Bug 2047148

Summary: -D_FORTIFY_SOURCE not defined on x86_64
Product: [Fedora] Fedora Reporter: Vitaly <vitaly>
Component: annobinAssignee: Nick Clifton <nickc>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: aoliva, dmalcolm, fweimer, jakub, jwakely, law, mpolacek, msebor, nickc, rjones, sipoyare
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-01-27 11:35:06 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2046784, 2047002    

Description Vitaly 2022-01-27 10:05:54 UTC
Description of problem:
error: -D_FORTIFY_SOURCE not defined [-Werror]

Version-Release number of selected component (if applicable):
gcc-12.0.1-0.3.fc36.x86_64
annobin-plugin-gcc-10.48-4.fc36.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. fedpkg clone -a semver
2. fedpkg scratch-build --arch x86_64

Actual results:
[1/8] /usr/bin/g++  -I/builddir/build/BUILD/semver-0.3.0/include -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DNDEBUG -Wall -Wextra -pedantic-errors -Werror -MD -MT example/CMakeFiles/range_example.dir/range_example.cpp.o -MF example/CMakeFiles/range_example.dir/range_example.cpp.o.d -o example/CMakeFiles/range_example.dir/range_example.cpp.o -c /builddir/build/BUILD/semver-0.3.0/example/range_example.cpp
FAILED: example/CMakeFiles/range_example.dir/range_example.cpp.o 
/usr/bin/g++  -I/builddir/build/BUILD/semver-0.3.0/include -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DNDEBUG -Wall -Wextra -pedantic-errors -Werror -MD -MT example/CMakeFiles/range_example.dir/range_example.cpp.o -MF example/CMakeFiles/range_example.dir/range_example.cpp.o.d -o example/CMakeFiles/range_example.dir/range_example.cpp.o -c /builddir/build/BUILD/semver-0.3.0/example/range_example.cpp
/builddir/build/BUILD/semver-0.3.0/example/range_example.cpp: error: -D_FORTIFY_SOURCE not defined [-Werror]
annobin: /builddir/build/BUILD/semver-0.3.0/example/range_example.cpp: Warning: -D_GLIBCXX_ASSERTIONS not defined
cc1plus: all warnings being treated as errors
[2/8] /usr/bin/g++  -I/builddir/build/BUILD/semver-0.3.0/include -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DNDEBUG -Wall -Wextra -pedantic-errors -Werror -MD -MT example/CMakeFiles/basic_example.dir/basic_example.cpp.o -MF example/CMakeFiles/basic_example.dir/basic_example.cpp.o.d -o example/CMakeFiles/basic_example.dir/basic_example.cpp.o -c /builddir/build/BUILD/semver-0.3.0/example/basic_example.cpp
FAILED: example/CMakeFiles/basic_example.dir/basic_example.cpp.o 
/usr/bin/g++  -I/builddir/build/BUILD/semver-0.3.0/include -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DNDEBUG -Wall -Wextra -pedantic-errors -Werror -MD -MT example/CMakeFiles/basic_example.dir/basic_example.cpp.o -MF example/CMakeFiles/basic_example.dir/basic_example.cpp.o.d -o example/CMakeFiles/basic_example.dir/basic_example.cpp.o -c /builddir/build/BUILD/semver-0.3.0/example/basic_example.cpp
