treewide: remove usages of obsolete pie hardening flag (#449771)
This commit is contained in:
Philip Taron
@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
|
||||
faust2lv2
|
||||
];
|
||||
|
||||
# ld: crtbegin.o: relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a PIE object
|
||||
# ld: failed to set dynamic section sizes: bad value
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
dontWrapQtApps = true;
|
||||
|
||||
@@ -158,8 +158,6 @@ stdenv.mkDerivation rec {
|
||||
++ lib.concatMap (p: p.buildInputs) enabledPlugins
|
||||
++ extraBuildInputs;
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
env.NIX_CFLAGS_COMPILE =
|
||||
"-I${python}/include/${python.libPrefix}"
|
||||
# Fix '_res_9_init: undefined symbol' error
|
||||
|
||||
@@ -150,9 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
# Linking fails without this
|
||||
hardeningDisable = [ "format" ];
|
||||
|
||||
# Pie needs to be enabled or else it segfaults
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
preConfigure = ''
|
||||
# mirror 2ship's stb
|
||||
mkdir stb
|
||||
|
||||
@@ -16,7 +16,6 @@ stdenv.mkDerivation {
|
||||
hash = "sha256-rRJrtCcgfbqC/4qQiTVeUUcPqoJlNfitYRqIO58AmpA=";
|
||||
};
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
preBuild = ''
|
||||
# pipe2() is only exposed with _GNU_SOURCE
|
||||
# Upstream makefile explicitly uses -O3 to improve SHA-3 performance
|
||||
|
||||
@@ -62,8 +62,6 @@ stdenv.mkDerivation rec {
|
||||
enableParallelBuilding = true;
|
||||
doCheck = true;
|
||||
|
||||
hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
|
||||
|
||||
passthru.tests = {
|
||||
inherit (nixosTests) chrony chrony-ptp;
|
||||
};
|
||||
|
||||
@@ -53,8 +53,6 @@ stdenv.mkDerivation rec {
|
||||
"PKG_CONFIG=${buildPackages.pkg-config}/bin/${buildPackages.pkg-config.targetPrefix}pkg-config"
|
||||
];
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
postBuild = lib.optionalString stdenv.hostPlatform.isLinux ''
|
||||
make -C contrib/lease-tools
|
||||
'';
|
||||
|
||||
@@ -26,10 +26,6 @@ stdenv.mkDerivation rec {
|
||||
bash
|
||||
];
|
||||
|
||||
# ld: /nix/store/*-gcc-14-20241116/lib/gcc/x86_64-unknown-linux-gnu/14.2.1/crtbegin.o:
|
||||
# relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a PIE object
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
dontWrapQtApps = true;
|
||||
|
||||
buildPhase = ''
|
||||
|
||||
@@ -32,8 +32,6 @@ stdenv.mkDerivation rec {
|
||||
libopus
|
||||
];
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
meta = {
|
||||
description = "Server software for streaming multimedia";
|
||||
mainProgram = "icecast";
|
||||
|
||||
@@ -35,8 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
"DESTROOT=$(out)"
|
||||
];
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
unpackCmd = ''
|
||||
mkdir cron
|
||||
pushd cron
|
||||
|
||||
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
|
||||
"format"
|
||||
"pic"
|
||||
"relro"
|
||||
"pie"
|
||||
];
|
||||
|
||||
# Prevent kexec-tools from using uname to detect target, which is wrong in
|
||||
|
||||
@@ -57,8 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
|
||||
|
||||
# darwin currently lacks a pure `pgrep` which is extensively used here
|
||||
doCheck = !stdenv.hostPlatform.isDarwin;
|
||||
nativeCheckInputs = [
|
||||
|
||||
@@ -38,8 +38,6 @@ stdenv.mkDerivation rec {
|
||||
# Note: tcmalloc and mimalloc are also supported (and normal malloc)
|
||||
cmakeFlags = lib.optional enableJemalloc "-DUSE_ALTERNATIVE_MALLOC=jemalloc";
|
||||
|
||||
hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "pie";
