New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gnats: format hardened flag isn't supported #107435
gnats: format hardened flag isn't supported #107435
Conversation
When invoking a simple Ada program with `gcc` from `gnats10`, the following warnings are shown: ``` $ gcc -c conftest.adb gnat1: warning: command-line option ‘-Wformat=1’ is valid for C/C++/ObjC/ObjC++ but not for Ada gnat1: warning: command-line option ‘-Wformat-security’ is valid for C/C++/ObjC/ObjC++ but not for Ada gnat1: warning: ‘-Werror=’ argument ‘-Werror=format-security’ is not valid for Ada $ echo $? 0 ``` This is only spammy when compiling Ada programs inside a Nix derivation, but certain configure scripts (such as the ./configure script from the gcc that's built by coreboot's `make crossgcc` command) fail entirely when getting that warning output. https://nixos.wiki/wiki/Coreboot currently suggests manually running > NIX_HARDENING_ENABLE="${NIX_HARDENING_ENABLE/ format/}" make crossgcc … but actually teaching the nixpkgs-provided cc wrapper that `format` isn't supported as a hardening flag seems to be the more canonical way to do this in nixpgks. After this, Ada programs still compile: ``` $ gcc -c conftest.adb $ echo $? 0 ``` And the compiler output is empty.
Result of 6 packages built:
Only took 4 hours to build... |
Can you update this after the PR got merged? |
I have no memory of doing this, but it seems hacky. This is probably a better solution, but I'm not really an expert in any of this. |
Ah, what a coincidence! I'm trying to make a Nix expression for coreboot and have found this issue just a few hours ago. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The solution is definitely correct and I can confirm it fixes the gcc configure script.
@petabyteboy already has something for that: https://git.petabyte.dev/petabyteboy/corenix |
I updated the wiki and removed the hack there. |
Nice, I'll take a look. |
When invoking a simple Ada program with
gcc
fromgnats10
, thefollowing warnings are shown:
This is only spammy when compiling Ada programs inside a Nix derivation,
but certain configure scripts (such as the ./configure script from the
gcc that's built by coreboot's
make crossgcc
command) fail entirelywhen getting that warning output.
https://nixos.wiki/wiki/Coreboot currently suggests manually running
… but actually teaching the nixpkgs-provided cc wrapper that
format
isn't supported as a hardening flag seems to be the more canonical way
to do this in nixpgks.
After this, Ada programs still compile:
And the compiler output is empty.
cc @ajs124 due to the nixos wiki edit and @petabyteboy due to
coreboot-utils
:-)This shouldn't be a scary rebuild, as the default gcc doesn't have ada support enabled.
Motivation for this change
Build Coreboot on NixOS
Things done
sandbox
innix.conf
on non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
./result/bin/
)nix path-info -S
before and after)