Commit Graph

435 Commits

Author SHA1 Message Date
stuebinm
ff1a94e523 treewide: add meta.mainProgram to packages with a single binary
The nixpkgs-unstable channel's programs.sqlite was used to identify
packages producing exactly one binary, and these automatically added
to their package definitions wherever possible.
2024-03-19 03:14:51 +01:00
Mario Rodas
d4b73625ba
Merge pull request #285514 from trofi/glibc-no-cet-on-i686
glibc: enable `cet` only on `x86_64` (skip `x86_32`)
2024-02-01 18:19:41 -05:00
Sergei Trofimovich
e447b1533e glibc: enable cet only on x86_64 (skip x86_32)
`glibc-2.39` improved `--enable-cet` detection on unsupported platforms
and `./configure` will start failing as:

    glibc> configure: error: "CET is only supported on x86_64 or x32"
2024-02-01 09:48:19 +00:00
Thomas Gerbet
7f8349fd48 glibc: 2.38-27 -> 2.38-44 and patch for glibc possible memory corruption in qsort()
Fixes CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780

Advisories from Qualys:
https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
https://www.qualys.com/2024/01/30/qsort.txt

Upstream advisories:
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0001;h=28931c75ae018cc398344af80e6be6ab6e1874b7;hb=6cdc44214253a74e7140d75a7ebfc900820a5fa8
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0002;h=940bfcf2fcb760505ec59d84b94250aaf49c3be9;hb=6cdc44214253a74e7140d75a7ebfc900820a5fa8
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0003;h=b43a5150ab1b0cc4ef2cabf5bf792428389f5e37;hb=6cdc44214253a74e7140d75a7ebfc900820a5fa8
2024-02-01 00:32:04 +01:00
Peder Bergebakken Sundt
f41aba3739 treewide: remove unreferenced patch files
Found with `fd \\.patch$ pkgs/ -x bash -c 'rg -F "{/}" pkgs/ -q || echo {}'`
2023-12-01 06:11:20 +01:00
Connor Baker
2b47345ff5 glibc: add NVCC include guards to fix ARM CUDA compilation 2023-11-06 00:53:11 +00:00
Vladimír Čunát
4d86c20f10
Merge branch 'master' into staging-next
Fixes an issue blocking staging-next-small evaluation.
2023-10-26 11:41:00 +02:00
Adam Joseph
b4371a5cea glibc: weaken host==build check to canExecute 2023-10-26 06:12:33 +00:00
Adam Joseph
27a73cd176 glibc: use (lib.getBin pkgsBuildBuild.glibc) to generate locales
This is an alternative resolution of the problem identified in

  https://github.com/NixOS/nixpkgs/pull/259964

which stated that "glibc depends on buildPackages.glibc for locale
things.  buildPackages.glibc depended on buildPackages.libgcc,
which, since it's GCC, depends on the target's bintools, which
depend on the target's glibc, which, again, depends on
buildPackages.glibc, causing an infinute recursion when evaluating
buildPackages.glibc when glibc hasn't come from stdenv (e.g. on
musl)."

The fact that we use pkgsBuildHost.glibc instead of
pkgsBuildBuild.glibc to generate the locales has always been a gross
hack.  If we simply remove the gross hack the circularity goes away.
2023-10-26 06:12:33 +00:00
Maximilian Bosch
7cd09e8073
Merge pull request #254334 from jiegec/glibc-libutil
glibc: use libutil.a when libutil.so.1 is unavailable
2023-10-10 09:23:07 +02:00
Maximilian Bosch
8bc5104a6e
treewide: refactor .attrs.sh detection
When specifying the `builder` attribute in `stdenv.mkDerivation`, this
will be effectively transformed into

    builtins.derivation {
      builder = stdenv.shell;
      args = [ "-e" builder ];
    }

This also means that `default-builder.sh` is never sourced and as a
result it's not guaranteed that `$NIX_ATTRS_SH_FILE` is set to a correct
location[1].

