similar to: vanilla build of 7.7p1 release on linux/4.17 fails with gcc8 @ "/usr/bin/ld: unrecognized option '-Wl,-z,retpolineplt'"

On Thu, Jun 07, 2018 at 06:14:42PM -0700, PGNet Dev wrote: > On 6/7/18 6:08 PM, Darren Tucker wrote: > > Well the intent is you should be able to set CC and LD to whatever you > > want as long as they work. In this case, the OSSH_CHECK_LDFLAG_LINK > > test invokes autoconf's AC_LINK_IFELSE with uses CC not LD. I'm not > > sure what to do about it yet though. I

hi On 6/7/18 4:03 PM, Darren Tucker wrote: > On 8 June 2018 at 07:09, PGNet Dev <pgnet.dev at gmail.com> wrote: >> Verifying a report I just got pinged about, building vanilla openssh 7.7p1 on linux configures ok, but fails build around 'retpoline' > [...] >> Should the retpoline flag be getting added? If so, what's needed to make LD happy with it? > >

On 8 June 2018 at 10:52, PGNet Dev <pgnet.dev at gmail.com> wrote: [...] > So, there's a problem for OpenSSH build with spec'ing LD=/usr/bin/ld ? in this particular case, apparently yes. not generally, though. [...] > What's *intended* re: openssh? Support for LD=ld or only =gcc, or undef'd ? Well the intent is you should be able to set CC and LD to whatever you

On 8 June 2018 at 11:21, PGNet Dev <pgnet.dev at gmail.com> wrote: > fyi > > add'l -- and looks unrelated -- issue > /usr/include/pthread.h:251:12: note: previous declaration of ?pthread_join? was here > extern int pthread_join (pthread_t __th, void **__thread_return); What included pthread.h? That's explicitly not supported by sshd: $ grep THREAD

One difference I notice is that in your failing example you are invoking /usr/bin/ld directly to link: /usr/bin/ld -o ssh ssh.o readconf.o clientloop.o sshtty.o sshconnect.o sshconnect2.o mux.o -L. -Lopenbsd-compat/ -Wl,-z,retpolineplt -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie -lssh -lopenbsd-compat -lutil -lz -lcrypt -lresolv whereas my example is

Hi. Both GCC and clang are adding mitigations for Spectre variant 2 although neither have yet made a release and neither are on by default. After trolling through and building release candidate branches for both I believe this is what is required for the ssh programs (although all the dependent libraries will also need to be built with mitigations, and I suspect libcrypto is a more likely

Also what exact distro and version are you having the problem on and what version of ld does it have? Mine is $ ld --version GNU ld version 2.29.1-23.fc28 -- Darren Tucker (dtucker at dtucker.net) GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860 37F4 9357 ECEF 11EA A6FA (new) Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.

On 8 June 2018 at 12:09, PGNet Dev <pgnet.dev at gmail.com> wrote: [...] > /usr/bin/ld -o ssh ssh.o readconf.o clientloop.o sshtty.o sshconnect.o sshconnect2.o mux.o -L. -Lopenbsd-compat/ -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -fstack-protector-strong -pie -lssh -lopenbsd-compat -lutil -lz -lcrypt -lresolv > /usr/bin/ld: unrecognized option

On 6/7/18 8:37 PM, Darren Tucker wrote: > On 8 June 2018 at 12:21, Darren Tucker <dtucker at dtucker.net> wrote: >> On 8 June 2018 at 12:09, PGNet Dev <pgnet.dev at gmail.com> wrote: >> [...] >>> /usr/bin/ld -o ssh ssh.o readconf.o clientloop.o sshtty.o sshconnect.o sshconnect2.o mux.o -L. -Lopenbsd-compat/ -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack

We recently discovered that our OpenSSH distribution binaries contain retpoline thunks. It's due to this OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc This was quite surprising because at least the GNU/Linux userspace has no provisions for retpolines. You also fail to enable -fno-plt, so you need

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 The same result without CFLAGS: configure:17300: checking for mblen configure:17356: gcc -o conftest -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE

On Wed, Mar 22, 2023 at 03:59:45PM +0800, Peng Fan (OSS) wrote: > From: Peng Fan <peng.fan at nxp.com> > > "-mfunction-return=thunk -mindirect-branch-register" are only valid > for x86. So introduce compiler operation check to avoid such issues > > Fixes: 0d0ed4006127 ("tools/virtio: enable to build with retpoline") > Signed-off-by: Peng Fan

On Thu, 23 Mar 2023 12:00:24 +0800, "Peng Fan (OSS)" <peng.fan at oss.nxp.com> wrote: > From: Peng Fan <peng.fan at nxp.com> > > "-mfunction-return=thunk -mindirect-branch-register" are only valid > for x86. So introduce compiler operation check to avoid such issues > > Fixes: 0d0ed4006127 ("tools/virtio: enable to build with retpoline")

Hello, friends! I need help. When I compile openssh-7.2p2 I get the error. ./configure .. OpenSSH has been configured with the following options: User binaries: /usr/local/bin System binaries: /usr/local/sbin Configuration files: /usr/local/etc Askpass program: /usr/local/libexec/ssh-askpass

On 8/08/2018 5:29 pm, Thore B?decker wrote: > Hey, > > you mentioned that dovecot builds fine, but does "make check" also > complete successfully with a glibc-2.28 build on a glibc-2.28 system? > > We have been seeing segfaults during "make check" and it seems the following > patch was able to make the testsuite run successfully. > > Just out of

Hi, Tried to build dovecot-2.3.4 on Solaris 11 x86 and it fails at configure part. I just went checked and it last version it works on is v2.3.2.1 Version 2.3.2.1 (OK) # ./configure .... checking Linux compatible mremap()... no checking whether shared mmaps get updated by write()s... yes checking whether fd passing works... yes ... Version 2.3.4 (FAIL) .... checking Linux compatible

Hi. I upgraded my main build host and the clang -Werror builds started failing. This is because clang 10's -Wimplicit-fallthrough doesn't understand /* FALLTHROUGH */ but rather requires __attribute__((fallthrough)): clang -Wall -O2 [...] -Wimplicit-fallthrough [...] -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -DHAVE_CONFIG_H -c /openbsd-compat/base64.c

https://bugzilla.mindrot.org/show_bug.cgi?id=3192 Bug ID: 3192 Summary: openssh-8.2 & openssl-1.1.1d error: dereferencing pointer to incomplete type Not found struct BIO , bio->num_write Product: Portable OpenSSH Version: 8.2p1 Hardware: Other OS: Linux Status: NEW

`git describe' says V_7_3_P1-207-gc924b2ef (shouldn't it say V_7_4_P1-<yadayada>?). This is what I see: gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -D_FORTIFY_SOURCE=2 -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I.

Back in January/March of 2017, it was the case that building openssh with the latest openssl on MacOS 10.12.x (Sierra) was a bit of a bother. I could build everything with Xcode, but the resulting sshd segfaulted upon invocation (see the archives). So I built gcc 6.3 and used that to build openssh 7.x on Sierra. As long as machines stayed on 10.12.x, all was fine. Under High Sierra, the Xcode