webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
2a8de00c6fbc7625d385ebd04ad466ee8a024a12
bpfire/lfs/gcc
Peter Müller 9a7e4d8506 Switch checksums from MD5 to BLAKE2 
Historically, the MD5 checksums in our LFS files serve as a protection
against broken downloads, or accidentally corrupted source files.

While the sources are nowadays downloaded via HTTPS, it make sense to
beef up integrity protection for them, since transparently intercepting
TLS is believed to be feasible for more powerful actors, and the state
of the public PKI ecosystem is clearly not helping.

Therefore, this patch switches from MD5 to BLAKE2, updating all LFS
files as well as make.sh to deal with this checksum algorithm. BLAKE2 is
notably faster (and more secure) than SHA2, so the performance penalty
introduced by this patch is negligible, if noticeable at all.

In preparation of this patch, the toolchain files currently used have
been supplied with BLAKE2 checksums as well on
https://source.ipfire.org/.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremeripfire.org>
2022-04-02 14:19:25 +00:00

319 lines
9.8 KiB
Plaintext
Raw Blame History

###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2022 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation, either version 3 of the License, or #
# (at your option) any later version. #
# #
# This program is distributed in the hope that it will be useful, #
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
# GNU General Public License for more details. #
# #
# You should have received a copy of the GNU General Public License #
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
# #
###############################################################################
###############################################################################
# Definitions
###############################################################################
include Config
VER = 11.1.0
GMP_VER = 6.2.1
MPFR_VER = 4.1.0
MPC_VER = 1.2.1
THISAPP = gcc-$(VER)
DL_FILE = $(THISAPP).tar.xz
DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
ifeq "$(PASS)" "1"
CFLAGS := $(patsubst -march=%,,$(CFLAGS))
CFLAGS := $(patsubst -mfpu=%,,$(CFLAGS))
CFLAGS := $(patsubst -mtune=%,,$(CFLAGS))
CFLAGS := $(patsubst -mfloat-abi=%,,$(CFLAGS))
CFLAGS := $(filter-out -fexceptions,$(CFLAGS))
CFLAGS := $(patsubst -mindirect-branch=%,,$(CFLAGS))
CFLAGS := $(patsubst -mfunction-return=%,,$(CFLAGS))
CFLAGS := $(patsubst -fstack-clash-protection,,$(CFLAGS))
CFLAGS := $(patsubst -fcf-protection,,$(CFLAGS))
endif
CXXFLAGS := $(CFLAGS)
ifeq "$(BUILD_ARCH)" "armv7hl"
FULL_BOOTSTRAP = 1
endif
ifeq "$(BUILD_ARCH)" "armv6l"
FULL_BOOTSTRAP = 1
endif
# Normal build or $(TOOLS_DIR) build.
#
ifeq "$(ROOT)" ""
TARGET = $(DIR_INFO)/$(THISAPP)
EXTRA_CONFIG = \
--prefix=/usr \
--libexecdir=/usr/lib \
--enable-shared \
--enable-threads=posix \
--enable-__cxa_atexit \
--enable-clocale=gnu \
--enable-languages=c,c++ \
--disable-bootstrap \
--disable-nls
EXTRA_MAKE =
EXTRA_INSTALL =
else
ifeq "$(PASS)" "1"
TARGET = $(DIR_INFO)/$(THISAPP)-tools1
EXTRA_CONFIG = \
--target=$(CROSSTARGET) \
--prefix=$(TOOLS_DIR) \
--with-sysroot=$(ROOT) \
--with-local-prefix=$(TOOLS_DIR) \
--with-native-system-header-dir=$(TOOLS_DIR)/include \
--with-glibc-version=2.11 \
--disable-nls \