Also, we need to source `.attrs.sh` to source `$stdenv`. So, the
following is done now:

* If `$NIX_ATTRS_SH_FILE` points to a correct location, then use it.
  Directly using `.attrs.sh` is problematic for `nix-shell(1)` usage
  (see previous commit for more context), so prefer the environment
  variable if possible.

* Otherwise, if `.attrs.sh` exists, then use it. See [1] for when this
  can happen.

* If neither applies, it can be assumed that `__structuredAttrs` is
  turned off and thus nothing needs to be done.

[1] It's possible that it doesn't exist at all - in case of Nix 2.3 or
    it can point to a wrong location on older Nix versions with a bug in
    `__structuredAttrs`.
2023-10-04 18:36:57 +02:00
edef
caa3d9d75d
glibc: 2.38-23 -> 2.38-27
Fixes CVE-2023-4911.

Change-Id: I154c79a7c6822051903ef15c547c3567691b1457
2023-10-04 14:19:15 +02:00
Maximilian Bosch
8348b18c09
glibc: 2.38-0 -> 2.38-23
Fixes CVE-2023-4806 & CVE-2023-4527.
2023-09-24 15:13:26 +02:00
Maximilian Bosch
e86152986c
glibc: 2.37-39 -> 2.38-0
Announcement: https://sourceware.org/pipermail/libc-alpha/2023-July/150524.html

So far this looks surprisingly good, I managed to build the stdenv
on `aarch64-linux` and got up to building `zfs` and `nix` on `x86_64-linux`.

The patchset is still empty because the latest commit on the release branch is
the one the 2.38 tag points to. I added an empty file though to keep
things consistent.

Also applied the new version of the DT_HASH fix from ArchLinux[1]. This
one's a way easier version than before because it doesn't contain the
autoconf changes, but only hardcodes the desired ld flags. It was
already confirmed that this patch is sufficient to fix the underlying
problem[2].

[1] e54d98e2d1 (7b1bfda0391ff4c2662e04a5e193c37e233a0738)
[2] https://github.com/ValveSoftware/Proton/issues/6051#issuecomment-1666055553
2023-09-24 15:10:19 +02:00
Thomas Gerbet
b23e08124d glibc: 2.37-8 -> 2.37-39
Includes fixes for CVE-2023-4527 and CVE-2023-4806

https://sourceware.org/bugzilla/show_bug.cgi?id=30842
https://sourceware.org/bugzilla/show_bug.cgi?id=30843
2023-09-23 14:25:12 +02:00
Jiajie Chen
9ced81cfbd glibc: use libutil.a when libutil.so.1 is unavailable
On some platforms (e.g. loongarch64-linux), libutil.so.1 is not built in
glibc (see glibc login/Makefile), only a dummy libutil.a is provided.
Do not symlink libutil.so but copy libutil.a to glibc.out if
libutil.so.1 does not exist.
2023-09-10 13:38:00 +08:00
github-actions[bot]
df770ba961
Merge master into staging-next 2023-08-15 06:01:24 +00:00
Adam Joseph
64046f0191 glibcCross: use a libgcc built separately from gcc
### Summary

This PR completely and finally solves the gcc<->glibc circular
`buildInputs` problem, for cross compilation.  The same technique
can be applied to native builds in the future.

Closes #213453

 ### Motivation

Prior to this PR, we had the following circular `buildInputs` problem:

1. gcc has glibc in its `buildInputs`

   - a compiled copy of glibc must be present before building gcc;
     if it isn't, gcc cripples itself (`inhibit_libc`) and refuses
     to build libgcc_s.so

2. glibc has libgcc_s.so in its `buildInputs`

   - glibc `dlopen()`s libgcc_s.so in order to implement POSIX
     thread cancellation.  For security reasons `glibc` requires
     that the path to `libgcc_s.so` is [hardwired] into `glibc` at
     compile time, so it's technically not a true dynamic link -- it
     just pretends to be one.

3. libgcc_s.so is built in the same derivation as gcc

   - libgcc_s.so is built as part of the gcc build process

We must cut one of these three links in the loop.