/builddir/build/BUILD/semver-0.3.0/example/basic_example.cpp: error: -D_FORTIFY_SOURCE not defined [-Werror]
annobin: /builddir/build/BUILD/semver-0.3.0/example/basic_example.cpp: Warning: -D_GLIBCXX_ASSERTIONS not defined
cc1plus: all warnings being treated as errors
[3/8] /usr/bin/g++  -I/builddir/build/BUILD/semver-0.3.0/test/3rdparty/Catch2 -I/builddir/build/BUILD/semver-0.3.0/include -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DNDEBUG -Wall -Wextra -pedantic-errors -Werror -std=c++17 -MD -MT test/CMakeFiles/semver-cpp17.t.dir/test.cpp.o -MF test/CMakeFiles/semver-cpp17.t.dir/test.cpp.o.d -o test/CMakeFiles/semver-cpp17.t.dir/test.cpp.o -c /builddir/build/BUILD/semver-0.3.0/test/test.cpp
FAILED: test/CMakeFiles/semver-cpp17.t.dir/test.cpp.o 
/usr/bin/g++  -I/builddir/build/BUILD/semver-0.3.0/test/3rdparty/Catch2 -I/builddir/build/BUILD/semver-0.3.0/include -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DNDEBUG -Wall -Wextra -pedantic-errors -Werror -std=c++17 -MD -MT test/CMakeFiles/semver-cpp17.t.dir/test.cpp.o -MF test/CMakeFiles/semver-cpp17.t.dir/test.cpp.o.d -o test/CMakeFiles/semver-cpp17.t.dir/test.cpp.o -c /builddir/build/BUILD/semver-0.3.0/test/test.cpp
/builddir/build/BUILD/semver-0.3.0/test/test.cpp: error: -D_FORTIFY_SOURCE not defined [-Werror]
annobin: /builddir/build/BUILD/semver-0.3.0/test/test.cpp: Warning: -D_GLIBCXX_ASSERTIONS not defined
cc1plus: all warnings being treated as errors
[4/8] /usr/bin/g++  -I/builddir/build/BUILD/semver-0.3.0/test/3rdparty/Catch2 -I/builddir/build/BUILD/semver-0.3.0/include -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DNDEBUG -Wall -Wextra -pedantic-errors -Werror -std=c++20 -MD -MT test/CMakeFiles/semver-cpp20.t.dir/test.cpp.o -MF test/CMakeFiles/semver-cpp20.t.dir/test.cpp.o.d -o test/CMakeFiles/semver-cpp20.t.dir/test.cpp.o -c /builddir/build/BUILD/semver-0.3.0/test/test.cpp
FAILED: test/CMakeFiles/semver-cpp20.t.dir/test.cpp.o 
/usr/bin/g++  -I/builddir/build/BUILD/semver-0.3.0/test/3rdparty/Catch2 -I/builddir/build/BUILD/semver-0.3.0/include -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DNDEBUG -Wall -Wextra -pedantic-errors -Werror -std=c++20 -MD -MT test/CMakeFiles/semver-cpp20.t.dir/test.cpp.o -MF test/CMakeFiles/semver-cpp20.t.dir/test.cpp.o.d -o test/CMakeFiles/semver-cpp20.t.dir/test.cpp.o -c /builddir/build/BUILD/semver-0.3.0/test/test.cpp
/builddir/build/BUILD/semver-0.3.0/test/test.cpp: error: -D_FORTIFY_SOURCE not defined [-Werror]
annobin: /builddir/build/BUILD/semver-0.3.0/test/test.cpp: Warning: -D_GLIBCXX_ASSERTIONS not defined
cc1plus: all warnings being treated as errors
ninja: build stopped: subcommand failed.

