Bug 2044879

Failed test: bind-now test

Test results:
\n Hardened: ctype.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: dirent.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: errno.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: fcntl.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: fnmatch.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: glob.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: grp.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: libgen.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: poll.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: pwd.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: sched.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: signal.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: stdio.so: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: st

Applicable RPMs:
lua-posix-35.0-5.el9.aarch64.rpm; lua-posix-35.0-5.el9.ppc64le.rpm; lua-posix-35.0-5.el9.s390x.rpm; lua-posix-35.0-5.el9.x86_64.rpm

Recommendation: Please fix the build system for the package or else add a skip of tests to the rpminspect.yaml file. For more details please see https://sourceware.org/annobin/annobin.html/Test-bind-now.html and https://sourceware.org/annobin/annobin.html/Waiving-Hardened-Results.html#Waiving-Hardened-Results.

Why this bug was filed: All packages in RHEL 9 built with gcc (g++, etc.) are required to use a common set of flags provided by the distribution. These flags turn on important security and performance features so it is critical that any package that lacks these flags be repaired. A scanning tool named annocheck, part of the annobin package, was used to scan RHEL 9 packages. This BZ was created because binary packages of this component with the mentioned NVRs were not built with the requisite flags for one or more RHEL 9 architectures.

How to reproduce the failure: You could try running annocheck locally against your builds: https://developers.redhat.com/blog/2019/02/04/annocheck-examining-the-contents-of-binary-files.

Annocheck resources:
* annobin documentation: https://sourceware.org/annobin/annobin.html/index.html
* annocheck on the customer portal: https://access.redhat.com/documentation/en-us/red_hat_developer_toolset/9/html/user_guide/chap-annobin

Contacts:
* Instant messaging: #tools on IRC
* Email: use tools for generic questions. Otherwise, use go-tools and llvm-clang-list for Go and Clang/LLVM specific questions.
* annobin-annocheck maintainer: Nick Clifton (nickc)