|
||||
|
||||
meta = with lib; {
|
||||
description = "Lightweight high-performance multi-threaded web server";
|
||||
mainProgram = "lwan";
|
||||
|
||||
@@ -25,8 +25,6 @@ stdenv.mkDerivation rec {
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
configureFlags = [
|
||||
"--enable-default-colors"
|
||||
"--enable-widec"
|
||||
|
||||
@@ -25,8 +25,6 @@ stdenv.mkDerivation rec {
|
||||
libevent
|
||||
];
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
env.NIX_CFLAGS_COMPILE = toString (
|
||||
[ "-Wno-error=deprecated-declarations" ] ++ lib.optional stdenv.hostPlatform.isDarwin "-Wno-error"
|
||||
);
|
||||
|
||||
@@ -21,8 +21,6 @@ buildGoModule rec {
|
||||
|
||||
buildInputs = lib.optional stdenv.hostPlatform.isLinux libX11;
|
||||
|
||||
hardeningEnabled = [ "pie" ];
|
||||
|
||||
meta = {
|
||||
description = "Automated WireGuard® Management Client";
|
||||
mainProgram = "netclient";
|
||||
|
||||
@@ -45,8 +45,6 @@ stdenv.mkDerivation rec {
|
||||
libcap
|
||||
];
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
postInstall = ''
|
||||
rm -rf $out/share/doc
|
||||
'';
|
||||
|
||||
@@ -100,7 +100,6 @@ stdenv.mkDerivation rec {
|
||||
++ lib.optional withTLSRPT libtlsrpt;
|
||||
|
||||
hardeningDisable = [ "format" ];
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
patches = [
|
||||
./postfix-script-shell.patch
|
||||
|
||||
@@ -74,8 +74,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
]
|
||||
++ lib.optional gamemodeSupport gamemode;
|
||||
|
||||
hardeningEnable = lib.optionals stdenv.hostPlatform.isLinux [ "pie" ];
|
||||
|
||||
cmakeFlags = [
|
||||
# downstream branding
|
||||
(lib.cmakeFeature "Launcher_BUILD_PLATFORM" "nixpkgs")
|
||||
|
||||
@@ -68,8 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
|
||||
|
||||
env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [ "-std=c11" ]);
|
||||
|
||||
# darwin currently lacks a pure `pgrep` which is extensively used here
|
||||
|
||||
@@ -66,8 +66,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
|
||||
|
||||
env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isFreeBSD "-lexecinfo";
|
||||
|
||||
# darwin currently lacks a pure `pgrep` which is extensively used here
|
||||
|
||||
@@ -56,8 +56,6 @@ stdenv.mkDerivation rec {
|
||||
})
|
||||
];
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
nativeBuildInputs = [
|
||||
cmake
|
||||
pkg-config
|
||||
|
||||
@@ -104,10 +104,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
fi
|
||||
'';
|
||||
|
||||
# ${src}/support/cpp/gcc/Makefile.in states:
|
||||
# We don't want to compile the compilers with -fPIE, it make PCH fail.
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
meta = {
|
||||
homepage = "https://sdcc.sourceforge.net/";
|
||||
description = "Small Device C Compiler";
|
||||
|
||||
@@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
hardeningDisable = [
|
||||
"fortify"
|
||||
"pic"
|
||||
"pie" # ld: warning: creating DT_TEXTREL in a PIE (and more)
|
||||
"stackprotector"
|
||||
];
|
||||
|
||||
|
||||
@@ -15,8 +15,6 @@ stdenv.mkDerivation {
|
||||
sha256 = "1sj7a77isc2jmh7gw2naw9l9366kjx6jb909h7spj7daxdwvji8f";
|
||||
};
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
preConfigure = ''
|
||||
makeFlags=( "PREFIX=$out" )
|
||||
'';
|
||||
|
||||
@@ -38,8 +38,6 @@ stdenv.mkDerivation rec {
|
||||
readline
|
||||
];
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
nativeCheckInputs = [
|
||||
|
||||
@@ -40,8 +40,6 @@ stdenv.mkDerivation {
|
||||
hash = "sha256-KbeY667Y/ZPUuRIGYOZMMAuVEVJ7Kn9UDUSThX5zfII=";
|
