Bug 1543859

Summary: nodejs: Fedora build flags only partially applied
Product: [Fedora] Fedora Reporter: Florian Weimer <fweimer>
Component: nodejsAssignee: NodeJS Packaging SIG <nodejs-sig>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 28CC: alessandro.polidori, athmanem, jamielinux, mrunge, nodejs-sig, piotr1212, sgallagh, tchollingsworth, thrcka, zsvetlik
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: nodejs-10-20180501175322.c7b355af nodejs-8.11.2-1.fc28 nodejs-8.11.2-1.fc27 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-05-23 15:39:56 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1539083    

Description Florian Weimer 2018-02-09 12:41:40 UTC
/usr/bin/node in nodejs-8.9.4-2.fc28.x86_64 and /usr/bin/node_g in nodejs-devel-8.9.4-2.fc28.x86_64 have not been linked with the standard Fedora linker flags (LDFLAGS) from redhat-rpm-config.

More information about RPM macros to set CFLAGS and LDFLAGS is available here:
https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md

Comment 1 Fedora End Of Life 2018-02-20 15:24:01 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle.
Changing version to '28'.

Comment 2 Fedora Update System 2018-05-01 19:43:45 UTC
nodejs-10-20180501175322.c7b355af has been submitted as an update to Fedora 28 Modular. https://bodhi.fedoraproject.org/updates/FEDORA-MODULAR-2018-2b0846cb86

Comment 3 Fedora Update System 2018-05-02 09:07:00 UTC
nodejs-10-20180501175322.c7b355af has been pushed to the Fedora 28 Modular testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-MODULAR-2018-2b0846cb86

Comment 4 Florian Weimer 2018-05-07 12:25:15 UTC
/usr/bin/node, /usr/bin/node_g in nodejs-1:8.11.0-1.fc28.x86_64 and nodejs-devel-1:8.11.0-1.fc28.x86_64 are still do not use full ASLR (PIE) and RELRO (BIND_NOW).

Comment 5 Stephen Gallagher 2018-05-07 12:29:07 UTC
(In reply to Florian Weimer from comment #4)
> /usr/bin/node, /usr/bin/node_g in nodejs-1:8.11.0-1.fc28.x86_64 and
> nodejs-devel-1:8.11.0-1.fc28.x86_64 are still do not use full ASLR (PIE) and
> RELRO (BIND_NOW).

This will be fixed on the next build of Node.js 8.x. In the meantime, can you confirm that it *is* fixed in the 10.x module stream?

Comment 6 Florian Weimer 2018-05-07 12:32:26 UTC
(In reply to Stephen Gallagher from comment #5)
> (In reply to Florian Weimer from comment #4)
> > /usr/bin/node, /usr/bin/node_g in nodejs-1:8.11.0-1.fc28.x86_64 and
> > nodejs-devel-1:8.11.0-1.fc28.x86_64 are still do not use full ASLR (PIE) and
> > RELRO (BIND_NOW).
> 
> This will be fixed on the next build of Node.js 8.x. In the meantime, can
> you confirm that it *is* fixed in the 10.x module stream?

Sorry, I can't tell from

https://koji.fedoraproject.org/koji/buildinfo?buildID=1078203

what actually went into the modular build.

Comment 7 Stephen Gallagher 2018-05-07 12:35:48 UTC
https://koji.fedoraproject.org/koji/buildinfo?buildID=1078177 is the actual package build that was included in the module.

Comment 8 Florian Weimer 2018-05-07 13:50:27 UTC
(In reply to Stephen Gallagher from comment #7)
> https://koji.fedoraproject.org/koji/buildinfo?buildID=1078177 is the actual
> package build that was included in the module.

I can't find node_g anymore, but /usr/bin/node in nodejs-10.0.0-1.module_1716+9b6ad2c1.x86_64 looks okay.  Thanks.

Comment 9 Stephen Gallagher 2018-05-07 13:52:06 UTC
(In reply to Florian Weimer from comment #8)
> (In reply to Stephen Gallagher from comment #7)
> > https://koji.fedoraproject.org/koji/buildinfo?buildID=1078177 is the actual
> > package build that was included in the module.
> 
> I can't find node_g anymore, but /usr/bin/node in
> nodejs-10.0.0-1.module_1716+9b6ad2c1.x86_64 looks okay.  Thanks.

node_g is temporarily disabled because it fails to build due to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85587

As soon as that hits the buildroot, I'll get it back in.

Comment 10 Fedora Update System 2018-05-10 14:19:16 UTC
nodejs-10-20180501175322.c7b355af has been pushed to the Fedora 28 Modular stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2018-05-18 17:32:35 UTC
nodejs-8.11.2-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-62bf1ccab6

Comment 12 Fedora Update System 2018-05-18 17:32:47 UTC
nodejs-8.11.2-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-d7cd949ce2

Comment 13 Fedora Update System 2018-05-19 01:48:52 UTC
nodejs-8.11.2-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-d7cd949ce2

Comment 14 Fedora Update System 2018-05-19 04:21:59 UTC
nodejs-8.11.2-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-62bf1ccab6

Comment 15 Fedora Update System 2018-05-23 15:39:56 UTC
nodejs-8.11.2-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2018-05-30 14:31:59 UTC
nodejs-8.11.2-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.