<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<font size="4">Hi </font>kpcyrd
<font size="4">,<br>
</font><br>
<font size="4">
<blockquote type="cite">Arch Linux is generally very invested in
binary hardening</blockquote>
Interesting! Also loving the topic. </font><font size="4">Is there
a reference list of </font><font size="4">binary hardening
techniques used at scale in Arch?<br>
<br>
Best,<br>
<br>
--Martin Monperrus<br>
<br>
</font><br>
<div class="moz-cite-prefix">On 2/4/26 20:38, kpcyrd wrote:<br>
</div>
<blockquote type="cite"
cite="mid:d525a150-11f4-4fb5-ad55-ab75a52bbb99@archlinux.org">Hello!
<br>
<br>
I remember during the summit LTO was mentioned as a possible cause
of Reproducible Builds issues, which raised some questions.
<br>
<br>
Foxboron has shared some details on the archlinux-dev-public list
about this, that I want to share here too:
<br>
<br>
> The reason why `lto` needs to be disabled is because there is
a `gcc` bug in the
<br>
> LTO streamer backend where bare `#line` macros get prepended
a temporary
<br>
> directory which does not get stripped by the `prefix-strip`
flag. I tried to
<br>
> propose a patch to the go compiler, and to gcc, but all of
this has stalled.
<br>
>
<br>
>
<a class="moz-txt-link-freetext" href="https://gcc.gnu.org/pipermail/gcc-patches/2024-March/647303.html">https://gcc.gnu.org/pipermail/gcc-patches/2024-March/647303.html</a>
<br>
> <a class="moz-txt-link-freetext" href="https://github.com/golang/go/pull/53528">https://github.com/golang/go/pull/53528</a>
<br>
>
<br>
> I've spent several weekends working through all the this and
I'm generally
<br>
> unhappy about the state of things.
<br>
<br>
<a class="moz-txt-link-freetext" href="https://lists.archlinux.org/archives/list/arch-dev-public@lists.archlinux.org/message/BSAAFYOJ3KTYZXACIQ26RP5II4JULLS4/">https://lists.archlinux.org/archives/list/arch-dev-public@lists.archlinux.org/message/BSAAFYOJ3KTYZXACIQ26RP5II4JULLS4/</a>
<br>
<br>
Arch Linux is generally very invested in binary hardening, which
is the reason why cgo is used for most packages.
<br>
<br>
cheers,
<br>
kpcyrd
<br>
</blockquote>
<br>
</body>
</html>