[Pkg-irc-commits] r304 - in /packages/inspircd2/trunk/debian: changelog patches/01_dpkg-buildflags_support.diff patches/05_gnutls_crypt_api_instead_gcrypt.diff patches/series rules

Sun Aug 3 19:42:09 UTC 2014

Author: kcd-guest
Date: Sun Aug  3 19:42:09 2014
New Revision: 304

URL: http://svn.debian.org/wsvn/pkg-irc/?sc=1&rev=304
Log:
Enable dpkg-buildflags in 2.0.16-2

Added:
    packages/inspircd2/trunk/debian/patches/01_dpkg-buildflags_support.diff
Modified:
    packages/inspircd2/trunk/debian/changelog
    packages/inspircd2/trunk/debian/patches/05_gnutls_crypt_api_instead_gcrypt.diff
    packages/inspircd2/trunk/debian/patches/series
    packages/inspircd2/trunk/debian/rules

Modified: packages/inspircd2/trunk/debian/changelog
URL: http://svn.debian.org/wsvn/pkg-irc/packages/inspircd2/trunk/debian/changelog?rev=304&op=diff
==============================================================================

--- packages/inspircd2/trunk/debian/changelog	(original)
+++ packages/inspircd2/trunk/debian/changelog	Sun Aug  3 19:42:09 2014
@@ -1,3 +1,14 @@
+inspircd (2.0.16-2) unstable; urgency=medium
+
+  * To re-enable hardening flags:
+    + Replace DEB_BUILD_HARDENING by DEB_BUILD_MAINT_OPTIONS to enable
+      dpkg-buildflags without pie
+    + debian/patches/01_dpkg-buildflags_support.diff: Patch upstream Makefile
+      template to use CPPFLAGS and custom LDFLAGS, CXXFLAGS; enable PIE on
+      inspircd binary only as libraries already compiled with PIC
+
+ -- Guillaume Delacour <gui at iroqwa.org>  Sun, 20 Jul 2014 23:23:42 +0200
+
 inspircd (2.0.16-1) unstable; urgency=low
 
   [ Guillaume Delacour ]

Added: packages/inspircd2/trunk/debian/patches/01_dpkg-buildflags_support.diff
URL: http://svn.debian.org/wsvn/pkg-irc/packages/inspircd2/trunk/debian/patches/01_dpkg-buildflags_support.diff?rev=304&op=file
==============================================================================
--- packages/inspircd2/trunk/debian/patches/01_dpkg-buildflags_support.diff	(added)
+++ packages/inspircd2/trunk/debian/patches/01_dpkg-buildflags_support.diff	Sun Aug  3 19:42:09 2014
@@ -0,0 +1,53 @@
+From: Guillaume Delacour <gui at iroqwa.org>
+Subject: Enable dpkg-buildflags in upstream MakeFile
+Last-Update: 2014-07-20
+
+Index: inspircd-2.0.16/make/template/main.mk
+===================================================================
+--- inspircd-2.0.16.orig/make/template/main.mk
++++ inspircd-2.0.16/make/template/main.mk
+@@ -34,9 +34,10 @@ CC = @CC@
+ SYSTEM = @SYSTEM@
+ BUILDPATH = @BUILD_DIR@
+ SOCKETENGINE = @SOCKETENGINE@
+-CXXFLAGS = -pipe -fPIC -DPIC
++CXXFLAGS += -pipe -fPIC -DPIC
++CPPFLAGS +=
+ LDLIBS = -pthread -lstdc++
+-LDFLAGS = 
++LDFLAGS +=
+ CORELDFLAGS = -rdynamic -L. $(LDFLAGS)
+ PICLDFLAGS = -fPIC -shared -rdynamic $(LDFLAGS)
+ BASE = "$(DESTDIR)@BASE_DIR@"
+@@ -132,7 +133,7 @@ CXXFLAGS += -Iinclude
+ @ENDIF
+ 
+ @DO_EXPORT RUNCC RUNLD CXXFLAGS LDLIBS PICLDFLAGS VERBOSE SOCKETENGINE CORELDFLAGS
+- at DO_EXPORT SOURCEPATH BUILDPATH PURE_STATIC SPLIT_CC
++ at DO_EXPORT SOURCEPATH BUILDPATH PURE_STATIC SPLIT_CC CPPFLAGS
+ 
+ # Default target
+ TARGET = all
+Index: inspircd-2.0.16/make/unit-cc.pl
+===================================================================
+--- inspircd-2.0.16.orig/make/unit-cc.pl
++++ inspircd-2.0.16/make/unit-cc.pl
+@@ -79,6 +79,10 @@ sub do_static_link {
+ }
+ 
+ sub do_core_link {
++	# enable PIE for inspircd binary (already enabled on libs with -fPIC)
++    if ($out =~ m#bin/inspircd#) {
++		$ENV{CORELDFLAGS} .= ' -fPIE -pie ';
++    }
+ 	my $execstr = "$ENV{RUNLD} -o $out $ENV{CORELDFLAGS} @_ $ENV{LDLIBS}";
+ 	print "$execstr\n" if $verbose;
+ 	exec $execstr;
+@@ -98,6 +102,7 @@ sub do_compile {
+ 	my $binary = $ENV{RUNCC};
+ 	if ($do_compile) {
+ 		$flags = $ENV{CXXFLAGS};
++		$flags .= ' '.$ENV{CPPFLAGS};
+ 		$flags =~ s/ -pedantic// if nopedantic($file);
+ 		$flags .= ' ' . getcompilerflags($file);
+ 