--disable-shared \
--disable-multilib \
--disable-decimal-float \
--disable-threads \
--disable-libatomic \
--disable-libmudflap \
--disable-libssp \
--disable-libmpx \
--disable-libgomp \
--disable-libquadmath \
--disable-libstdc++-v3 \
--disable-libvtv \
--disable-libcilkrts \
--disable-libitm \
--disable-libsanitizer \
--with-newlib \
--without-headers \
--without-ppl \
--without-cloog \
--enable-languages=c,c++
EXTRA_MAKE =
EXTRA_INSTALL =
else
ifeq "$(PASS)" "2"
TARGET = $(DIR_INFO)/$(THISAPP)-tools2
EXTRA_ENV = \
CC="$(CROSSTARGET)-gcc" \
CXX="$(CROSSTARGET)-g++" \
AR="$(CROSSTARGET)-ar" \
RANLIB="$(CROSSTARGET)-ranlib"
EXTRA_CONFIG = \
--build=$(BUILDTARGET) \
--host=$(BUILDTARGET) \
--prefix=$(TOOLS_DIR) \
--with-local-prefix=$(TOOLS_DIR) \
--with-native-system-header-dir=$(TOOLS_DIR)/include \
--enable-languages=c,c++ \
--disable-libstdcxx-pch \
--disable-multilib \
--disable-libgomp
EXTRA_MAKE =
EXTRA_INSTALL =
ifeq "$(FULL_BOOTSTRAP)" "1"
EXTRA_CONFIG += --enable-bootstrap
else
EXTRA_CONFIG += --disable-bootstrap
endif
else
# PASS=L # libstdc++-v3
TARGET = $(DIR_INFO)/$(THISAPP)-libstdc++
EXTRA_ENV = \
CC="$(CROSSTARGET)-gcc" \
AR="$(CROSSTARGET)-ar" \
RANLIB="$(CROSSTARGET)-ranlib"
EXTRA_CONFIG = \
--host=$(CROSSTARGET) \
--prefix=$(TOOLS_DIR) \
--with-sysroot=$(ROOT) \
--disable-shared \
--disable-nls \
--disable-libstdcxx-threads \
--disable-libstdcxx-pch \
--with-gxx-include-dir=$(TOOLS_DIR)/$(CROSSTARGET)/include/c++/$(VER)
EXTRA_MAKE =
EXTRA_INSTALL =
endif
endif
endif
ifeq "$(BUILD_ARCH)" "aarch64"
EXTRA_CONFIG += \
--enable-standard-branch-protection
endif
ifeq "$(BUILD_ARCH)" "armv7hl"
EXTRA_CONFIG += \
--with-float=hard
endif
ifeq "$(BUILD_ARCH)" "armv6l"
EXTRA_CONFIG += \
--with-arch=armv6zk+fp \
--with-float=softfp
# --disable-sjlj-exceptions
endif
ifeq "$(BUILD_ARCH)" "riscv64"
EXTRA_CONFIG += \
--with-arch=rv64gc \
--with-abi=lp64d
endif
EXTRA_CONFIG += \
--disable-multilib \
--with-bugurl=https://bugzilla.ipfire.org \
--disable-libunwind-exceptions \
--enable-gnu-unique-object
export XCFLAGS = $(CFLAGS)
export TCFLAGS = $(CFLAGS)
###############################################################################
# Top-level Rules
###############################################################################
objects = $(DL_FILE) \
gmp-$(GMP_VER).tar.xz \
mpfr-$(MPFR_VER).tar.xz \
mpc-$(MPC_VER).tar.gz
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
gmp-$(GMP_VER).tar.xz = $(DL_FROM)/gmp-$(GMP_VER).tar.xz
mpfr-$(MPFR_VER).tar.xz = $(DL_FROM)/mpfr-$(MPFR_VER).tar.xz
mpc-$(MPC_VER).tar.gz = $(DL_FROM)/mpc-$(MPC_VER).tar.gz
$(DL_FILE)_BLAKE2 = fe617e776b0270d11adea21b5c37d889de90865c19ab82d1c37bbd5c5b9c583a98c174606c4f893ca4950a4233e2a58aae93ad6aa7ad33d4e78a31c72371c1ed
gmp-$(GMP_VER).tar.xz_BLAKE2 = c0d85f175392a50cfa01bc6b0a312b235946ad8b4f6f84f6dabd33d7a6f2cc75c9b0e1e33057be07750bfa0145b7c4cf3b6188a5be6ca9d7271ec2276c84ebcb
mpfr-$(MPFR_VER).tar.xz_BLAKE2 = 41d1be0c4b557760f12a4525ad3a84b6e2cd6f0927c935fcfba577ac0490e582d1ae4b581dce58e21e705cf9d7c88373054d7fb7a94bb32c69b339f99a25dc68
mpc-$(MPC_VER).tar.gz_BLAKE2 = 9cd03c6a71839e4cdb3c1f18d718cc4d3097c3f8ec307a5c756bd5df27c68aa013755156b3b156efee1acabfee2269602c6a3a358092ef0d522271c9c56c133d
install : $(TARGET)
check : $(patsubst %,$(DIR_CHK)/%,$(objects))