 ### Previous Attempts

Previously https://github.com/NixOS/nixpkgs/pull/238154 had
attempted to cut link (1) by building `gcc` without `glibc`, and
using the `libgcc_s` which emerges from that build.  Unfortunately
this just doesn't work.  GCC's configure script extracts quite a lot
of information from the glibc headers (which are a build artifact --
you can't just copy them out of the source tarball) and various
`./configure`-driven linking attempts.  If `glibc` isn't around at
build time you wind up with a `libgcc_s.so` that is missing various
unwinder features (see https://github.com/NixOS/nixpkgs/issues/213453
for the most problematic one).

Musl "cuts" link (2), or rather never creates it in the first place.
["Cancellation cleanup handling in musl has no relationship to C++
exceptions and unwinding... glibc implements cancellation as an
exception"](https://wiki.musl-libc.org/functional-differences-from-glibc.html#Thread-cancellation).
IMHO Musl made the smarter decision here.  It is incredibly rare to
find a codebase that uses both POSIX thread cancellation *and* C++
exceptions.  I have never seen a codebase that uses both *and*
expects them to be aware of each other, and I would be astonished if
one existed.  Glibc paid an immense cost in complexity for something
nobody has ever used.

 ### Changes Made

This PR cuts link (3): instead of building libgcc_s.so as part of
gcc, we build it separately from gcc.  Now there is a strict acyclic
graph of `buildInputs`:

```
 gccWithoutTargetLibc
 |
 +--->glibc-nolibgcc
 |    |
 |    v
 +--->libgcc
 |    |
 |    v
 +--->glibc
 |    |
 |    v
 +--->gcc
```

In other words, there's a simple linear `buildInputs` chain
`glibc-nolibgcc` `->` `libgcc` `->` `glibc` `->` `gcc` where all
four packages are compiled by (and therefore have as a
`(native)BuildInput`) `gccWithoutTargetLibc`.

`gccWithoutTargetLibc` and `glibc-nolibgcc` are strictly
bootstrapping artifacts; nothing else has them as a `buildInput` and
they shouldn't appear in the closure of any final deployment
packages.  `glibc-nolibgcc` lacks `libgcc_s.so`, so it will segfault
if you try to use it with POSIX thread cancellation.  Fortunately
all we need from it is (a) its headers (`lib.getDev`) and (b) to use
it in the `./configure` script for `libgcc`.

When translated over to the native bootstrap, `xgcc` takes the place
of `gccWithoutTargetLibc`, and the "first `glibc`" (we build two of
them) takes the place of `glibc-nolibgcc`.  At that point our native
and cross bootstrap have the same overall architecture, and it
becomes possible to merge them (at last!)

[213453]: https://github.com/NixOS/nixpkgs/issues/213453
[238154]: https://github.com/NixOS/nixpkgs/pull/238154
[hardwired]: 7553d0fe29/pkgs/development/libraries/glibc/default.nix (L69-L88)
2023-08-14 15:09:06 -07:00
Vladimír Čunát
5b033f3a00
Merge #246049: glibcLocales: disable parallelism
..to restore deterministic locales; Merge into staging
2023-08-11 10:23:32 +02:00
Yureka
7197b9f03b
glibcLocales: fix extraNativeBuildInputs definition (#246537) 2023-08-02 21:02:33 +02:00
Sergei Trofimovich
43da9e8fff glibcLocales: disable parallelism to restore deterministic locales
The way `nixpkgs` runs parallel `localedef` instances shares
`--prefix=/build` flag. As a result `localedef` processes
non-deterministically extend the file with new locales (hopefully
without data corruption):

