ghc: Always disable PIE hardening

Always disable PIE for GHC in preperation to global PIE in nixpkgs.

Currently, only musl-based stdenv enables PIE and it is explicitly
disabled by ghc derivations.
This commit is contained in:
Hubert Jasudowicz 2025-01-05 14:27:31 +01:00
parent aec3457418
commit cb84cdad80
7 changed files with 32 additions and 46 deletions

View File

@ -471,14 +471,12 @@ stdenv.mkDerivation rec {
# They're in $out/share/{doc,man}.
'';
# In nixpkgs, musl based builds currently enable `pie` hardening by default
# (see `defaultHardeningFlags` in `make-derivation.nix`).
# But GHC cannot currently produce outputs that are ready for `-pie` linking.
# GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
hardeningDisable = lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "pie" ];
doInstallCheck = true;
installCheckPhase = ''

View File

@ -557,16 +557,15 @@ stdenv.mkDerivation (
checkTarget = "test";
hardeningDisable =
[ "format" ]
# In nixpkgs, musl based builds currently enable `pie` hardening by default
# (see `defaultHardeningFlags` in `make-derivation.nix`).
# But GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
++ lib.optional stdenv.targetPlatform.isMusl "pie";
# GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
hardeningDisable = [
"format"
"pie"
];
# big-parallel allows us to build with more than 2 cores on
# Hydra which already warrants a significant speedup

View File

@ -211,14 +211,12 @@ stdenv.mkDerivation rec {
done
'';
# In nixpkgs, musl based builds currently enable `pie` hardening by default
# (see `defaultHardeningFlags` in `make-derivation.nix`).
# But GHC cannot currently produce outputs that are ready for `-pie` linking.
# GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
hardeningDisable = lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "pie" ];
doInstallCheck = true;
installCheckPhase = ''

View File

@ -437,14 +437,12 @@ stdenv.mkDerivation rec {
"$out/bin/ghc-pkg" --package-db="$package_db" recache
'';
# In nixpkgs, musl based builds currently enable `pie` hardening by default
# (see `defaultHardeningFlags` in `make-derivation.nix`).
# But GHC cannot currently produce outputs that are ready for `-pie` linking.
# GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
hardeningDisable = lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "pie" ];
doInstallCheck = true;
installCheckPhase = ''

View File

@ -416,14 +416,12 @@ stdenv.mkDerivation rec {
"$out/bin/ghc-pkg" --package-db="$package_db" recache
'';
# In nixpkgs, musl based builds currently enable `pie` hardening by default
# (see `defaultHardeningFlags` in `make-derivation.nix`).
# But GHC cannot currently produce outputs that are ready for `-pie` linking.
# GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
hardeningDisable = lib.optional stdenv.targetPlatform.isMusl "pie";
hardeningDisable = [ "pie" ];
doInstallCheck = true;
installCheckPhase = ''

View File

@ -620,16 +620,12 @@ stdenv.mkDerivation ({
checkTarget = "test";
hardeningDisable =
[ "format" ]
# In nixpkgs, musl based builds currently enable `pie` hardening by default
# (see `defaultHardeningFlags` in `make-derivation.nix`).
# But GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
++ lib.optional stdenv.targetPlatform.isMusl "pie";
# GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
hardeningDisable = [ "format" "pie" ];
# big-parallel allows us to build with more than 2 cores on
# Hydra which already warrants a significant speedup

View File

@ -569,16 +569,15 @@ stdenv.mkDerivation (
checkTarget = "test";
hardeningDisable =
[ "format" ]
# In nixpkgs, musl based builds currently enable `pie` hardening by default
# (see `defaultHardeningFlags` in `make-derivation.nix`).
# But GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
++ lib.optional stdenv.targetPlatform.isMusl "pie";
# GHC cannot currently produce outputs that are ready for `-pie` linking.
# Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
# See:
# * https://github.com/NixOS/nixpkgs/issues/129247
# * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
hardeningDisable = [
"format"
"pie"
];
# big-parallel allows us to build with more than 2 cores on
# Hydra which already warrants a significant speedup