Bug 1978176
| Summary: | annobin: Needs rebuild for gcc-11.1.1-6.1.el9 to fix buildroot | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Florian Weimer <fweimer> |
| Component: | annobin | Assignee: | Nick Clifton <nickc> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Martin Cermak <mcermak> |
| Severity: | high | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 9.0 | CC: | bgalvani, edewata, fweimer, jpazdziora, kdudka, mcermak, nickc, wenliang |
| Target Milestone: | beta | Keywords: | Bugfix, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | annobin-9.79-1.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-12-07 21:20:54 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1958224 | ||
|
Description
Florian Weimer
2021-07-01 09:06:22 UTC
Fixed in annobin-9.79-1.el9 Do I need to rebuild coreutils-8.32-29.el9 which was built with a wrong combination of gcc/annobin?
https://dashboard.osci.redhat.com/#/artifact/brew-build/aid/37838342?focus=id:e845dd5f7efbf640456dd93519793e437420339b80a1f7ebe831175786959880
(In reply to Kamil Dudka from comment #3) Hi Kamil, > Do I need to rebuild coreutils-8.32-29.el9 which was built with a wrong > combination of gcc/annobin? No. The new version of annobin is still in gating at the moment, so until it makes it through to the buildroot the problem will persist. Also - there is nothing actually wrong being detected. Annocheck is saying that any "FAIL" results that appear to be bogus could be due to the discrepancy between the version of gcc used to build the annobin plugin and the version of gcc which ran the plugin. But the log does not show any FAIL results. So there is nothing to be concerned about. (I am not sure why this is actually showing up as a failed test. Perhaps the test harness is looking for the string "FAIL" rather than checking the return code from annocheck. That would be rather ironic though). So for now please just waive the coreutils gating failure. Hopefully the next time you build the coreutils the buildroot will have been updated and this problem will be resolved[*]. Cheers Nick [*] Except that exactly the same thing could happen again in the future. Ie if gcc is updated and gets into the buildroot, but annobin is not updated, then annocheck will notice and start to complain again. We try to keep the two in sync, but occasionally there are slip ups. (In reply to Nick Clifton from comment #4) > The new version of annobin is still in gating at the moment, so until it > makes it through to the buildroot the problem will persist. No worries. I would certainly wait for a fixed build of annobin to appear in the buildroot before resubmitting the build of coreutils. My question was more whether it would be fine to release such a build of coreutils in el9 beta in the unlikely case that coreutils were not rebuilt from now on. > Also - there is nothing actually wrong being detected. Annocheck is saying > that any "FAIL" results that appear to be bogus could be due to the > discrepancy between the version of gcc used to build the annobin plugin and > the version of gcc which ran the plugin. But the log does not show any FAIL > results. So there is nothing to be concerned about. (I am not sure why > this is actually showing up as a failed test. Perhaps the test harness is > looking for the string "FAIL" rather than checking the return code from > annocheck. That would be rather ironic though). Actually I can see a lot of FAIL results in various binaries on various architectures, for example: Hardened: /usr/bin/arch: FAIL: stack-clash test because -fstack-clash-protection not enabled (addr range: 0x2420..0x6aa0) Hardened: /usr/bin/arch: FAIL: stack-clash test because -fstack-clash-protection not enabled (addr range: 0x2ae0..0x69dc) [...] Hardened: /usr/bin/csplit: FAIL: stack-realign test because -fstack-realign not enabled (function: quotearg_buffer_restyled.constprop.0.cold) [...] Hardened: /usr/bin/cp: FAIL: cf-protection test because no protection enabled (function: triple_hash_no_name) Hardened: /usr/bin/cp: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: triple_hash_no_name) Hardened: /usr/bin/cp: FAIL: cf-protection test because no protection enabled (function: isaac_refill) Hardened: /usr/bin/cp: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: isaac_refill) None of them appeared in the annocheck output of coreutils-8.32-28.el9, which ran two weeks ago. *** Bug 1978573 has been marked as a duplicate of this bug. *** *** Bug 1977997 has been marked as a duplicate of this bug. *** (In reply to Kamil Dudka from comment #5) Hi Kamil, > Actually I can see a lot of FAIL results in various binaries on various > architectures, for example: > > Hardened: /usr/bin/arch: FAIL: stack-clash test because > -fstack-clash-protection not enabled (addr range: 0x2420..0x6aa0) Hmm, I must have missed these. Sorry. OK, so the warning from annocheck is probably correct - these FAIL results are happening because an old version of annobin was used with a new version of gcc. Hopefully the new build of annobin should fix this. Cheers Nick *** Bug 1979523 has been marked as a duplicate of this bug. *** *** Bug 1980480 has been marked as a duplicate of this bug. *** I've started to specifically test latest glibc builds. The gcc version discrepancy messages are gone but there are still FAILs reported: bug 1981410. |