b78b16e24a
Update the compiler and linker flags for RHEL 10 by incorporating the
distribution's defaults from RHEL 10.0 Beta, because RHEL 10.0 is still
early in its development cycle and the defaults may be in a state of
flux. Some exceptions are mentioned below.
The '-z pack-relative-relocs' linker flag was left out. It's currently
not supported on s390x, so using it would require architecture specific
patches, which is a hassle. Support for aarch64 was recently added [1],
so hopefully s390x will also be supported soon.
The change to use the RPM's %{name}, %{version}, %{release} and the
SOURCE_DATE_EPOCH environment variable [2], instead of /dev/urandom, to
generate the build ID annotation for the toolbox(1) binary [3] was left
out. It will need more work to propagate the RPM's %{name}, %{version}
and %{release} to Meson.
The 'rpminspect --tests=elf' test run by the downstream CI was silenced
because toolbox(1) is only built with the '-z relro' linker flag, but
not '-z now' [4]. Otherwise, it fails with:
/usr/bin/toolbox lost full GNU_RELRO security protection
Stop carrying the downstream patch for the compiler and linker flags for
PPC64. The architecture was already discontinued from Fedora 29 [5],
even before the patch was added [6]. It was added purely for the sake
of completeness, and in the last four years since it was introduced, it
hasn't been tested or used. At this point it's becoming too much of a
maintenance burden, and removing it silences the %ifarch-applied-patch
warning from rpmlint.
Fill in some of the missing Requires for the toolbox-tests sub-package.
[1] CentOS Stream redhat-rpm-config commit 3c5a6b17540b2a0b
https://gitlab.com/redhat/centos-stream/rpms/redhat-rpm-config/-/commit/3c5a6b17540b2a0b
https://gitlab.com/redhat/centos-stream/rpms/redhat-rpm-config/-/merge_requests/42
https://issues.redhat.com/browse/RHEL-40379
[2] https://reproducible-builds.org/docs/source-date-epoch/
[3] go-rpm-macros commit 1980932bf3a21890
https://pagure.io/go-rpm-macros/c/1980932bf3a21890
https://fedoraproject.org/wiki/Changes/ReproduciblePackageBuilds
[4] Upstream commit 83f28c52e47c2d44
https://github.com/containers/toolbox/commit/83f28c52e47c2d44
https://github.com/containers/toolbox/pull/1548
[5] https://fedoraproject.org/wiki/Changes/DiscontinuePPC64
[6] Fedora toolbox commit ba60453d21
https://src.fedoraproject.org/rpms/toolbox/c/ba60453d216a9226
https://src.fedoraproject.org/rpms/toolbox/pull-request/2
Resolves: RHEL-61579
17 lines
363 B
YAML
17 lines
363 B
YAML
# https://github.com/rpminspect/rpminspect/blob/master/data/generic.yaml
|
|
# https://github.com/rpminspect/rpminspect-data-fedora/blob/main/fedora.yaml
|
|
|
|
---
|
|
|
|
annocheck:
|
|
extra_opts:
|
|
hardened: --skip-run-path --skip-stack-prot
|
|
|
|
elf:
|
|
exclude_path: /usr/bin/toolbox
|
|
|
|
runpath:
|
|
allowed_paths:
|
|
- /run/host/usr/lib
|
|
- /run/host/usr/lib64
|