Bug#989000: distutils: missing CFLAGS/LDFLAGS from environment

0 views
Skip to first unread message

Samuel Thibault

unread,
May 22, 2021, 5:20:03 PMMay 22
to
Package: python3.9
Version: 3.9.2-1
Severity: normal
Affects: brltty

Hello,

The brltty package build is currently unreproducible because the build
path leaks into its Python bindings because distutils does not take
CFLAGS (and not LDFLAGS either) from the environment.

That can be seen in the brltty build log (as of current git version that
enables verbose log):

/tmp/brltty-6.3+dfsg$ dpkg-buildpackage
[...]
set -- --verbose build --build-temp .; \
[ "linux-gnu" != "mingw32" ] || set -- "${@}" --compiler mingw32; \
"/usr/bin/python3.9" ./setup.py "${@}"
running build
running build_ext
building 'brlapi' extension
x86_64-linux-gnu-gcc -pthread -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O2 -Wall -g -ffile-prefix-map=/build/python3.9-RNBry6/python3.9-3.9.2=. -fstack-protector-strong -Wformat -Werror=format-security -g -fwrapv -O2 -g -ffile-prefix-map=/build/python3.9-RNBry6/python3.9-3.9.2=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -I. -I../../../Bindings/Python -I../../Programs -I../../../Programs -I../../ -I../../../ -I/usr/include/python3.9 -c ../../../Bindings/Python/bindings.c -o ./../../../Bindings/Python/bindings.o -Wno-parentheses -Wno-unused -fno-strict-aliasing -U_POSIX_C_SOURCE -U_XOPEN_SOURCE
x86_64-linux-gnu-gcc -pthread -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O2 -Wall -g -ffile-prefix-map=/build/python3.9-RNBry6/python3.9-3.9.2=. -fstack-protector-strong -Wformat -Werror=format-security -g -fwrapv -O2 -g -ffile-prefix-map=/build/python3.9-RNBry6/python3.9-3.9.2=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -I. -I../../../Bindings/Python -I../../Programs -I../../../Programs -I../../ -I../../../ -I/usr/include/python3.9 -c brlapi.auto.c -o ./brlapi.auto.o -Wno-parentheses -Wno-unused -fno-strict-aliasing -U_POSIX_C_SOURCE -U_XOPEN_SOURCE
creating build
creating build/lib.linux-x86_64-3.9
x86_64-linux-gnu-gcc -pthread -shared -Wl,-O1 -Wl,-Bsymbolic-functions -Wl,-z,relro -g -fwrapv -O2 -Wl,-z,relro -g -fwrapv -O2 -g -ffile-prefix-map=/build/python3.9-RNBry6/python3.9-3.9.2=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 ./../../../Bindings/Python/bindings.o ./brlapi.auto.o -L./../../Programs -lbrlapi -lpthread -o build/lib.linux-x86_64-3.9/brlapi.cpython-39-x86_64-linux-gnu.so

I.e. distutils passes to gcc the flags it got during python3.9 build
(which included -ffile-prefix-map=/build/python3.9-RNBry6/python3.9-3.9.2=.)
but it does not include the flags it got from the environment (which
includes -ffile-prefix-map=/tmp/brltty-6.3+dfsg=.), and as a result the
generated .o and .so files include the build path /tmp/brltty-6.3+dfsg.


blhc also notices that LDFLAGS is not getting included:

https://salsa.debian.org/a11y-team/brltty/-/jobs/1660079

2438:LDFLAGS missing (-Wl,-z,now): x86_64-linux-gnu-gcc -pthread -shared -Wl,-O1 -Wl,-Bsymbolic-functions -Wl,-z,relro -g -fwrapv -O2 -Wl,-z,relro -g -fwrapv -O2 -g -ffile-prefix-map=/build/python3.9-RNBry6/python3.9-3.9.2=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 ./../../../Bindings/Python/bindings.o ./brlapi.auto.o -L./../../Programs -lbrlapi -lpthread -o build/lib.linux-x86_64-3.9/brlapi.cpython-39-x86_64-linux-gnu.so

Samuel

-- System Information:
Debian Release: 11.0
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), (500, 'proposed-updates'), (500, 'oldoldstable'), (500, 'buildd-unstable'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental-debug'), (1, 'buildd-experimental'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.12.0 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages python3.9 depends on:
ii libpython3.9-stdlib 3.9.2-1
ii media-types 4.0.0
ii mime-support 3.66
ii python3.9-minimal 3.9.2-1

python3.9 recommends no packages.