||||
};
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
configurePhase = ''
|
||||
runHook preConfigure
|
||||
sh configure.sh --prefix=/
|
||||
|
||||
@@ -24,8 +24,6 @@ buildGoModule rec {
|
||||
"-w"
|
||||
];
|
||||
|
||||
hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
|
||||
|
||||
passthru.updateScript = nix-update-script { };
|
||||
|
||||
meta = {
|
||||
|
||||
@@ -83,7 +83,6 @@ stdenv.mkDerivation {
|
||||
|
||||
hardeningDisable = [
|
||||
"pic"
|
||||
"pie" # MBR gets too big with PIE
|
||||
"stackprotector"
|
||||
"fortify"
|
||||
];
|
||||
|
||||
@@ -41,7 +41,6 @@ stdenv.mkDerivation rec {
|
||||
];
|
||||
|
||||
hardeningDisable = [
|
||||
"pie"
|
||||
"stackprotector"
|
||||
];
|
||||
|
||||
|
||||
@@ -64,8 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
|
||||
|
||||
env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [ "-std=c11" ]);
|
||||
|
||||
# darwin currently lacks a pure `pgrep` which is extensively used here
|
||||
|
||||
@@ -80,9 +80,6 @@ stdenv.mkDerivation rec {
|
||||
"FPC=${startFPC}/bin/fpc"
|
||||
];
|
||||
|
||||
# disabled by default in fpcsrc/compiler/llvm/agllvm.pas
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
installFlags = [ "INSTALL_PREFIX=\${out}" ];
|
||||
|
||||
postInstall = ''
|
||||
|
||||
@@ -234,7 +234,6 @@ pipe
|
||||
|
||||
hardeningDisable = [
|
||||
"format"
|
||||
"pie"
|
||||
"stackclashprotection"
|
||||
];
|
||||
|
||||
|
||||
@@ -474,13 +474,6 @@ stdenv.mkDerivation {
|
||||
"$out/bin/ghc-pkg" --package-db="$package_db" recache
|
||||
'';
|
||||
|
||||
# GHC cannot currently produce outputs that are ready for `-pie` linking.
|
||||
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
|
||||
# See:
|
||||
# * https://github.com/NixOS/nixpkgs/issues/129247
|
||||
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
doInstallCheck = true;
|
||||
installCheckPhase = ''
|
||||
# Sanity check, can ghc create executables?
|
||||
|
||||
@@ -438,13 +438,6 @@ stdenv.mkDerivation {
|
||||
"$out/bin/ghc-pkg" --package-db="$package_db" recache
|
||||
'';
|
||||
|
||||
# GHC cannot currently produce outputs that are ready for `-pie` linking.
|
||||
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
|
||||
# See:
|
||||
# * https://github.com/NixOS/nixpkgs/issues/129247
|
||||
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
doInstallCheck = true;
|
||||
installCheckPhase = ''
|
||||
# Sanity check, can ghc create executables?
|
||||
|
||||
@@ -417,13 +417,6 @@ stdenv.mkDerivation {
|
||||
"$out/bin/ghc-pkg" --package-db="$package_db" recache
|
||||
'';
|
||||
|
||||
# GHC cannot currently produce outputs that are ready for `-pie` linking.
|
||||
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
|
||||
# See:
|
||||
# * https://github.com/NixOS/nixpkgs/issues/129247
|
||||
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
doInstallCheck = true;
|
||||
installCheckPhase = ''
|
||||
# Sanity check, can ghc create executables?
|
||||
|
||||
@@ -432,13 +432,6 @@ stdenv.mkDerivation {
|
||||
"$out/bin/ghc-pkg" --package-db="$package_db" recache
|
||||
'';
|
||||
|
||||
# GHC cannot currently produce outputs that are ready for `-pie` linking.
|
||||
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
|
||||
# See:
|
||||
# * https://github.com/NixOS/nixpkgs/issues/129247
|
||||
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
doInstallCheck = true;
|
||||
installCheckPhase = ''
|
||||
# Sanity check, can ghc create executables?
|
||||
|
||||
@@ -780,14 +780,8 @@ stdenv.mkDerivation (
|
||||
|
||||
checkTarget = "test";
