ship one variant, and stop asking for CET - #35
Merged
Conversation
The case builds gl-fwd.so by the default recipe and again with -fcf-protection=full asked for, and requires the default to come out with strictly fewer endbr64. A default build that requested the flag would tie with the flag arm and fail here. Run against the tree before the change it governs, it fails as predicted: both arms tie at 3478, the table reports 63 matched and 1 mismatched. Stage 3 now installs make, and the required-tool check names it.
The release shipped two builds of every object because one consumer wanted a strict environment, and the default asked for -fcf-protection=full, which measured as doing no protective work here: it adds six endbr64 to the shims and cannot produce the IBT property note, because glibc's crti.o carries no property and the linker ANDs that absence across the link (report 9.13). The release matrix now builds the default only, six jobs instead of twelve. make portable stays as the packager's strict-environment target, differing from the default by -DCLD_STRICT_ENV and nothing else; the Makefile's CET probe is gone and the flag stays askable with make CET_CFLAGS=-fcf-protection=full. The APPDIR fallback stays: upstream's own AppImage relies on it, and quick-sharun sets CROSS_LIBC_DLOPEN_ROOT itself, which wins when both are set. E101 now passes: the default build carries 3472 endbr64 against the flag arm's 3478, and the suite reports 64/64 on x86-64. Every one-home record moved with the total: report 01, 08, 09 and 10, and the list in gates.yml. verify-gates.sh carried the same list claiming to be identical to gates.yml and had drifted to 53/53 50/50; both now say 64/64 60/60. build.sh and build-in-env.sh lose the CLD_NO_CET plumbing, and building.md, integrating.md and the generated release body describe one variant.
PROGRESS.md restated the evidence total and the aarch64 total, both of which are gated numbers whose home is the report, and the one-home gate refused a clean tree. The prose now points at report 08. The plant for that gate named 53/53, which left the list when it moved to 64/64, so the plant names a number the gate actually gates.
The note spelled the old totals, and one of them is a gated number whose home is the report, so the one-home gate refused a clean tree. The prose says what happened without restating the number.
Samueru-sama
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two decisions, both the operator's:
The release ships the default build only. The strict build (reads only CROSS_LIBC_DLOPEN_ROOT, never APPDIR) stays a build-time choice: cd src && make portable, measured by E87 and E88. quick-sharun sets CROSS_LIBC_DLOPEN_ROOT itself, so the strict assets had no consumer. The APPDIR fallback stays: upstream's own AppImage relies on it, and src/cld-env.h has that argument in full; CROSS_LIBC_DLOPEN_ROOT wins when both are set. The release matrix drops from twelve jobs to six.
No build asks for -fcf-protection=full. Measured in report 9.13: the flag adds six endbr64 to the shims and cannot produce the IBT property note (glibc's crti.o carries none, the linker ANDs that absence), so a CET-enforcing loader honours none of it. It stays askable with make CET_CFLAGS=-fcf-protection=full.
The case that governs it. E101 builds gl-fwd.so by the default recipe and again with the flag asked for, and requires the default to come out strictly lighter.
Every one-home record moved with the total: report 01, 08, 09 and 10, the list in gates.yml, and the same list in scripts/verify-gates.sh. The aarch64 total stays where report 08 says (its skip list gains E101, so the scored count is unchanged); this PR's CI run is that measurement.
Also measured locally: build.sh default and --portable both exit 0 with the right manifest variant; the default gl-fwd.so carries 3472 endbr64; both build dirs package; the generated body describes one variant. check-drift, check-charset and verify-gates (14 gates proven) all exit 0.
One finding, named not fixed: skip E76 and skip E76b at the foot of experiments/30-run-tests.sh name a function that does not exist in that file. On an x86-64 machine with neither qemu nor an aarch64 cross compiler, E76 and E76b would fail with skip: command not found instead of skipping by name. CI never reaches that path. Left for its own decision.