Expected results:
Successful build.

Additional info:

Comment 2 Vitaly 2022-01-27 10:09:45 UTC
All x86_64 builds are affected. If `-Werror` is not set, it just a warning.

Example from my nheko package:

[27/267] /usr/bin/g++ -DQAPPLICATION_CLASS=QApplication -DQT_CORE_LIB -DQT_GUI_LIB -DQT_NETWORK_LIB -DQT_NO_DEBUG -DQT_WIDGETS_LIB -I/builddir/build/BUILD/nheko-0.9.1/redhat-linux-build/third_party/SingleApplication-3.3.2 -I/builddir/build/BUILD/nheko-0.9.1/third_party/SingleApplication-3.3.2 -I/builddir/build/BUILD/nheko-0.9.1/redhat-linux-build/third_party/SingleApplication-3.3.2/SingleApplication_autogen/include -isystem /usr/include/qt5 -isystem /usr/include/qt5/QtCore -isystem /usr/lib64/qt5/mkspecs/linux-g++ -isystem /usr/include/qt5/QtNetwork -isystem /usr/include/qt5/QtWidgets -isystem /usr/include/qt5/QtGui -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection 		-Wall 		-Wextra 		-pipe 		-pedantic 		-fsized-deallocation 		-fdiagnostics-color=always 		-Wunreachable-code 		-Wno-attributes -DNDEBUG -fPIC -fPIC -std=gnu++17 -MD -MT third_party/SingleApplication-3.3.2/CMakeFiles/SingleApplication.dir/singleapplication_p.cpp.o -MF third_party/SingleApplication-3.3.2/CMakeFiles/SingleApplication.dir/singleapplication_p.cpp.o.d -o third_party/SingleApplication-3.3.2/CMakeFiles/SingleApplication.dir/singleapplication_p.cpp.o -c /builddir/build/BUILD/nheko-0.9.1/third_party/SingleApplication-3.3.2/singleapplication_p.cpp
/builddir/build/BUILD/nheko-0.9.1/third_party/SingleApplication-3.3.2/singleapplication_p.cpp: warning: -D_FORTIFY_SOURCE not defined
annobin: /builddir/build/BUILD/nheko-0.9.1/third_party/SingleApplication-3.3.2/singleapplication_p.cpp: Warning: -D_GLIBCXX_ASSERTIONS not defined

Comment 3 Jakub Jelinek 2022-01-27 10:17:44 UTC
That is already fixed in annobin-10.51-2.fc36
I think we need to debug why annobin got so much worse at becoming incompatible with any gcc *.opt changes whatsoever, that certainly wasn't the case before.

Comment 4 Vitaly 2022-01-27 11:35:06 UTC
> That is already fixed in annobin-10.51-2.fc36

Builds fine now, thanks.

Comment 5 Nick Clifton 2022-01-27 11:38:31 UTC
(In reply to Jakub Jelinek from comment #3)
> That is already fixed in annobin-10.51-2.fc36
> I think we need to debug why annobin got so much worse at becoming
> incompatible with any gcc *.opt changes whatsoever, that certainly wasn't
> the case before.

I could really use some help tracking down why the plugin is so flaky.

The problem with -D_FORTIFY_SOURCE and -D_GLIBCXX_ASSERTIONS might be 
explainable however.  The annobin plugin scans the gcc command line 
by walking through the save_decoded_options[] array.  If the field 
layout of this array changes between versions of gcc, then the walk
will end up looking in the wrong places.

Comment 6 Jakub Jelinek 2022-01-27 12:00:50 UTC
Walking save_decoded_options is generally fine (with the exception when the structure changes,
as happened e.g. in https://gcc.gnu.org/r12-6839 - sorry about that), but it depends on what fields from it you rely on.
The OPT_* values do change quite often, so relying on opt_index in there would require translation through cl_options or something.
orig_option_with_args_text or canonical_option might be more reliable.

Comment 7 Nick Clifton 2022-01-27 12:27:16 UTC
(In reply to Jakub Jelinek from comment #6)

> orig_option_with_args_text or canonical_option might be more reliable.

Thanks.  The canonical_option array looks perfect for my needs.  I will update the plugin to use it.

One question though - can I rely upon canonical_options being present in older versions of GCC ?
Annobin still builds for RHEL-6....

Comment 8 Florian Weimer 2022-01-27 12:38:16 UTC
With the plugin switching in redhat-rpm-config, I don't think these ABI stability kludges will be needed anymore. We ensure matching ABIs by construction.

Comment 9 Jakub Jelinek 2022-01-27 12:51:16 UTC
canonical_options is GCC 4.6+.

(In reply to Florian Weimer from comment #8)
> With the plugin switching in redhat-rpm-config, I don't think these ABI
> stability kludges will be needed anymore. We ensure matching ABIs by
> construction.

Yeah, but I need to find time to apply/tweak it on the gcc.spec side and test it.
Will probably use mock for that because in koji gcc builds are super slow.