|
||||
|
||||
# GHC cannot currently produce outputs that are ready for `-pie` linking.
|
||||
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
|
||||
# See:
|
||||
# * https://github.com/NixOS/nixpkgs/issues/129247
|
||||
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
|
||||
hardeningDisable = [
|
||||
"format"
|
||||
"pie"
|
||||
];
|
||||
|
||||
# big-parallel allows us to build with more than 2 cores on
|
||||
|
||||
@@ -600,14 +600,8 @@ stdenv.mkDerivation (
|
||||
|
||||
checkTarget = "test";
|
||||
|
||||
# GHC cannot currently produce outputs that are ready for `-pie` linking.
|
||||
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
|
||||
# See:
|
||||
# * https://github.com/NixOS/nixpkgs/issues/129247
|
||||
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
|
||||
hardeningDisable = [
|
||||
"format"
|
||||
"pie"
|
||||
];
|
||||
|
||||
# big-parallel allows us to build with more than 2 cores on
|
||||
|
||||
@@ -134,8 +134,7 @@ stdenv.mkDerivation (
|
||||
];
|
||||
# x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
|
||||
hardeningDisable =
|
||||
lib.optional (lib.versionAtLeast version "4.09" && stdenv.hostPlatform.isMusl) "pie"
|
||||
++ lib.optional (lib.versionAtLeast version "5.0" && stdenv.cc.isClang) "strictoverflow"
|
||||
lib.optional (lib.versionAtLeast version "5.0" && stdenv.cc.isClang) "strictoverflow"
|
||||
++ lib.optionals (args ? hardeningDisable) args.hardeningDisable;
|
||||
|
||||
# Older versions have some race:
|
||||
|
||||
@@ -39,7 +39,6 @@ let
|
||||
|
||||
static_gtest = gtest.overrideAttrs (old: {
|
||||
dontDisableStatic = true;
|
||||
disableHardening = [ "pie" ];
|
||||
cmakeFlags = old.cmakeFlags ++ [ "-DBUILD_SHARED_LIBS=OFF" ];
|
||||
});
|
||||
|
||||
|
||||
@@ -730,13 +730,7 @@ lib.fix (
|
||||
# package specifies `hardeningDisable`.
|
||||
hardeningDisable =
|
||||
lib.optionals (args ? hardeningDisable) hardeningDisable
|
||||
++ lib.optional (ghc.isHaLVM or false) "all"
|
||||
# Static libraries (ie. all of pkgsStatic.haskellPackages) fail to build
|
||||
# because by default Nix adds `-pie` to the linker flags: this
|
||||
# conflicts with the `-r` and `-no-pie` flags added by GHC (see
|
||||
# https://gitlab.haskell.org/ghc/ghc/-/issues/19580). hardeningDisable
|
||||
# changes the default Nix behavior regarding adding "hardening" flags.
|
||||
++ lib.optional enableStaticLibraries "pie";
|
||||
++ lib.optional (ghc.isHaLVM or false) "all";
|
||||
|
||||
configurePhase = ''
|
||||
runHook preConfigure
|
||||
|
||||
@@ -122,11 +122,6 @@ stdenv.mkDerivation {
|
||||
cd builddir
|
||||
'';
|
||||
|
||||
# ;; Loading file ../src/defmacro.lisp ...
|
||||
# *** - handle_fault error2 ! address = 0x8 not in [0x1000000c0000,0x1000000c0000) !
|
||||
# SIGSEGV cannot be cured. Fault address = 0x8.
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
doCheck = true;
|
||||
|
||||
postInstall = lib.optionalString (withModules != [ ]) ''
|
||||
|
||||
@@ -584,9 +584,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
export CFLAGS_NODIST="-fno-semantic-interposition"
|
||||
'';
|
||||
|
||||
# Our aarch64-linux bootstrap files lack Scrt1.o, which fails the config test
|
||||
hardeningEnable = lib.optionals (!withMinimalDeps && !stdenv.hostPlatform.isAarch64) [ "pie" ];
|
||||
|
||||
setupHook = python-setup-hook sitePackages;
|
||||
|
||||
postInstall =
|
||||
|
||||
@@ -48,8 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
sourceRoot=$(readlink -e "./libgcc")
|
||||
'';
|
||||
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
preConfigure = ''
|
||||
# Drop in libiberty, as external builds are not expected
|
||||
cd "$buildRoot"
|
||||
|
||||
@@ -58,12 +58,11 @@ in
|
||||
makeFlagsArray+=("bindir=$bin/bin" "sbindir=$bin/sbin" "rootsbindir=$bin/sbin")
|
||||
'';
