Hi,
Ben Cotton <bcotton(a)redhat.com> writes:
The annobin package provides two components, a plugin for gcc that
records details about how a program was compiled and an analyser that
uses this information to produce a report on the security hardening
status of the compiled program. Currently the plugin is being used as
part of the build process for Fedora packages (when they are built
using gcc), but the analysing program is not being run. This proposal
is to have the analyser (called annocheck) run when creating
information for review by the Bodhi update process, possibly allowing
an update to be delayed until the security issues are addressed.
I currently run annocheck manually on my builds, so I am a fan of this
change.
But I think it's worth calling out one limitation: this currently mostly
works with gcc. clang is a bit behind in implementing some of the
features that annocheck looks at. With Fedora 30, annocheck would
cleanly skip most of clang-produced binaries. With Fedora 31, clang
seems to insert some of the meta-data that annocheck looks for, but
doesn't quite implement to match the gcc standard. I have recently run
into failures flagged by annocheck that I need to dig into on Fedora 31.
It is desirable that the packaging guidelines be updated to describe
the security hardening features examined by annocheck. (If they are
not already mentioned in the guidelines).
https://docs.fedoraproject.org/en-US/packaging-guidelines/#_compiler_flags
has some of this, but not all. It seems to me like annocheck is more
strict than the current packaging guidelines.
Thanks,
Omair
--
PGP Key: B157A9F0 (
http://pgp.mit.edu/)
Fingerprint = 9DB5 2F0B FD3E C239 E108 E7BD DF99 7AF8 B157 A9F0