Versions of packages python3.9 suggests:
ii binutils 2.35.2-2
pn python3.9-doc <none>
ii python3.9-venv 3.9.2-1

-- no debconf information

--
Samuel
Profitant de cette occasion, vous serait-il possible de rebooter
aussi Modérator et son petit copain qui gère les ressources de
download ?
-+- OB in NPC : Apprendre à flasher son personnel -+-

Samuel Thibault

unread,
May 22, 2021, 5:40:03 PMMay 22
to
Samuel Thibault, le sam. 22 mai 2021 23:10:16 +0200, a ecrit:
> That can be seen in the brltty build log (as of current git version that
> enables verbose log):

That is

git clone https://salsa.debian.org/a11y-team/brltty.git
cd brltty
git checkout cc47bc6d950c0bca6c061be6f4750661d17e977e

(In a later revision I added passing over CFLAGS/LDFLAGS by hand, but we
don't want to have to patch each and every debian python package like
this)

Samuel

Samuel Thibault

unread,
Sep 12, 2021, 3:40:04 PMSep 12
to
Hello,

From: Debian FTP Masters <ftpm...@ftp-master.debian.org>
> * Fix CFLAGS in the python3.x-config scripts. Closes: #992669, #989000.

Thanks for fixing CFLAGS!

However LDFLAGS are still missing:

Samuel Thibault, le sam. 22 mai 2021 23:10:16 +0200, a ecrit:
> blhc also notices that LDFLAGS is not getting included:
>
> https://salsa.debian.org/a11y-team/brltty/-/jobs/1660079
>
> 2438:LDFLAGS missing (-Wl,-z,now): x86_64-linux-gnu-gcc -pthread -shared -Wl,-O1 -Wl,-Bsymbolic-functions -Wl,-z,relro -g -fwrapv -O2 -Wl,-z,relro -g -fwrapv -O2 -g -ffile-prefix-map=/build/python3.9-RNBry6/python3.9-3.9.2=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 ./../../../Bindings/Python/bindings.o ./brlapi.auto.o -L./../../Programs -lbrlapi -lpthread -o build/lib.linux-x86_64-3.9/brlapi.cpython-39-x86_64-linux-gnu.so

That is still the case, see for instance:

https://salsa.debian.org/a11y-team/brltty/-/jobs/1938826

Samuel

Matthias Klose

unread,
Sep 17, 2021, 6:30:04 AMSep 17
to
I don't see these flags anymore in

/usr/lib/python3.9/_sysconfigdata__x86_64-linux-gnu.py

or

/usr/bin/python3.9-config

Please could you check where these come from?

Matthias

Samuel Thibault

unread,
Sep 18, 2021, 5:30:04 PMSep 18
to
Matthias Klose, le ven. 17 sept. 2021 12:18:53 +0200, a ecrit:
They are there:

'BLDSHARED': 'x86_64-linux-gnu-gcc -pthread -shared -Wl,-O1 '
'-Wl,-Bsymbolic-functions '
' -Wl,-z,relro -g '
'-fwrapv -O2 ',

'LDFLAGS': ' -Wl,-z,relro -g -fwrapv '
'-O2 ',

The command shown above is basically

$BLDSHARED $LDFLAGS $CFLAGS ./../../../Bindings/Python/bindings.o [...]

(where CFLAGS is indeed now properly coming from environment, but
LDFLAGS is still as set in _sysconfigdata__x86_64-linux-gnu.py and not
from the environment.

Samuel

Matthias Klose

unread,
Sep 19, 2021, 4:50:03 AMSep 19
to
ahh, so -Wl,-z,relro was still set...
Reply all
Reply to author
Forward
0 new messages