    https://github.com/NixOS/nixpkgs/issues/245360

Co-authored-by: Adam Joseph <54836058+amjoseph-nixpkgs@users.noreply.github.com>
2023-07-29 20:43:50 +01:00
Sergei Trofimovich
4d4f5e2db1 glibcLocales: enable parallel building 2023-06-20 09:38:33 +01:00
Maximilian Bosch
1f72072bdd
Merge pull request #238027 from amjoseph-nixpkgs/pr/glibc/parallel
glibcLocales: use more than one core to build
2023-06-17 14:55:40 +02:00
Adam Joseph
7306386eb3 glibcInfo: use makeFlags instead of buildPhase
This commit causes glibc/info.nix to use the standard builder's
`buildPhase` so things like `preBuild`, `postBuild`,
`enableParallelBuilding`, etc work correctly.
2023-06-15 20:14:29 -07:00
Adam Joseph
238b793373 glibc: allow users of glibc/common.nix to override makeFlags
This commit allows to include `makeFlags` in a glibc derivation
without clobbering the flags from `common.nix`
2023-06-15 20:14:29 -07:00
Adam Joseph
b243596eb7 glibcLocales: use more than one core to build
This commit massively reduces the build latency for glibcLocales by
allowing it to build in parallel.  This requires passing
`-j$NIX_BUILD_CORES` via the glibc-specific make variable
`PARALLELMFLAGS`.

This commit also fixes a preexisting bug where the glibcLocales
package would ignore `preBuild` and `postBuild`.
2023-06-15 19:36:23 -07:00
Adam Joseph
cc22c861e8 glibc: allow users of glibc/common.nix to override makeFlags
This commit allows to include `makeFlags` in a glibc derivation
without clobbering the flags from `common.nix`
2023-06-15 19:36:18 -07:00
Linus Heckemann
4d649f2b63 glibc: split getent into its own output
Many dependents only require getent and not all the locale generation
tools that are included in the `bin` output. This can save some
closure size!
2023-06-12 10:26:52 +02:00
Adam Joseph
0e9ef0a07d cc-wrapper: when merging gcc32 and gcc64, merge libgcc as well
Our gcc_multi and glibc_multi expressions merge together a
32-bit-targeted and 64-bit-targeted gcc.  However they do not thread
through the passthru.libgcc from these merged gccs.

This commit corrects that.

It also extends passthru.libgcc to allow a *list* rather than just a
single outpath.

Resolves part of #221891 (at least getting it back to the error
message it gave before).
2023-05-09 00:16:24 -07:00
Adam Joseph
c5a4cc8396 glibc: suppress warning about IEEE-standard long double 2023-04-05 15:54:26 -07:00
Vladimír Čunát
4eaca2b138
Merge #188492: glibc: 2.35-224 -> 2.37-8
...into staging
2023-04-03 20:29:07 +02:00
Adam Joseph
7553d0fe29 stdenv: Nix-driven bootstrap of gcc
#### Summary

By default, when you type `make`, GCC will compile itself three
times.  This PR inhibits that behavior by configuring GCC with
`--disable-bootstrap`, and reimplements the triple-rebuild using
Nix rather than `make`/`sh`.

 #### Immediate Benefits

- Allow `gcc11` and `gcc12` on `aarch64` (without needing new
  `bootstrapFiles`)
- Faster stdenv rebuilds: the third compilation of gcc
  (i.e. stageCompare) is no longer a `drvInput` of the final stdenv.
  This allows Nix to build stageCompare in parallel with the rest of
  nixpkgs instead of in series.
- No more copying `libgcc_s` out of the bootstrap-files or other
  derivations
- No more Frankenstein compiler: the final gcc and the libraries it
  links against (mpfr, mpc, isl, glibc) are all built by the same
  compiler (xgcc) instead of a mixture of the bootstrapFiles'
  compiler and xgcc.
- No more [static lib{mpfr,mpc,gmp,isl}.a hack]
- Many other small `stdenv` hacks eliminated
- `gcc` and `clang` share the same codepath for more of `cc-wrapper`.

