Hi all,
There are rebuilds ongoing for packages build before 2017-01-01, this *should* add PIE and the newer BUILDINFO format to these old packages. And uncovers some build failures, which should be fixed and I will make a todolist for.
Note, that we still not have PIE for everything :-( Packages without PIE are listed here, note that Haskell will require some research to enable PIE. Golang/Rust packages also require special treatment. [1]
[1] http://pkgbuild.com/~jelle/repro_sec_status.txt
On 11/09/18 at 10:54pm, Jelle van der Waa wrote:
Hi all,
There are rebuilds ongoing for packages build before 2017-01-01, this *should* add PIE and the newer BUILDINFO format to these old packages. And uncovers some build failures, which should be fixed and I will make a todolist for.
Fake news, we are rebuilding everything before 2017-08-01!
On 11/9/18 5:29 PM, Jelle van der Waa wrote:
On 11/09/18 at 10:54pm, Jelle van der Waa wrote:
Hi all,
There are rebuilds ongoing for packages build before 2017-01-01, this *should* add PIE and the newer BUILDINFO format to these old packages. And uncovers some build failures, which should be fixed and I will make a todolist for.
Fake news, we are rebuilding everything before 2017-08-01!
We more or less need to rebuild everything since 2018-09-11 because svn propsets aren't reproducible no matter what BUILDINFO format you use. :p
On 11/10/18 at 08:15pm, Eli Schwartz via arch-dev-public wrote:
On 11/9/18 5:29 PM, Jelle van der Waa wrote:
On 11/09/18 at 10:54pm, Jelle van der Waa wrote:
Hi all,
There are rebuilds ongoing for packages build before 2017-01-01, this *should* add PIE and the newer BUILDINFO format to these old packages. And uncovers some build failures, which should be fixed and I will make a todolist for.
Fake news, we are rebuilding everything before 2017-08-01!
We more or less need to rebuild everything since 2018-09-11 because svn propsets aren't reproducible no matter what BUILDINFO format you use. :p
Sure, but we do things in batches. My current goal is first see how far we can come with PIE. When we really have something official for reproducing our packages, we should indeed fix those packages.
arch-dev-public@lists.archlinux.org