public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream/staging' into compiler-rt

Browse Source
This commit is contained in:
John Ericson
2018-05-24 02:58:00 -04:00
parent 46eeef1898 33b8830a85
commit 205fc55ea2
447 changed files with 3606 additions and 3015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/build-support/cc-wrapper/add-flags.sh
+3 -14
View File
@@ -14,26 +14,15 @@ var_templates_bool=(
NIX+ENFORCE_NO_NATIVE
)
# Accumulate infixes for taking in the right input parameters. See setup-hook
# for details.
declare -a role_infixes=()
if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_BUILD:-}" ]; then
role_infixes+=(_BUILD_)
fi
if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_HOST:-}" ]; then
role_infixes+=(_)
fi
if [ "${NIX_CC_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then
role_infixes+=(_TARGET_)
fi
accumulateRoles
# We need to mangle names for hygiene, but also take parameters/overrides
# from the environment.
for var in "${var_templates_list[@]}"; do
mangleVarList "$var" "${role_infixes[@]}"
mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"}
done
for var in "${var_templates_bool[@]}"; do
mangleVarBool "$var" "${role_infixes[@]}"
mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"}
done
# `-B@out@/bin' forces cc to use ld-wrapper.sh when calling ld.
pkgs/build-support/cc-wrapper/add-hardening.sh
+60 -55
View File
@@ -1,67 +1,72 @@
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
# Intentionally word-split in case 'hardeningEnable' is defined in
# Nix. Also, our bootstrap tools version of bash is old enough that
# undefined arrays trip `set -u`.
if [[ -v hardeningEnable[@] ]]; then
hardeningFlags+=(${hardeningEnable[@]})
fi
hardeningCFlags=()
declare -a hardeningCFlags=()
declare -A hardeningDisableMap
declare -A hardeningEnableMap=()
# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
do
hardeningDisableMap[$flag]=1
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
# array expansion also prevents undefined variables from causing trouble with
# `set -u`.
for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
hardeningEnableMap["$flag"]=1
done
# Remove unsupported flags.
for flag in @hardening_unsupported_flags@; do
unset -v "hardeningEnableMap[$flag]"
done
if (( "${NIX_DEBUG:-0}" >= 1 )); then
declare -a allHardeningFlags=(fortify stackprotector pie pic strictoverflow format)
declare -A hardeningDisableMap=()
# Determine which flags were effectively disabled so we can report below.
for flag in "${allHardeningFlags[@]}"; do
if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
hardeningDisableMap["$flag"]=1
fi
done
printf 'HARDENING: disabled flags:' >&2
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
echo >&2
fi
if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
if (( "${NIX_DEBUG:-0}" >= 1 )); then
if (( "${#hardeningEnableMap[@]}" )); then
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
fi
for flag in "${hardeningFlags[@]}"
do
if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
case $flag in
fortify)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
;;
stackprotector)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
;;
pie)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
hardeningCFlags+=('-fPIE')
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
hardeningCFlags+=('-pie')
fi
;;
pic)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
hardeningCFlags+=('-fPIC')
;;
strictoverflow)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
hardeningCFlags+=('-fno-strict-overflow')
;;
format)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
;;
*)
# Ignore unsupported. Checked in Nix that at least *some*
# tool supports each flag.
;;
esac
fi
done
fi
for flag in "${!hardeningEnableMap[@]}"; do
case $flag in
fortify)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
;;
stackprotector)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
hardeningCFlags+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
;;
pie)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
hardeningCFlags+=('-fPIE')
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
hardeningCFlags+=('-pie')
fi
;;
pic)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
hardeningCFlags+=('-fPIC')
;;
strictoverflow)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
hardeningCFlags+=('-fno-strict-overflow')
;;
format)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
;;
*)
# Ignore unsupported. Checked in Nix that at least *some*
# tool supports each flag.
;;
esac
done
pkgs/build-support/cc-wrapper/cc-wrapper.sh
+3 -3
View File
@@ -15,7 +15,7 @@ if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
fi
source @out@/nix-support/utils.sh
source @out@/nix-support/utils.bash
# Flirting with a layer violation here.
if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
@@ -134,8 +134,8 @@ fi
source @out@/nix-support/add-hardening.sh
# Add the flags for the C compiler proper.
extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE "${hardeningCFlags[@]}")
extraBefore=()
extraAfter=($NIX_@infixSalt@_CFLAGS_COMPILE)
extraBefore=(${hardeningCFlags[@]+"${hardeningCFlags[@]}"})
if [ "$dontLink" != 1 ]; then
pkgs/build-support/cc-wrapper/default.nix
+10 -4
View File
@@ -71,7 +71,7 @@ assert nativePrefix == bintools.nativePrefix;
stdenv.mkDerivation {
name = targetPrefix
+ (if name != "" then name else "${ccName}-wrapper")
+ (if name != "" then name else stdenv.lib.removePrefix targetPrefix "${ccName}-wrapper")
+ (stdenv.lib.optionalString (cc != null && ccVersion != "") "-${ccVersion}");
preferLocalBuild = true;
@@ -188,10 +188,16 @@ stdenv.mkDerivation {
wrap ${targetPrefix}gccgo ${./cc-wrapper.sh} $ccPath/${targetPrefix}gccgo
'';
strictDeps = true;
propagatedBuildInputs = [ bintools ];
depsTargetTargetPropagated = extraPackages;
setupHook = ./setup-hook.sh;
wrapperName = "CC_WRAPPER";
setupHooks = [
../setup-hooks/role.bash
./setup-hook.sh
];
postFixup =
''
@@ -277,7 +283,7 @@ stdenv.mkDerivation {
+ ''
substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
substituteAll ${./utils.sh} $out/nix-support/utils.sh
substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
##
## Extra custom steps
@@ -288,7 +294,7 @@ stdenv.mkDerivation {
inherit expand-response-params;
# for substitution in utils.sh
# for substitution in utils.bash
expandResponseParams = "${expand-response-params}/bin/expand-response-params";
