Bug#837489: antlr: Please build libantlr.a with -fPIC

[Bálint Réczey]

Hi Tony,

2016-09-25 19:11 GMT+02:00 tony mancill <tmancill at debian.org>:
> On Mon, Sep 12, 2016 at 01:16:32AM +0200, Balint Reczey wrote:
>> Source: antlr
>> Version: 2.7.7+dfsg-7
>> Severity: important
>> User: balint at balintreczey.hu
>> Usertags: pie-bindnow-20160906
>> Justification: makes gpt FTBFS with extra hardening
>> Affects: gpt sqlitebrowser
>>
>> Dear Maintainers,
>>
>> During a rebuild of all packages in sid, gpt
>> failed to build on amd64 with patched GCC and dpkg. The root
>> cause seems to be that libantlr.a is shipped as a non-PIC library.
>
> Hi Balint,
>
> The libantlr-dev package is shipping two artifacts in /usr/lib:
>
>   /usr/lib/libantlr-pic.a
>   /usr/lib/libantlr.a
>

Yes, and shipping both is implemented in d/rules:
...
        $(MAKE) -C lib/cpp CXXFLAGS="+ -fPIC -DPIC"
        mv -f lib/cpp/src/libantlr.a debian/libantlr-pic.a
        $(MAKE) -C lib/cpp clean
        $(MAKE) -C lib/cpp
...


>
> Can the gpt and sqlitebrowser builds reference the libantlr-pic
> library?  Or is the request to *only* ship the -fPIC library?

The two other packages could be fixed instead, but I believe
shipping only libantlr.a compiled with -fPIC would result the
best overall outcome partly due to simpler code in every
affected package.

Apparently only one package uses -pic.a which need to be changed:
https://codesearch.debian.net/search?q=antlr-pic

Please see related discussion on d-devel:
https://lists.debian.org/debian-devel/2016/09/msg00277.html

Cheers,
Balint