|
||||
|
||||
# The pie, stackprotector and fortify hardening flags are autodetected by
|
||||
# The stackprotector and fortify hardening flags are autodetected by
|
||||
# glibc and enabled by default if supported. Setting it for every gcc
|
||||
# invocation does not work.
|
||||
hardeningDisable = [
|
||||
"fortify"
|
||||
"pie"
|
||||
"stackprotector"
|
||||
"strictflexarrays3"
|
||||
];
|
||||
|
||||
@@ -24,9 +24,6 @@ buildDunePackage rec {
|
||||
export sourceRoot=$PWD
|
||||
'';
|
||||
|
||||
# x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
|
||||
hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
|
||||
|
||||
nativeBuildInputs = [
|
||||
menhir
|
||||
odoc
|
||||
|
||||
@@ -35,9 +35,6 @@ buildGoModule (finalAttrs: {
|
||||
|
||||
doCheck = false;
|
||||
|
||||
# /nix/store/.../bin/ld: internal/mkcw/embed/entrypoint_amd64.o: relocation R_X86_64_32S against `.rodata.1' can not be used when making a PIE object; recompile with -fPIE
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
nativeBuildInputs = [
|
||||
go-md2man
|
||||
installShellFiles
|
||||
|
||||
@@ -179,7 +179,6 @@ stdenv.mkDerivation {
|
||||
|
||||
hardeningDisable = [
|
||||
"format"
|
||||
"pie"
|
||||
];
|
||||
|
||||
configurePlatforms = [
|
||||
|
||||
@@ -209,7 +209,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
hardeningDisable = [
|
||||
"format"
|
||||
"pie"
|
||||
];
|
||||
|
||||
configurePlatforms = [
|
||||
|
||||
@@ -31,9 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
];
|
||||
strictDeps = true;
|
||||
|
||||
# x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
|
||||
hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
|
||||
|
||||
configurePhase = ''
|
||||
runHook preConfigure
|
||||
|
||||
|
||||
@@ -69,7 +69,6 @@ stdenv.mkDerivation rec {
|
||||
|
||||
hardeningDisable = [
|
||||
"format"
|
||||
"pie"
|
||||
]
|
||||
++ lib.optionals enableStatic [ "fortify" ];
|
||||
|
||||
|
||||
@@ -573,7 +573,6 @@ lib.makeOverridable (
|
||||
"fortify"
|
||||
"stackprotector"
|
||||
"pic"
|
||||
"pie"
|
||||
];
|
||||
|
||||
makeFlags = [
|
||||
|
||||
@@ -254,8 +254,6 @@ stdenv.mkDerivation {
|
||||
--replace-fail '@nixStoreDirLen@' "''${#NIX_STORE}"
|
||||
'' postPatch;
|
||||
|
||||
hardeningEnable = lib.optional (!stdenv.hostPlatform.isDarwin) "pie";
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
preInstall = ''
|
||||
|
||||
@@ -137,8 +137,6 @@ stdenv.mkDerivation rec {
|
||||
|
||||
preConfigure = (lib.concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
|
||||
|
||||
hardeningEnable = optional (!stdenv.hostPlatform.isDarwin) "pie";
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
postInstall = ''
|
||||
|
||||
@@ -169,8 +169,6 @@ stdenv.mkDerivation rec {
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
meta = with lib; {
|
||||
description = "Scalable, high-performance, open source NoSQL database";
|
||||
homepage = "http://www.mongodb.org";
|
||||
|
||||
@@ -52,8 +52,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
__structuredAttrs = true;
|
||||
|
||||
hardeningEnable = lib.optionals (!stdenv.cc.isClang) [ "pie" ];
|
||||
|
||||
outputs = [
|
||||
"out"
|
||||
"dev"
|
||||
|
||||
@@ -151,7 +151,6 @@ let
|
||||
"nostrictaliasing"
|
||||
"pacret"
|
||||
"pic"
|
||||
"pie"
|
||||
"relro"
|
||||
"stackprotector"
|
||||
"glibcxxassertions"
|
||||
@@ -439,7 +438,7 @@ let
|
||||
else
|
||||
subtractLists hardeningDisable' (defaultHardeningFlags ++ hardeningEnable);