download :$(patsubst %,$(DIR_DL)/%,$(objects))
b2 : $(subst %,%_BLAKE2,$(objects))
###############################################################################
# Downloading, checking, b2sum
###############################################################################
$(patsubst %,$(DIR_CHK)/%,$(objects)) :
@$(CHECK)
$(patsubst %,$(DIR_DL)/%,$(objects)) :
@$(LOAD)
$(subst %,%_BLAKE2,$(objects)) :
@$(B2SUM)
###############################################################################
# Installation Details
###############################################################################
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) $(DIR_SRC)/gcc-build && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/gcc/gcc.git-745dae5-remove_cyclades.patch
@mkdir $(DIR_SRC)/gcc-build
cd $(DIR_APP) && sed -i 's/install_to_$$(INSTALL_DEST) //' libiberty/Makefile.in
cd $(DIR_APP) && sed -i gcc/Makefile.in \
-e 's@\./fixinc\.sh@-c true@' \
-e 's/^T_CFLAGS =$$/& -fomit-frame-pointer/'
ifeq "$(TOOLCHAIN)" "1"
# Build gmp and mpfr internally in toolchain.
cd $(DIR_APP) && tar xfa $(DIR_DL)/gmp-$(GMP_VER).tar.xz
cd $(DIR_APP) && mv -v gmp-$(GMP_VER) gmp
cd $(DIR_APP) && tar xfa $(DIR_DL)/mpfr-$(MPFR_VER).tar.xz
cd $(DIR_APP) && mv -v mpfr-$(MPFR_VER) mpfr
cd $(DIR_APP) && tar xfa $(DIR_DL)/mpc-$(MPC_VER).tar.gz
cd $(DIR_APP) && mv -v mpc-$(MPC_VER) mpc
ifeq "$(PASS)" "2"
cd $(DIR_APP) && cat gcc/limitx.h gcc/glimits.h gcc/limity.h > \
`dirname $$($(TOOLS_DIR)/bin/$(CROSSTARGET)-gcc -print-libgcc-file-name)`/include-fixed/limits.h
endif
for file in $$(find $(DIR_APP)/gcc/config -name linux64.h -o -name linux.h \
-o -name sysv4.h -o -name linux-eabi.h -o -name linux-elf.h -o -name aarch64-linux.h); do \
echo "Processing $${file}..."; \
sed -i $${file} \
-e 's@/lib\(64\)\?\(32\)\?/ld@$(TOOLS_DIR)&@g' \
-e 's@/usr@$(TOOLS_DIR)@g'; \
echo '#undef STANDARD_STARTFILE_PREFIX_1' >> $${file}; \
echo '#undef STANDARD_STARTFILE_PREFIX_2' >> $${file}; \
echo '#define STANDARD_STARTFILE_PREFIX_1 "$(TOOLS_DIR)/lib/"' >> $${file}; \
echo '#define STANDARD_STARTFILE_PREFIX_2 ""' >> $${file}; \
done
endif
ifeq "$(PASS)" "L"
# libstdc++ pass
cd $(DIR_SRC)/gcc-build && \
$(EXTRA_ENV) \
$(DIR_APP)/libstdc++-v3/configure \
$(EXTRA_CONFIG)
cd $(DIR_SRC)/gcc-build && make $(EXTRA_MAKE)
cd $(DIR_SRC)/gcc-build && make $(EXTRA_INSTALL) install
else
# The actual build.
cd $(DIR_SRC)/gcc-build && \
$(EXTRA_ENV) \
$(DIR_APP)/configure \
$(EXTRA_CONFIG)
cd $(DIR_SRC)/gcc-build && make $(EXTRA_MAKE) $(MAKETUNING)
cd $(DIR_SRC)/gcc-build && make $(EXTRA_INSTALL) install
endif
ifeq "$(TOOLCHAIN)" "1"
ifeq "$(PASS)" "1"
ln -svf libgcc.a $$($(TOOLS_DIR)/bin/$(CROSSTARGET)-gcc -print-libgcc-file-name | sed 's/libgcc/&_eh/')
endif
ifeq "$(PASS)" "2"
ln -svf gcc $(TOOLS_DIR)/bin/cc
# remove gdb python files from libdir
rm -rf $(TOOLS_DIR)/lib/*-gdb.py
endif
ifeq "$(PASS)" "L"
# Workaround for https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70936
sed -e "s/^#include_next/#include/" -i $(TOOLS_DIR)/$(CROSSTARGET)/include/c++/$(VER)/cstdlib
endif
else # NON-TOOLCHAIN
ln -svf ../usr/bin/cpp /lib
ln -svf gcc /usr/bin/cc
# remove gdb python files from libdir
rm -rf /usr/lib/*-gdb.py
endif
@rm -rf $(DIR_APP) $(DIR_SRC)/gcc-build
@$(POSTBUILD)
Reference in New Issue View Git Blame Copy Permalink