From 96c58a5dc559b35cd616013bb3cd2139fcfdcdc1 Mon Sep 17 00:00:00 2001 From: Lokesh Mandvekar Date: Fri, 16 Jul 2021 11:34:13 -0400 Subject: [PATCH] adjust hardening flags for s390x otherwise build fails Signed-off-by: Lokesh Mandvekar --- buildah.spec | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/buildah.spec b/buildah.spec index a81dc99..746c34f 100644 --- a/buildah.spec +++ b/buildah.spec @@ -110,15 +110,17 @@ popd mv vendor src export GOPATH=$(pwd)/_build:$(pwd) -export CGO_CFLAGS="-O2 -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -ffat-lto-objects -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64" -%ifarch x86_64 -export CGO_CFLAGS="$CGO_CFLAGS -m64 -mtune=generic" -%if 0%{?fedora} || 0%{?centos} >= 8 -export CGO_CFLAGS="$CGO_CFLAGS -fcf-protection" +#export CGO_CFLAGS="-O2 -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -ffat-lto-objects -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64" +export CGO_CFLAGS="-O2 -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -ffat-lto-objects -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE" +# FIXME: Investigate why this fails +%ifnarch s390x +export CGO_CFLAGS+=" -D_FILE_OFFSET_BITS=64" %endif +%ifarch x86_64 +export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full" %endif # These extra flags present in %%{optflags} have been skipped for now as they break the build -#export CGO_CFLAGS="$CGO_CFLAGS -flto=auto -Wp,D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1" +#export CGO_CFLAGS+=" -flto=auto -Wp,D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1" export BUILDTAGS='seccomp selinux' %if 0%{?centos} >= 8