Modified: packages/inspircd2/trunk/debian/patches/05_gnutls_crypt_api_instead_gcrypt.diff
URL: http://svn.debian.org/wsvn/pkg-irc/packages/inspircd2/trunk/debian/patches/05_gnutls_crypt_api_instead_gcrypt.diff?rev=304&op=diff
==============================================================================
--- packages/inspircd2/trunk/debian/patches/05_gnutls_crypt_api_instead_gcrypt.diff	(original)
+++ packages/inspircd2/trunk/debian/patches/05_gnutls_crypt_api_instead_gcrypt.diff	Sun Aug  3 19:42:09 2014
@@ -6,8 +6,10 @@
 Forwarded: not-needed
 Last-Update: 2014-07-13
 
---- a/src/modules/extra/m_ssl_gnutls.cpp
-+++ b/src/modules/extra/m_ssl_gnutls.cpp
+Index: inspircd-2.0.16/src/modules/extra/m_ssl_gnutls.cpp
+===================================================================
+--- inspircd-2.0.16.orig/src/modules/extra/m_ssl_gnutls.cpp
++++ inspircd-2.0.16/src/modules/extra/m_ssl_gnutls.cpp
 @@ -22,12 +22,18 @@
  
  

Modified: packages/inspircd2/trunk/debian/patches/series
URL: http://svn.debian.org/wsvn/pkg-irc/packages/inspircd2/trunk/debian/patches/series?rev=304&op=diff
==============================================================================
--- packages/inspircd2/trunk/debian/patches/series	(original)
+++ packages/inspircd2/trunk/debian/patches/series	Sun Aug  3 19:42:09 2014
@@ -1,2 +1,3 @@
+01_dpkg-buildflags_support.diff
 02_disable_rpath_for_extra_modules.diff
 05_gnutls_crypt_api_instead_gcrypt.diff

Modified: packages/inspircd2/trunk/debian/rules
URL: http://svn.debian.org/wsvn/pkg-irc/packages/inspircd2/trunk/debian/rules?rev=304&op=diff
==============================================================================
--- packages/inspircd2/trunk/debian/rules	(original)
+++ packages/inspircd2/trunk/debian/rules	Sun Aug  3 19:42:09 2014
@@ -1,8 +1,9 @@
 #!/usr/bin/make -f
 # -*- makefile -*-
 
-# hardening options at build time
-export DEB_BUILD_HARDENING=1
+# hardening options at build time, without PIE enabled globally
+# enable PIE on inspircd binary only in upstream build system
+export DEB_BUILD_MAINT_OPTIONS=hardening=+all,-pie
 
 # use DEB_BUILD_OPTIONS="parallel=n" to parallelize the build
 ifneq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))


