux-kernel-headers)
150-
(base-libc (make-glibc-with-bind-now (make-glibc-without-werror glibc-2.24)))
150+
(base-libc (hardened-glibc (make-glibc-without-werror glibc-2.27)))
151151
(base-gcc (make-gcc-rpath-link (hardened-gcc base-gcc))))
152152
"Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
153153
desirable for building Bitcoin Core release binaries."
@@ -537,48 +537,30 @@ inspecting signatures in Mach-O binaries.")
537537
(define (make-glibc-without-werror glibc)
538538
(package-with-extra-configure-variable glibc "enable_werror" "no"))
539539

540-
(define (make-glibc-with-stack-protector glibc)
541-
(package-with-extra-configure-variable glibc "--enable-stack-protector" "all"))
542-
543-
(define (make-glibc-with-bind-now glibc)
544-
(package-with-extra-configure-variable glibc "--enable-bind-now" "yes"))
545-
546-
(define-public glibc-2.24
547-
(package
548-
(inherit glibc-2.31)
549-
(version "2.24")
550-
(source (origin
551-
(method git-fetch)
552-
(uri (git-reference
553-
(url "https://sourceware.org/git/glibc.git")
554-
(commit "0d7f1ed30969886c8dde62fbf7d2c79967d4bace")))
555-
(file-name (git-file-name "glibc" "0d7f1ed30969886c8dde62fbf7d2c79967d4bace"))
556-
(sha256
557-
(base32
558-
"0g5hryia5v1k0qx97qffgwzrz4lr4jw3s5kj04yllhswsxyjbic3"))
559-
(patches (search-our-patches "glibc-ldd-x86_64.patch"
560-
"glibc-versioned-locpath.patch"
561-
"glibc-2.24-elfm-loadaddr-dynamic-rewrite.patch"
562-
"glibc-2.24-no-build-time-cxx-header-run.patch"
563-
"glibc-2.24-fcommon.patch"
564-
"glibc-2.24-guix-prefix.patch"))))))
540+
;; https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html
541+
(define (hardened-glibc glibc)
542+
(package-with-extra-configure-variable (
543+
package-with-extra-configure-variable glibc
544+
"--enable-stack-protector" "all")
545+
"--enable-bind-now" "yes"))
565546

566-
(define-public glibc-2.27/bitcoin-patched
547+
(define-public glibc-2.27
567548
(package
568549
(inherit glibc-2.31)
569550
(version "2.27")
570551
(source (origin
571552
(method git-fetch)
572553
(uri (git-reference
573554
(url "https://sourceware.org/git/glibc.git")
574-
(commit "23158b08a0908f381459f273a984c6fd328363cb")))
575-
(file-name (git-file-name "glibc" "23158b08a0908f381459f273a984c6fd328363cb"))
555+
(commit "73886db6218e613bd6d4edf529f11e008a6c2fa6")))
556+
(file-name (git-file-name "glibc" "73886db6218e613bd6d4edf529f11e008a6c2fa6"))
576557
(sha256
577558
(base32
578-
"1b2n1gxv9f4fd5yy68qjbnarhf8mf4vmlxk10i3328c1w5pmp0ca"))
559+
"0azpb9cvnbv25zg8019rqz48h8i2257ngyjg566dlnp74ivrs9vq"))
579560
(patches (search-our-patches "glibc-ldd-x86_64.patch"
561+
"glibc-versioned-locpath.patch"
580562
"glibc-2.27-riscv64-Use-__has_include-to-include-asm-syscalls.h.patch"
581-
"glibc-2.27-dont-redefine-nss-database.patch"
563+
"glibc-2.27-fcommon.patch"
582564
"glibc-2.27-guix-prefix.patch"))))))
583565

584566
(packages->manifest
@@ -627,12 +609,7 @@ inspecting signatures in Mach-O binaries.")
627609
(make-nsis-for-gcc-10 nsis-x86_64)
628610
osslsigncode))
629611
((string-contains target "-linux-")
630-
(list (cond ((string-contains target "riscv64-")
631-
(make-bitcoin-cross-toolchain target
632-
#:base-libc (make-glibc-with-stack-protector
633-
(make-glibc-with-bind-now (make-glibc-without-werror glibc-2.27/bitcoin-patched)))))
634-
(else
635-
(make-bitcoin-cross-toolchain target)))))
612+
(list (make-bitcoin-cross-toolchain target)))
636613
((string-contains target "darwin")
637614
(list clang-toolchain-10 binutils cmake xorriso python-signapple))
638615
(else '())))))

‎contrib/guix/patches/glibc-2.24-elfm-loadaddr-dynamic-rewrite.patch

Lines changed: 0 additions & 62 deletions
This file was deleted.

‎contrib/guix/patches/glibc-2.24-guix-prefix.patch

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎contrib/guix/patches/glibc-2.24-no-build-time-cxx-header-run.patch

Lines changed: 0 additions & 100 deletions
This file was deleted.

0 commit comments

Comments
 (0)