 #### Future Benefits

- This should allow using a [foreign] `bootstrap-files` so long as
  `hostPlatform.canExecute bootstrapFiles`.
- This should allow each of the libraries that ship with `gcc`
  (lib{backtrace, atomic, cc1, decnumber, ffi, gomp, iberty,
  offloadatomic, quadmath, sanitizer, ssp, stdc++-v3, vtv}) to be
  built in separate (one-liner) derivations which `inherit src;`
  from `gcc`, much like https://github.com/NixOS/nixpkgs/pull/132343

 #### Incorporates

- https://github.com/NixOS/nixpkgs/pull/210004
- https://github.com/NixOS/nixpkgs/pull/36948 (unreverted)
- https://github.com/NixOS/nixpkgs/pull/210325
- https://github.com/NixOS/nixpkgs/pull/210118
- https://github.com/NixOS/nixpkgs/pull/210132
- https://github.com/NixOS/nixpkgs/pull/210109
- https://github.com/NixOS/nixpkgs/pull/213909
- https://github.com/NixOS/nixpkgs/pull/216136
- https://github.com/NixOS/nixpkgs/pull/216237
- https://github.com/NixOS/nixpkgs/pull/210019
- https://github.com/NixOS/nixpkgs/pull/216232
- https://github.com/NixOS/nixpkgs/pull/216016
- https://github.com/NixOS/nixpkgs/pull/217977
- https://github.com/NixOS/nixpkgs/pull/217995

 #### Closes

- Closes #108305
- Closes #108111
- Closes #201254
- Closes #208412

 #### Credits

This project was made possible by three important insights, none of
which were mine:

1. @ericson2314 was the first to advocate for this change, and
   probably the first to appreciate its advantages.  Nix-driven
   (external) bootstrap is "cross by default".

2. @trofi has figured out a lot about how to get gcc to not mix up
   the copy of `libstdc++` that it depends on with the copy that it
   builds, by moving the `bootstrapFiles`' `libstdc++` into a
   [versioned directory].  This allows a Nix-driven bootstrap of gcc
   without the final gcc would still having references to the
   `bootstrapFiles`.

3. Using the undocumented variable [`user-defined-trusted-dirs`]
   when building glibc.  When glibc `dlopen()`s `libgcc_s.so`, it
   uses a completely different and totally special set of rules for
   finding `libgcc_s.so`.  This trick is the only way we can put
   `libgcc_s.so` in its own separate outpath without creating
   circular dependencies or dependencies on the bootstrapFiles.  I
   would never have guessed to use this (or that it existed!) if it
   were not for a [comment in guix] which @Mic92 [mentioned].

My own role in this PR was basically: being available to go on a
coding binge at an opportune moment, so we wouldn't waste a
[crisis].

[aarch64-compare-ofborg]: https://github.com/NixOS/nixpkgs/pull/209870/checks?check_run_id=10662822938
[amd64-compare-ofborg]: https://github.com/NixOS/nixpkgs/pull/209870/checks?check_run_id=10662825857
[nonexistent sysroot]: https://github.com/NixOS/nixpkgs/pull/210004
[versioned directory]: https://github.com/NixOS/nixpkgs/pull/209054
[`user-defined-trusted-dirs`]: https://sourceware.org/legacy-ml/libc-help/2013-11/msg00026.html
[comment in guix]: 5e4ec82181/gnu/packages/gcc.scm (L253)
[mentioned]: https://github.com/NixOS/nixpkgs/pull/210112#issuecomment-1379608483
[crisis]: https://github.com/NixOS/nixpkgs/issues/108305
[foreign]: https://github.com/NixOS/nixpkgs/pull/170857#issuecomment-1170558348
[static lib{mpfr,mpc,gmp,isl}.a hack]: 2f1948af9c/pkgs/stdenv/linux/default.nix (L380)
2023-04-02 13:49:41 -07:00
Maximilian Bosch
047f379d38
glibc: use patch from ArchLinux to re-enable DT_HASH 2023-03-29 09:50:29 +02:00
Maximilian Bosch
b42ee8b817
glibc: 2.35-224 -> 2.37-8
Announcement: https://sourceware.org/pipermail/libc-alpha/2022-August/141193.html
Announcement: https://sourceware.org/pipermail/libc-alpha/2023-February/145190.html
2023-03-29 09:50:24 +02:00
Artturin
6b2a05e190 treewide: manual fixups for
treewide: use toString on list NIX_CFLAGS_COMPILE
treewide: move NIX_CFLAGS_COMPILE to the env attrset
2023-02-22 21:23:04 +02:00
Artturin
f9fdf2d402 treewide: move NIX_CFLAGS_COMPILE to the env attrset
with structuredAttrs lists will be bash arrays which cannot be exported
which will be a issue with some patches and some wrappers like cc-wrapper

