[Pkg-openssl-devel] Bug#845193: Bug#845193: Bug#845193: dpkg: recent -specs PIE changes break openssl

[Sebastian Andrzej Siewior]

On 2016-12-29 00:25:05 [+0100], To Kurt Roeckx wrote:
> > Figure out why it uses link_a instead of link_o, and maybe fix it?

so that link_a instead of link_o is always used - not just on x32.
Replacing _a with _o here gets the build to continue but fails later in
a (normal) link_o rule:

|make[3]: Entering directory '/home/bigeasy/openssl1.0-1.0.2j/engines/ccgost'
|SHLIB_COMPAT=; SHLIB_SOVER=; if [ -n "" ]; then prev=""; for v in `echo " " | cut -d';' -f1`; do SHLIB_SOVER_NODOT=$v; SHLIB_SOVER=.$v; if [ -n "$prev" ]; then SHLIB_COMPAT="$SHLIB_COMPAT .$prev"; fi; prev=$v; done; fi; SHLIB=libgost.so; SHLIB_SUFFIX=; ALLSYMSFLAGS='-Wl,--whole-archive'; NOALLSYMSFLAGS='-Wl,--no-whole-archive'; SHAREDFLAGS="-DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -mx32 -DL_ENDIAN -g -O2 -fdebug-prefix-map=/home/bigeasy/openssl1.0-1.0.2j=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIE -Wl,-z,relro -Wl,-z,now -Wa,--noexecstack -Wall -DMD32_REG_T=int -mx32 -Wl,--version-script=openssl.ld -shared -Wl,-soname=$SHLIB$SHLIB_SOVER$SHLIB_SUFFIX"; SHOBJECTS="e_gost_err.o gost2001_keyx.o gost2001.o gost89.o gost94_keyx.o gost_ameth.o gost_asn1.o gost_crypt.o gost_ctl.o gost_eng.o gosthash.o gost_keywrap.o gost_md.o gost_params.o gost_pmeth.o gost_sign.o"; ( :; LIBDEPS="${LIBDEPS:--L../.. -lcrypto}"; SHAREDCMD="${SHAREDCMD:-gcc}"; SHAREDFLAGS="${SHAREDFLAGS:--DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -mx32 -DL_ENDIAN -g -O2 -fdebug-prefix-map=/home/bigeasy/openssl1.0-1.0.2j=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIE -Wl,-z,relro -Wl,-z,now -Wa,--noexecstack -Wall -DMD32_REG_T=int -mx32 -Wl,--version-script=openssl.ld}"; LIBPATH=`for x in $LIBDEPS; do echo $x; done | sed -e 's/^ *-L//;t' -e d | uniq`; LIBPATH=`echo $LIBPATH | sed -e 's/ /:/g'`; LD_LIBRARY_PATH=$LIBPATH:$LD_LIBRARY_PATH ${SHAREDCMD} ${SHAREDFLAGS} -o $SHLIB$SHLIB_SOVER$SHLIB_SUFFIX $ALLSYMSFLAGS $SHOBJECTS $NOALLSYMSFLAGS $LIBDEPS ) && if [ -n "$INHIBIT_SYMLINKS" ]; then :; else prev=$SHLIB$SHLIB_SOVER$SHLIB_SUFFIX; if [ -n "$SHLIB_COMPAT" ]; then for x in $SHLIB_COMPAT; do ( :; rm -f $SHLIB$x$SHLIB_SUFFIX; ln -s $prev $SHLIB$x$SHLIB_SUFFIX ); prev=$SHLIB$x$SHLIB_SUFFIX; done; fi; if [ -n "$SHLIB_SOVER" ]; then ( :; rm -f $SHLIB$SHLIB_SUFFIX; ln -s $prev $SHLIB$SHLIB_SUFFIX ); fi; fi
|/usr/bin/ld: gost_eng.o: relocation R_X86_64_PC32 against symbol `stderr@@GLIBC_2.16' can not be used when making a shared object; recompile with -fPIC
|/usr/bin/ld: final link failed: Bad value
|collect2: error: ld returned 1 exit status
|../../Makefile.shared:167: recipe for target 'link_o.gnu' failed

and this attempt was with -fPIE without the -fPIC and the spec file
switch. So I *think* that maybe fPIE is not perfectly fine here. I don't
see a failure on sparc64 which is also using the spec file and the same
link rule for the first fips_premain_dso target.

> and according to gdb somewhere in the asm corner. So going from
> x86_64_asm to no_asm makes it build. Is there a reason why we should fix
> asm for x32 in the old openssl while it seems to work in 1.1.0?
> Otherwise I would drop the asm for x32 and be done with it.

dropped.

> btw: During the build I saw
> |gcc: note: pie specs /usr/share/dpkg/pie-compile.specs ignored when pie is not enabled
> |gcc: note: pie specs /usr/share/dpkg/pie-link.specs ignored when pie is not enabled
> 
> after each gcc line. This pops up also with openssl 1.1.0 but I don't
> see it in any for of the build logs (for 1.0.2 or 1.1.0) so it must be
> new.

#849542

> > Kurt
 
Sebastian