í«îÛgcc_secure-1.0-0.12.oe2403Žè¤>”Ð Ðùè<ì@ïPðT@‰Í7!.Ü¶›uj¤Œï·Gû7¼of=Æyopeneuler@compass-ci.com ·Gû7¼ofºþ&ðß3+Ç$øà‚1Ö :¦º_ ¡Š/È/—:‹²w<Æá;ýSECË3_«|±•LºëÁLâÁŽ}áÕÐ–vþxðæ×r¢ùúú_9å{ÓÚPò÷o<œ¦ã¥¥¾¢„Ø{ß×¨ùSˆdz]»rcÌx4¿Ñè¨á+Ï» ÃÇIæù~QªwlµÈhŸ•U‰kâ‹©!ö}ž€7Ú{EGhšàs¯ƒ’œK-k(ó$ÿÏLŽô*;Þ¿µö”‹=jÎfpc-š@?µÚ9†ŸÂå%ØZ™0ÂÓg¥`’NB‘ çá»@Èë¸Ï\·ZyZ'9 ÷¹–B2ðZE0SB˜:È˜?XUÛ…nŸÏÓÃ»gpµÎ–ª¿âòð>pUƒ«ìÅJÔ7S¶EfK: .kñ„ŽJ…lNÙò–Hú7÷¿ùžxæÉKW€½¿EkùÓ"(bb ‰!X¶K\¯7ÖéÓ]iZëXu²§Žýà7Õyû(‰móff180069868ae66bc18657f13962d329960cc41bef2d64d967949c732f83974076b60c3277e71aea0358f6c6d4595af744e8f6473Ã|%b¦°KöËƒhNpd>ÿÿÿ€Žè4)R?)Bdèé êì í IîtïxñŒö÷ø ²ýÄþÊÔØ Ú Üà! $(-48DT™(«8´9Ì:ßF¤GÄHÈIÌRÐXÔYØ\è]ì^üdýef“ÆäåXé\ëCgcc_secure1.00.12.oe2403Enforcing secure compile options for abuildEnforcing secure compile option for abuildf=Æxdc-64g.compass-cihGPL-2.0-onlyhttp://openeuler.orgSystem/Managementlinuxaarch64h´f=ÆJ9411ca7e66d7287314074193e6bbfb4cb0ebc3a3db093721bc6ad6b3fe3a5d7c rootrootÿÿÿÿgcc_secure coreutilsrpmlib(CompressedFileNames)rpmlib(FileDigests)util-linux3.0.4-14.6.0-14.18.2bâz@b8Àbþ@`ø@`ì.À`nð@Chenyx - 1.0-0.12zoulin - 1.0-0.11zhangchenfeng - 1.0-0.10licihua - 1.0-0.9shenyangyang - 1.0-0.8shenyangyang - 1.0-0.7- License compliance rectification- Type:enhancement - ID:NA - SUG:NA - DESC: Add automake.spec to gcc_secure_exclude- Type:enhancement - ID:NA - SUG:NA - DESC: clean spec- Type:enhancement - ID:NA - SUG:NA - DESC: support -fsigned-char for g++- Type:enhancement - ID:NA - SUG:NA - DESC:change file mode from 777 to 755 for secure- Type:enhancement - ID:NA - SUG:NA - DESC: bump release rebuilding for adding rhash.spec to macro gcc_secure_excludedc-64g.compass-ci 17153245361.0-0.12.oe2403gcc_secure.speccpiogzip9utf-8fa32c57894e4514ba5cb193c4ed568b3037f3ba5c41561dfddf194e852f723fc6078644ba88e4928e082bb08e7454131c4ea2bfd5a238d7404f81fa0b76912b3Name: gcc_secure Summary: Enforcing secure compile options for abuild License: GPL-2.0-only Group: System/Management Version: 1.0 Release: 0.12 BuildRoot: /var/tmp/gcc_secure-1.0 BuildRequires: util-linux coreutils Requires: util-linux rpm grep binutils gcc coreutils rpm-build %description Enforcing secure compile option for abuild %prep %pre %post echo -e '*cc1_options:\n+ %{!D__KERNEL__:%{!nostdlib:%{!nodefaultlibs:%{!fno-stack-protector:%{!fstack-protector-all:-fstack-protector-strong}}}}}' >/opt/gcc-specs-fs-cc1 echo -e '*cc1_options:\n+ %{!r:%{!D__KERNEL__:%{!pie:%{!fpic:%{!fPIC:%{!fpie:%{!fPIE:%{!fno-pic:%{!fno-PIC:%{!fno-pie:%{!fno-PIE:%{!shared:%{!static:%{!nostdlib:%{!nostartfiles:-fPIE}}}}}}}}}}}}}}}' >/opt/gcc-specs-pie-cc1 echo -e '*self_spec:\n+ %{!D__KERNEL__:%{!pie:%{!A:%{!fno-pie:%{!fno-PIE:%{!fno-pic:%{!fno-PIC:%{!shared:%{!static:%{!r:%{!nostdlib:%{!nostartfiles:-pie}}}}}}}}}}}}' >/opt/gcc-specs-pie-ld old_gcc=/usr/bin/gcc mv $old_gcc $old_gcc"_old" cat < $old_gcc #!