tech-pkg archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Updated patch for pkgsrc hardening



Do you have a plan for how this will be extended to more
compilers/platforms?  I'd like to understand that before we start.

I am curious what kind of testing this has received.  Have you done bulk
builds with this?  On which platforms?  Have the programs had their
tests run ('make test'), and are there regressions?   What compilers
have been tested with this besides gcc?  Certainly clang matters.  But
if you are saying that no behavior will change except for netbsd/gcc,
that's probably ok.

This adds things to wrappers, but what about cwrappers?  We are nearing
flipping to cwrappers by default, which I think means that we are in a
period where changes have to apply to both.  Also, the new wrapper seems
to open-code flags, making it harder to maintain this and to port to
clang.

I would like to see this separated into adding mechanisms that don't
behave differently by default and later changing the defaults, so that
people can easily experiment locally, rather than having the new
behavior hit everyone right away.

  +#PKGSRC_MKPIE?= yes

  +.if ${PKGSRC_MKPIE:Uyes} != "no"

I find this style confusing (moving the default into the test, vs having
a normal test and setting the variable).  It also makes it harder to
just leave "PKGSRC_MKPIE?= no" as default (if that is indeed the current
behavior), and add the extra behavior when it's defined.  This feels
like optimizing make code at the expense of understandability,
especially to people who are not serious make coders.

So all I all I'd like:

  to hear the long-term plan (other platforms, other compilers)

  to avoid the yes=no make-optimization

  to figure out about cwrappers

  to have this be just adding features that can be turned on, not
  changing defaults

in support of people being able to test more before having a separate
conversation about flipping the defaults.

But that's just me and I'd like to hear what others think, in particular
the people who hack on wrappers and compiler stuff more than I do.

Attachment: signature.asc
Description: PGP signature



Home | Main Index | Thread Index | Old Index