this makes it clearer that NIX_CFLAGS_COMPILE must be a string as lists
in env cause a eval failure
2023-02-22 21:23:04 +02:00
Felix Buehler
cdb39a86e0 treewide: use optionalString 2023-02-13 21:52:34 +01:00
Sergei Trofimovich
6728277e19 libc: wipe out all references from copied libgcc_s.so.1
Without the change a copy from freshly built `gcc` still retains a
reference even after `patchelf --remove-rpath` because `patchelf` does
not cleanup dynamic sprintgs section.

The change stubs the reference out and fixes build on bootstraps where
`gcc` is built before `glibc`.
2023-01-14 18:23:56 +00:00
Sergei Trofimovich
76f5618e1e glibc: copy libgcc_s.so from .lib output if it exists
Otherwise copy it from the default output. The difference is visible
when we build `glibc` with:

- `bootstrapTools` `gcc`: ${stdenv.cc.cc.out}/lib/libgcc_s.so.1 is used
- `nixpkgs` `gcc`: ${stdenv.cc.cc.lib}/lib/libgcc_s.so.1 is used

Noticed when experimented with multiple `gcc` rebuilds in bootstrap.

While at it killing `RUNPATH` reference to bootstrap `glibc`.
2023-01-14 11:58:31 +00:00
github-actions[bot]
4712ed9439
Merge master into staging-next 2023-01-14 00:02:26 +00:00
Adam Joseph
97c335216d glibc: allow overriding common.nix 2023-01-13 19:16:30 +02:00
Vladimír Čunát
4835c7a74c
glibc, python3Packages.twisted: resolve temporary workaround
It certainly seems better to patch the twisted test than glibc.
2023-01-04 20:28:54 +01:00
Robert Hensing
16f5747575
Merge pull request #175649 from Artturin/opt-in-structured-attrs
stdenv: support opt-in __structuredAttrs
2022-12-10 21:12:43 +01:00
Artturin
c01f509e44 treewide: source .attrs in builders
if theres a source $stdenv then this is needed

for structuredAttrs
2022-12-08 21:09:02 +02:00
Artturin
adc8900df1 treewide: fix some core package structuredAttrs 2022-12-08 21:05:28 +02:00
Vladimír Čunát
5dffcba8fe
glibc: revert one patch from those added in parent commit
For now.  It causes issues in python3Packages.twisted testsuite,
so maybe it's buggy.  The tests might be buggy instead, but so far
we've had no report of the issues that are to be fixed by the patch.
https://github.com/NixOS/nixpkgs/pull/201805#issuecomment-1342735635
2022-12-08 14:34:53 +01:00
Vladimír Čunát
ec7567ba19
glibc: 2.35-163 -> 2.35-224 2022-12-06 15:51:01 +01:00
Dmitry Kalinkin
68e63f0ee3
Merge pull request #202827 from vcunat/p/glibc-kernel-versions
glibc: bump the minimum kernel version
2022-12-03 18:30:33 -05:00
Vladimír Čunát
68b44c86c2
glibc: bump the minimum kernel version
I don't think anyone sane is really using kernel < 3.10 nowadays.
(At least in a use case with glibc from nixpkgs.)

As another suspect with old kernels, Ubuntu seems to start at 3.13 now.
2022-11-25 11:38:48 +01:00
Sergei Trofimovich
ca95ee0977 glibc: backport make-4.4 fix
Not updating the whole snapshot as unrelated patches break some of
timezone-related tests:
    https://github.com/NixOS/nixpkgs/pull/201805#issuecomment-1320917345

Let's unblock `make-4.4` first.
2022-11-19 16:49:53 +00:00