meta =
pkgs/build-support/cc-wrapper/setup-hook.sh
+13 -42
View File
@@ -60,61 +60,28 @@ set -u
# native compile.
#
# TODO(@Ericson2314): No native exception
[[ -z ${crossConfig-} ]] || (( "$hostOffset" < 0 )) || return 0
[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
# It's fine that any other cc-wrapper will redefine this. Bash functions close
# over no state, and there's no @-substitutions within, so any redefined
# function is guaranteed to be exactly the same.
ccWrapper_addCVars () {
# The `depHostOffset` describes how the host platform of the dependencies
# are slid relative to the depending package. It is brought into scope of
# the environment hook defined as the role of the dependency being applied.
case $depHostOffset in
-1) local role='BUILD_' ;;
0) local role='' ;;
1) local role='TARGET_' ;;
*) echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
return 1 ;;
esac
# See ../setup-hooks/role.bash
local role_post role_pre
getTargetRoleEnvHook
if [[ -d "$1/include" ]]; then
export NIX_${role}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
export NIX_${role_pre}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
fi
if [[ -d "$1/Library/Frameworks" ]]; then
export NIX_${role}CFLAGS_COMPILE+=" -F$1/Library/Frameworks"
export NIX_${role_pre}CFLAGS_COMPILE+=" -F$1/Library/Frameworks"
fi
}
# Since the same cc-wrapper derivation can be depend on in multiple ways, we
# need to accumulate *each* role (i.e. target platform relative the depending
# derivation) in which the cc-wrapper derivation is used.
# `NIX_CC_WRAPPER_@infixSalt@_TARGET_*` tracks this (needs to be an exported env
# var so can't use fancier data structures).
#
# We also need to worry about what role is being added on *this* invocation of
# setup-hook, which `role` tracks.
case $targetOffset in
-1)
export NIX_CC_WRAPPER_@infixSalt@_TARGET_BUILD=1
role_pre='BUILD_'
role_post='_FOR_BUILD'
;;
0)
export NIX_CC_WRAPPER_@infixSalt@_TARGET_HOST=1
role_pre=''
role_post=''
;;
1)
export NIX_CC_WRAPPER_@infixSalt@_TARGET_TARGET=1
role_pre='TARGET_'
role_post='_FOR_TARGET'
;;
*)
echo "cc-wrapper: used as improper sort of dependency" >2;
return 1
;;
esac
# See ../setup-hooks/role.bash
getTargetRole
getTargetRoleWrapper
# We use the `targetOffset` to choose the right env hook to accumulate the right
# sort of deps (those with that offset).
@@ -147,6 +114,10 @@ export ${role_pre}CXX=@named_cxx@
export CC${role_post}=@named_cc@
export CXX${role_post}=@named_cxx@
# If unset, assume the default hardening flags.
: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
export NIX_HARDENING_ENABLE
# No local scope in sourced file
unset -v role_pre role_post
set +u
pkgs/build-support/cc-wrapper/utils.sh
-80
View File
@@ -1,80 +0,0 @@
mangleVarList() {
local var="$1"
shift
local -a role_infixes=("$@")
local outputVar="${var/+/_@infixSalt@_}"
declare -gx ${outputVar}+=''
# For each role we serve, we accumulate the input parameters into our own
# cc-wrapper-derivation-specific environment variables.
for infix in "${role_infixes[@]}"; do
local inputVar="${var/+/${infix}}"
if [ -v "$inputVar" ]; then
export ${outputVar}+="${!outputVar:+ }${!inputVar}"
fi
done
}
mangleVarBool() {
local var="$1"
shift
local -a role_infixes=("$@")
local outputVar="${var/+/_@infixSalt@_}"
declare -gxi ${outputVar}+=0
for infix in "${role_infixes[@]}"; do
local inputVar="${var/+/${infix}}"
if [ -v "$inputVar" ]; then
# "1" in the end makes `let` return success error code when
# expression itself evaluates to zero.
# We don't use `|| true` because that would silence actual
# syntax errors from bad variable values.
let "${outputVar} |= ${!inputVar:-0}" "1"
fi
done
}
skip () {
if (( "${NIX_DEBUG:-0}" >= 1 )); then
echo "skipping impure path $1" >&2
fi
}
# Checks whether a path is impure. E.g., `/lib/foo.so' is impure, but
# `/nix/store/.../lib/foo.so' isn't.
badPath() {
local p=$1
# Relative paths are okay (since they're presumably relative to
# the temporary build directory).
if [ "${p:0:1}" != / ]; then return 1; fi
# Otherwise, the path should refer to the store or some temporary
# directory (including the build directory).
test \
"$p" != "/dev/null" -a \
"${p:0:${#NIX_STORE}}" != "$NIX_STORE" -a \
"${p:0:4}" != "/tmp" -a \
"${p:0:${#NIX_BUILD_TOP}}" != "$NIX_BUILD_TOP"
}
expandResponseParams() {
declare -ga params=("$@")
local arg
for arg in "$@"; do
if [[ "$arg" == @* ]]; then
# phase separation makes this look useless
# shellcheck disable=SC2157
if [ -x "@expandResponseParams@" ]; then
# params is used by caller
#shellcheck disable=SC2034
readarray -d '' params < <("@expandResponseParams@" "$@")
return 0
else
echo "Response files aren't supported during bootstrapping" >&2
return 1
fi
fi
done
}