-fcf-protection insert non i586 instructions that crash on amd k6 and geode
to build a working glibc also the toolchain compiler must build without this
so this need a new toolchain.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Instrument binaries to guard against ROP/JOP attacks.
This flag in only available on x86_64 and i586.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This patch turns on instrumentation to avoid skipping the guard page
in large stack frames.
Without this flag, vulnerabilities can result in where the stack
overlaps with the heap, or thread stacks spill into other regions
of memory.
This flag in only available on x86_64 and aarch64.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
I cannot find any evidence that this is helpful and no other
distribution has this as default. Packages that are vulnerable to these
attacks (i.e. the kernel) add these flags as appropriate automatically.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
The message "ls: cannot access '*.bz2': No such file or directory" comes
from the 'ls' command prior to creating the *.md5-files for *.bz2, *.img.xz
and *.iso files.
But on most builds we have especially no more bzip2 compressed images anymore.
This message can usually be ignored and is just irritating.
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
We have loads of packages linked against the older
version which is difficult to update.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Since Go has a horrible build system which requires a Go
compiler to build the Go compiler and takes a very long
time to compile, we are following Rust and are using the
"official" pre-compiled release tarball.
We no longer ship the Go runtime, which mitigates the
risk of shipping any malware.
Because we currently only have one package using this
and which is only being compiled for x86_64, we are
only making Go available on this architecture.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
The build system is writing a large amount of temporary file
systems that might land on disk or at least in the journal.
This change will speed up the build and remove a lot of I/O
usage.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
The cgi support only rfcomm modem dialup. This is not used by modern hardware.
Also the used bluez stack version is outdated long time.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This patch links kmod against OpenSSL which is required to
decode the kernel modules' PKCS#7 signatures.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This package is outdated and unmaintained for many many years.
I am not sure if this even works and if there are any users.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
this is useless because the new nightly also copies the core updaters
to the unstable and testing pakfire trees.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This probably has only been used by me and we do not need
it any more.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This package was used internally and we have no script that uses it
any more.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
