/usr/bin/dbxtool in dbxtool-8-4.fc28.x86_64 is not linked with the standard Fedora linker flags (LDFLAGS) from redhat-rpm-config. Naïvely setting LDFLAGS does not fix this because the recursive make invocation does not pass down the flags, it seems. (I tried.) Please fix this in Fedora 28 as well. See https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md for information on RPM macros and environment variables provided by the build environment.
So I thought I had a fix when hardened.sh for F28 stopped complaining but when I then tested it with the F29 build, it's noisy again. The build passes some of the flags more than once because it concatenates its own flags with flags from its deps. I wonder if it's fine and it's just confusing the check script: % hardened.sh /usr/bin/dbxtool hardened.sh: /usr/bin/dbxtool: FAIL: multiple, different, settings of -fstack-protector used hardened.sh: /usr/bin/dbxtool: FAIL: insufficient value for -D_FORTIFY_SOURCE=0 hardened.sh: /usr/bin/dbxtool: FAIL: multiple, different, settings of -fpic/-fpie used hardened.sh: /usr/bin/dbxtool: FAIL: some parts built without operator range checking hardened.sh: /usr/bin/dbxtool: FAIL: some parts built with different settings for -fcf-protection hardened.sh: /usr/bin/dbxtool: FAIL: some parts built different CET settings
Created attachment 1420862 [details] F29 build.log
(In reply to Petr Šabata from comment #1) > So I thought I had a fix when hardened.sh for F28 stopped complaining but > when I then tested it with the F29 build, it's noisy again. The build > passes some of the flags more than once because it concatenates its own > flags with flags from its deps. Is this check script based on annobin? That's not quite there yet in rawhide (and has false negatives in Fedora 28). Nick is working on this. (In reply to Petr Šabata from comment #2) > Created attachment 1420862 [details] > F29 build.log gcc -Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -o dbxtool dbxtool.o iter.o esltree.o -lpopt -lefivar -lpthread This looks okay to me.
(In reply to Florian Weimer from comment #3) > (In reply to Petr Šabata from comment #1) > > So I thought I had a fix when hardened.sh for F28 stopped complaining but > > when I then tested it with the F29 build, it's noisy again. The build > > passes some of the flags more than once because it concatenates its own > > flags with flags from its deps. > > Is this check script based on annobin? That's not quite there yet in > rawhide (and has false negatives in Fedora 28). Nick is working on this. It comes from the annobin package. > (In reply to Petr Šabata from comment #2) > > Created attachment 1420862 [details] > > F29 build.log > > gcc -Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld > -o dbxtool dbxtool.o iter.o esltree.o -lpopt -lefivar -lpthread > > This looks okay to me. Thanks!
dbxtool-8-5.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b61d0943c
dbxtool-8-5.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b61d0943c
dbxtool-8-5.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.