Build using rpmbuild broken since 1.60.0

[dclaisse]

Problem:

Since version 1.60.0, building with rpmbuild is failing. It turns out that it is due to incompatible build options, as optimizations are explicitely turned off for the CPU jitter RNG build, while standard CFLAGS from rpmbuild enable _FORTIFY_SOURCE which needs optimizations to be enabled, and Werror so warnings are treated as errors.

Relevant details

AWS-LC commit: fc02874
Incompatible -O0 option comes from here https://github.com/aws/aws-lc/blame/f4f0be9fc1a894121c56a2a3b06b043f15465249/third_party/jitterentropy/CMakeLists.txt#L27

A trivial fix is to add -Wp,-U_FORTIFY_SOURCE on that line which fixes the build, but not sure it is the best way to fix this.

System information:

• CPU architecture: x86-64
• CPU name: Not relevant here
• OS: CentOS

Build log:

[...]
CFLAGS='-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection'
[...]
cd /builddir/build/BUILD/aws-lc-1.61.4/third_party/jitterentropy && /opt/rh/gcc-toolset-14/root/usr/bin/cc -DBORINGSSL_RELEASE_BUILD -I/builddir/build/BUILD/aws-lc-1.61.4/symbol_prefix_include -I/builddir/build/BUILD/aws-lc-1.61.4/include -I/builddir/build/BUILD/aws-lc-1.61.4/third_party/jitterentropy/jitterentropy-library -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -Wredundant-decls -Wextra -Wunused -Wcomment -Wchar-subscripts -Wuninitialized -Wshadow -Wwrite-strings -Wformat-security -Wunused-result -Wno-overlength-strings -Wno-cast-function-type  -Wall -fvisibility=hidden -fno-common -Wno-c11-extensions -Wvla -Wtype-limits -Wno-unused-parameter -Werror -Wformat=2 -Wsign-compare -Wmissing-field-initializers -Wwrite-strings -Wno-free-nonheap-object -Wmissing-braces -Wimplicit-fallthrough -Wformat-signedness -Wmissing-prototypes -Wold-style-definition -Wstrict-prototypes -DHAVE_LINUX_RANDOM_H -DAWS_LC_STDALIGN_AVAILABLE -DAWS_LC_BUILTIN_SWAP_SUPPORTED -D_XOPEN_SOURCE=700 -DNDEBUG -std=gnu11 -fPIC -DAWSLC -fwrapv --param ssp-buffer-size=4 -fvisibility=hidden -Wcast-align -Wmissing-field-initializers -Wshadow -Wswitch-enum -Wextra -Wall -pedantic -O0 -fwrapv -Wconversion  -MD -MT third_party/jitterentropy/CMakeFiles/jitterentropy.dir/jitterentropy-library/src/jitterentropy-base.c.o -MF CMakeFiles/jitterentropy.dir/jitterentropy-library/src/jitterentropy-base.c.o.d -o CMakeFiles/jitterentropy.dir/jitterentropy-library/src/jitterentropy-base.c.o -c /builddir/build/BUILD/aws-lc-1.61.4/third_party/jitterentropy/jitterentropy-library/src/jitterentropy-base.c
[...]
In file included from /usr/include/sys/types.h:25,
                 from /builddir/build/BUILD/aws-lc-1.61.4/third_party/jitterentropy/jitterentropy-library/jitterentropy-base-user.h:52,
                 from /builddir/build/BUILD/aws-lc-1.61.4/third_party/jitterentropy/jitterentropy-library/jitterentropy.h:168,
                 from /builddir/build/BUILD/aws-lc-1.61.4/third_party/jitterentropy/jitterentropy-library/src/jitterentropy-internal.h:45,
                 from /builddir/build/BUILD/aws-lc-1.61.4/third_party/jitterentropy/jitterentropy-library/src/jitterentropy-gcd.h:23,
                 from /builddir/build/BUILD/aws-lc-1.61.4/third_party/jitterentropy/jitterentropy-library/src/jitterentropy-base.c:33:
/usr/include/features.h:381:4: error: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Werror=cpp]
  381 | #  warning _FORTIFY_SOURCE requires compiling with optimization (-O)
      |    ^~~~~~~

[skmcgrail]

I know -Wno-error=cpp also would silence this as well, which is what the ArchLinux AUR package had chosen to do. Regardless the -O0 disablement of optimizations is intentional to the jitterentropy design which was reintroduced with this release. So we can't remove that flag in this instance, maybe perhaps just unsetting FORTIFY_SOURCE per your suggestion always for this build of jitterentropy makes the most sense here?

[torben-hansen]

Adding -Wp,-U_FORTIFY_SOURCE might be the only scalable solution. At least, I can't come up with any other solution other than having all consumers with an offending _FORTIFY_SOURCE definition change their environment.

Any other suggestions?