|
||||
# hardeningDisable additionally supports "all".
|
||||
erroneousHardeningFlags = subtractLists knownHardeningFlags (
|
||||
erroneousHardeningFlags = subtractLists (knownHardeningFlags ++ [ "pie" ]) (
|
||||
hardeningEnable ++ remove "all" hardeningDisable
|
||||
);
|
||||
|
||||
@@ -637,7 +636,9 @@ let
|
||||
else
|
||||
null
|
||||
} =
|
||||
builtins.concatStringsSep " " enabledHardeningOptions;
|
||||
lib.warnIf ((builtins.elem "pie" hardeningEnable) || (builtins.elem "pie" hardeningDisable))
|
||||
"The 'pie' hardening flag has been removed in favor of enabling PIE by default in compilers and should no longer be used. PIE can be disabled with the -no-pie compiler flag, but this is usually not necessary as most build systems pass this if needed. Usage of the 'pie' hardening flag will become an error in future."
|
||||
(builtins.concatStringsSep " " enabledHardeningOptions);
|
||||
|
||||
# TODO: remove platform condition
|
||||
# Enabling this check could be a breaking change as it requires to edit nix.conf
|
||||
|
||||
@@ -696,7 +696,6 @@ nameDrvAfterAttrName (
|
||||
relROExplicitDisabled = brokenIf true (
|
||||
checkTestBin
|
||||
(f2exampleWithStdEnv stdenv {
|
||||
hardeningDisable = [ "pie" ];
|
||||
})
|
||||
{
|
||||
ignoreRelRO = false;
|
||||
@@ -1202,7 +1201,6 @@ nameDrvAfterAttrName (
|
||||
hardeningDisable = [ "all" ];
|
||||
hardeningEnable = [
|
||||
"fortify"
|
||||
"pie"
|
||||
];
|
||||
};
|
||||
in
|
||||
|
||||
@@ -136,8 +136,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
doCheck = false;
|
||||
enableParallelChecking = false;
|
||||
nativeCheckInputs = [
|
||||
|
||||
@@ -32,8 +32,6 @@ stdenv.mkDerivation rec {
|
||||
})
|
||||
];
|
||||
|
||||
hardeningEnable = [ "pie" ];
|
||||
|
||||
nativeBuildInputs = [
|
||||
autoreconfHook
|
||||
w3m
|
||||
|
||||
@@ -373,7 +373,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
# fortify breaks the build with lto and musl for some reason
|
||||
++ lib.optional stdenv.hostPlatform.isMusl "fortify";
|
||||
|
||||
# hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
|
||||
separateDebugInfo = stdenv.hostPlatform.isLinux && !enableStatic;
|
||||
enableParallelBuilding = true;
|
||||
|
||||
|
||||
@@ -101,8 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
"doc"
|
||||
];
|
||||
|
||||
hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
|
||||
|
||||
hardeningDisable = [
|
||||
"shadowstack"
|
||||
]
|
||||
|
||||
@@ -150,7 +150,6 @@ let
|
||||
pkg-config
|
||||
];
|
||||
separateDebugInfo = !stdenv.hostPlatform.isStatic;
|
||||
hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
|
||||
};
|
||||
|
||||
mesonLibraryLayer = finalAttrs: prevAttrs: {
|
||||
|
||||
@@ -32,12 +32,6 @@ stdenv.mkDerivation rec {
|
||||
hash = "sha256-+MNIZQnecFGSE4sA7ywAu73Q6Eww1cB9I/xzqdxMycw=";
|
||||
};
|
||||
|
||||
# PIE is incompatible with the "persistent malloc" ("pma") feature.
|
||||
# While build system attempts to pass -no-pie to gcc. nixpkgs' `ld`
|
||||
# wrapped still passes `-pie` flag to linker and breaks linkage.
|
||||
# Let's disable "pie" until `ld` is fixed to do the right thing.
|
||||
hardeningDisable = [ "pie" ];
|
||||
|
||||
# When we do build separate interactive version, it makes sense to always include man.
|
||||
outputs = [
|
||||
"out"
|
||||
|
||||
Reference in New Issue
Block a user