/bin/sh gcc_secure_exclude=\`rpm --eval 'podman.spec|gcc.spec|arm-trusted-firmware.spec|docker-engine-openeuler.spec|arts.spec|runc-openeuler.spec|kata-containers.spec|dyninst.spec|ipxe.spec|tboot.spec|syslinux.spec|gcc-libraries.spec|kpatch.spec|gdb.spec|xorg-x11-server.spec|xorg-x11-drv-fbdev.spec|xorg-x11-drv-vesa.spec|xorg-x11-drv-ati.spec|xorg-x11-drv-dummy.spec|xorg-x11-drv-intel.spec|xorg-x11-drv-nouveau.spec|xorg-x11-drv-qxl.spec|xorg-x11-drv-v4l.spec|xorg-x11-drv-vmware.spec|xorg-x11-drv-evdev.spec|xorg-x11-drv-synaptics.spec|xorg-x11-drv-vmmouse.spec|xorg-x11-drv-void.spec|xorg-x11-drv-wacom.spec|hivex.spec|gimp.spec|memstomp.spec|supermin.spec|system-config-firewall.spec|isdn4k-utils.spec|emacs.spec|graphviz.spec|buildah.spec|rhash.spec|automake.spec'\` if ! cat /.build.command | egrep "\$gcc_secure_exclude" &>/dev/null; then sec_opt='-fPIC -D_FORTIFY_SOURCE=2 -O2 -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wtrampolines -fsigned-char' fs_opt='' if [[ "\$@" =~ "-O0" ]]; then #openjdk set O0 can not use FS sec_opt=\`echo \$sec_opt | sed 's/ -D_FORTIFY_SOURCE=2 -O2 / /'\` fi if [ -d '/home/abuild/rpmbuild/SOURCES' ]; then configfile=/home/abuild/rpmbuild/SOURCES/config_for_secure else configfile=/root/rpmbuild/SOURCES/config_for_secure fi if [ -f \$configfile ]; then rpm_name=\`cat \$configfile| grep rpm_name| awk -F: '{print \$NF}'\` sec_opt=\`cat \$configfile| grep sec_opt| awk -F: '{print \$NF}'\` fs_opt=\`cat \$configfile| grep fs_opt| awk -F: '{print \$NF}'\` fi if [[ x\$rpm_name = "xnumactl" ]] && [[ "\$@" =~ "-march=x86-64" ]];then #numactl i686 use asm can't add -fPIC sec_opt=\`echo \$sec_opt | sed 's/-fPIC / /'\` fi if [[ x\$rpm_name = "xglibc" ]] || [[ x\$rpm_name = "xcompat-glibc" ]];then #glibc supply fs define, can not add fs for glibc self /usr/bin/gcc_old \$sec_opt "\$@" \$fs_opt --specs=/opt/gcc-specs-pie-cc1 --specs=/opt/gcc-specs-pie-ld else /usr/bin/gcc_old \$sec_opt "\$@" \$fs_opt --specs=/opt/gcc-specs-pie-cc1 --specs=/opt/gcc-specs-pie-ld --specs=/opt/gcc-specs-fs-cc1 fi else $old_gcc"_old" "\$@" fi END1 chmod 755 $old_gcc $old_gcc"_old" old_gplus=/usr/bin/g++ if [ -f $old_gplus ]; then mv $old_gplus $old_gplus"_old" cat < $old_gplus #!/bin/sh gcc_secure_exclude=\`rpm --eval 'podman.spec|gcc.spec|arm-trusted-firmware.spec|docker-engine-openeuler.spec|arts.spec|runc-openeuler.spec|kata-containers.spec|dyninst.spec|ipxe.spec|tboot.spec|syslinux.spec|gcc-libraries.spec|kpatch.spec|gdb.spec|xorg-x11-server.spec|xorg-x11-drv-fbdev.spec|xorg-x11-drv-vesa.spec|xorg-x11-drv-ati.spec|xorg-x11-drv-dummy.spec|xorg-x11-drv-intel.spec|xorg-x11-drv-nouveau.spec|xorg-x11-drv-qxl.spec|xorg-x11-drv-v4l.spec|xorg-x11-drv-vmware.spec|xorg-x11-drv-evdev.spec|xorg-x11-drv-synaptics.spec|xorg-x11-drv-vmmouse.spec|xorg-x11-drv-void.spec|xorg-x11-drv-wacom.spec|hivex.spec|gimp.spec|memstomp.spec|supermin.spec|system-config-firewall.spec|isdn4k-utils.spec|emacs.spec|graphviz.spec|buildah.spec|rhash.spec|automake.spec'\` if ! cat /.build.command | egrep "\$gcc_secure_exclude" &>/dev/null; then sec_opt='-fPIC -D_FORTIFY_SOURCE=2 -O2 -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wtrampolines -fsigned-char' fs_opt='' if [[ "\$@" =~ "-O0" ]]; then #openjdk set O0 can not use FS sec_opt=\`echo \$sec_opt | sed 's/ -D_FORTIFY_SOURCE=2 -O2 / /'\` fi if [ -d '/home/abuild/rpmbuild/SOURCES' ]; then configfile=/home/abuild/rpmbuild/SOURCES/config_for_secure_g++ else configfile=/root/rpmbuild/SOURCES/config_for_secure_g++ fi if [ -f \$configfile ]; then rpm_name=\`cat \$configfile| grep rpm_name| awk -F: '{print \$NF}'\` sec_opt=\`cat \$configfile| grep sec_opt| awk -F: '{print \$NF}'\` fs_opt=\`cat \$configfile| grep fs_opt| awk -F: '{print \$NF}'\` fi if [[ x"\$@" = "x-v" ]];then #libtool use g++ -v for test compile env,if add Wl opt, it will make g++ -v fail $old_gplus"_old" "\$@" else /usr/bin/g++_old \$sec_opt "\$@" \$fs_opt --specs=/opt/gcc-specs-pie-cc1 --specs=/opt/gcc-specs-pie-ld --specs=/opt/gcc-specs-fs-cc1 fi else $old_gplus"_old" "\$@" fi END1 chmod 755 $old_gplus $old_gplus"_old" fi old_cpp=/usr/bin/c++ if [ -f $old_cpp ]; then mv $old_cpp $old_cpp"_old" cat < $old_cpp #!/bin/sh gcc_secure_exclude=\`rpm --eval 'podman.spec|gcc.spec|arm-trusted-firmware.spec|docker-engine-openeuler.spec|arts.spec|runc-openeuler.spec|kata-containers.spec|dyninst.spec|ipxe.spec|tboot.spec|syslinux.spec|gcc-libraries.spec|kpatch.spec|gdb.spec|xorg-x11-server.spec|xorg-x11-drv-fbdev.spec|xorg-x11-drv-vesa.spec|xorg-x11-drv-ati.spec|xorg-x11-drv-dummy.spec|xorg-x11-drv-intel.spec|xorg-x11-drv-nouveau.spec|xorg-x11-drv-qxl.spec|xorg-x11-drv-v4l.spec|xorg-x11-drv-vmware.spec|xorg-x11-drv-evdev.spec|xorg-x11-drv-synaptics.spec|xorg-x11-drv-vmmouse.spec|xorg-x11-drv-void.spec|xorg-x11-drv-wacom.spec|hivex.spec|gimp.spec|memstomp.spec|supermin.spec|system-config-firewall.spec|isdn4k-utils.spec|emacs.spec|graphviz.spec|buildah.spec|rhash.spec|automake.spec'\` if ! cat /.build.command | egrep "\$gcc_secure_exclude" &>/dev/null; then sec_opt='-fPIC -D_FORTIFY_SOURCE=2 -O2 -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wtrampolines -fsigned-char' fs_opt='' if [[ "\$@" =~ "-O0" ]]; then #openjdk set O0 can not use FS sec_opt=\`echo \$sec_opt | sed 's/ -D_FORTIFY_SOURCE=2 -O2 / /'\` fi if [ -d '/home/abuild/rpmbuild/SOURCES' ]; then configfile=/home/abuild/rpmbuild/SOURCES/config_for_secure_c++ else configfile=/root/rpmbuild/SOURCES/config_for_secure_c++ fi if [ -f \$configfile ]; then rpm_name=\`cat \$configfile| grep rpm_name| awk -F: '{print \$NF}'\` sec_opt=\`cat \$configfile| grep sec_opt| awk -F: '{print \$NF}'\` fs_opt=\`cat \$configfile| grep fs_opt| awk -F: '{print \$NF}'\` fi /usr/bin/c++_old \$sec_opt "\$@" \$fs_opt --specs=/opt/gcc-specs-pie-cc1 --specs=/opt/gcc-specs-pie-ld --specs=/opt/gcc-specs-fs-cc1 else $old_cpp"_old" "\$@" fi END1 chmod 755 $old_cpp $old_cpp"_old" fi %preun %postun %files %defattr(-,root,root) %clean rm -rf $RPM_BUILD_ROOT/* rm -rf /var/tmp/gcc_secure-1.0 rm -rf $RPM_BUILD_DIR/gcc_secure-1.0 %changelog * Thu Jul 28 2022 Chenyx - 1.0-0.12 - License compliance rectification * Thu Feb 17 2022 zoulin - 1.0-0.11 - Type:enhancement - ID:NA - SUG:NA - DESC: Add automake.spec to gcc_secure_exclude * Thu Feb 10 2022 zhangchenfeng - 1.0-0.10 - Type:enhancement - ID:NA - SUG:NA - DESC: clean spec * Wed Jul 21 2021 licihua - 1.0-0.9 - Type:enhancement - ID:NA - SUG:NA - DESC: support -fsigned-char for g++ * Mon Jul 12 2021 shenyangyang - 1.0-0.8 - Type:enhancement - ID:NA - SUG:NA - DESC:change file mode from 777 to 755 for secure * Thu Apr 8 2021 shenyangyang - 1.0-0.7 - Type:enhancement - ID:NA - SUG:NA - DESC: bump release rebuilding for adding rhash.spec to macro gcc_secure_exclude * Tue Feb 18 2020 yanzhihua - 1.0-0.6 - Type:enhancement - ID:NA - SUG:NA - DESC: add compile options for arm * Mon Jan 13 2020 openEuler Buildteam - 1.0-0.5 - package init * Mon Apr 01 2019 liuxueping - 1.0-0.4 - Type:enhancement - ID:NA - SUG:NA - DESC: no buildrequires rpms about tool * Tue Nov 27 2018 zhangchenfeng - 1.0-0.3 - Type:enhancement - ID:NA - SUG:NA - DESC:resolve numactl i686 fail * Tue Nov 27 2018 zhangchenfeng - 1.0-0.2 - Type:enhancement - ID:NA - SUG:NA - DESC:resolve numactl i686 fail * Sat Nov 10 2018 Wuyou - 1.0-0.1 - Type:enhancement - ID:NA - SUG:NA - DESC:add safe compile options ?ÿÿüÀ‹íYmsÛ¸ÎgþŠµÏŽÚØ´DÅ‘uª”‰Ï–3n;#;Ítâ¢ ‰`AP–»¿½»à‹Þ•¨“¹~1g$âe±xv±x–+G•£ŠSI/s¯;ÝÃÊòË©Õ^ö¼Ú!3•n^ù¡Ë)JÏscî%ŠÄ÷ž={vÉBÞ€É5‘°®“0dê¾èm‹¾Tž/ €'ÃÈ8ÈHûRÄ€ÝÀº‰ô¬ßã"žh~ûþÂ®Tl)‚{ë’I45éõ}¬yX~Çðmý“«U2ÎAÅêð€³)••§jýF³u¤ÔYóî7W‡QÄôð±¼ûM qöî·QªîÑÊäù¿_ñ¸‰ö;ðE2Fc§jlY“þi…0P<‚.VI|5Fývj¼µÛã±§|ãë;n›öšµáxóE¬Y¤ ô/cmqo(ÁæPzáyŽ›9½q+öÐêS×ýG»sÙ¾pÝVè~7-÷xŸ%ÆzL }!mÔï}±#%5÷´T¦y®ÍF {¡5ÖJŠÁ#]%x]Fet„Mñ£´à¬õXÍls€#Ÿ‘ï™ûûó“¬Î³z;‡ž‹`1—2|Òjdã!S¼gJšétÐ¬_°]é>®EŒvâ¨ÇÙkÑ<œdÞ¾˜}—zW¬D†ëx5Îå6-C¯Ö›€ª¿ŸÂL=[[å$Veg±ÂìdEaÛÅÂ¶å1 ÍfûòÔ×EŸõË– i¸|ìI·n?Ó~±m>bzeQâñö³å÷aHyùÀl€Ü!=xn¶ÚöíÎâÈmxþºÜã£²H‚ào ‡\X´÷QŠ"U¢µ<ûÔ=»êÜœŸýË½¾úÐ9i·ª`_áïc°oÝWŠ˜Ê½ak\¯ÙµC”³1™¿V¯™HdqH‘YÒÀz=0[jƒÐL·àŠ8\D>@>óî‡‡eý”2™¶±9ð¦â$Š‚{t$`¾Ã»_ì,² Ÿ>Ÿd¢HÚÅði$¾›²'õßíNº8Hg†G[Ë³ÂºndÝ…íðçÌ»ª7ËÔùÚÈf©?Eb¡±¿å CÙƒ£W¯V¦Š4·DAOe—½=+ß»;E±s‹ÄcZ'ÅÕÉ‡zŸÒÏSúY—9\ŠºŸ‘‚ EOih™g‡d