On Mon, Sep 01, 2025 at 01:07:28AM +0200, [email protected] wrote:
During a test rebuild for CMake 4, yubihsm-shell failed to rebuild.
[...]
/usr/bin/ld:
/usr/lib/gcc/aarch64-linux-gnu/14/../../../aarch64-linux-gnu/Scrt1.o: in
function `_start':
(.text+0x1c): undefined reference to `main'
/usr/bin/ld: (.text+0x20): undefined reference to `main'
collect2: error: ld returned 1 exit status
/usr/bin/cc -fPIC -g -O2 -Werror=implicit-function-declaration
-ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=.
-fstack-protector-strong -fstack-clash-protection -Wformat
-Werror=format-security -mbranch-protection=standard -Wdate-time
-D_FORTIFY_SOURCE=2 -I/usr/include/PCSC -flto -Wno-missing-braces
-Wno-missing-field-initializers
-Wl,--dependency-file=CMakeFiles/yubihsm.dir/link.d -shared -Wl,-z,relro
-fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now
-Wl,-soname,libyubihsm.so.2 -o libyubihsm.so.2.7.0
CMakeFiles/yubihsm.dir/__/aes_cmac/aes.c.o
CMakeFiles/yubihsm.dir/__/aes_cmac/aes_cmac.c.o
CMakeFiles/yubihsm.dir/__/common/hash.c.o
CMakeFiles/yubihsm.dir/__/common/pkcs5.c.o
CMakeFiles/yubihsm.dir/__/common/rand.c.o
CMakeFiles/yubihsm.dir/__/common/ecdh.c.o CMakeFiles/yubihsm.dir/error.c.o
CMakeFiles/yubihsm.dir/lib_util.c.o CMakeFiles/yubihsm.dir/yubihsm.c.o
CMakeFiles/yubihsm.dir/data_compress.c.o -L/usr/lib/aarch64-linux-gnu -lcrypto
-ldl /usr/lib/aarch64-linux-gnu/libz.so
The important bit of the build log diff seems to be:
-/usr/bin/cc -fPIC -g -O2 -Werror=implicit-function-declaration
-ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=.
-fstack-protector-strong -fstack-clash-protection -Wformat
-Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2
-I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers
-Wl,--dependency-file=CMakeFiles/yubihsm.dir/link.d -Wl,-z,relro
-fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now -shared
-Wl,-soname,libyubihsm.so.2 -o libyubihsm.so.2.7.0
CMakeFiles/yubihsm.dir/__/aes_cmac/aes.c.o
CMakeFiles/yubihsm.dir/__/aes_cmac/aes_cmac.c.o
CMakeFiles/yubihsm.dir/__/common/hash.c.o
CMakeFiles/yubihsm.dir/__/common/pkcs5.c.o
CMakeFiles/yubihsm.dir/__/common/rand.c.o
CMakeFiles/yubihsm.dir/__/common/ecdh.c.o CMakeFiles/yubihsm.dir/error.c.o
CMakeFiles/yubihsm.dir/lib_util.c.o CMakeFiles/yubihsm.dir/yubihsm.c.o
CMakeFiles/yubihsm.dir/data_compress.c.o -L/usr/lib/x86_64-linux-gnu -lcrypto
-ldl /usr/lib/x86_64-linux-gnu/libz.so
+/usr/bin/cc -fPIC -g -O2 -Werror=implicit-function-declaration
-ffile-prefix-map=/build/reproducible-path/yubihsm-shell-2.7.0=.
-fstack-protector-strong -fstack-clash-protection -Wformat
-Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2
-I/usr/include/PCSC -flto -Wno-missing-braces -Wno-missing-field-initializers
-Wl,--dependency-file=CMakeFiles/yubihsm.dir/link.d -shared -Wl,-z,relro
-fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now
-Wl,-soname,libyubihsm.so.2 -o libyubihsm.so.2.7.0
CMakeFiles/yubihsm.dir/__/aes_cmac/aes.c.o
CMakeFiles/yubihsm.dir/__/aes_cmac/aes_cmac.c.o
CMakeFiles/yubihsm.dir/__/common/hash.c.o
CMakeFiles/yubihsm.dir/__/common/pkcs5.c.o
CMakeFiles/yubihsm.dir/__/common/rand.c.o
CMakeFiles/yubihsm.dir/__/common/ecdh.c.o CMakeFiles/yubihsm.dir/error.c.o
CMakeFiles/yubihsm.dir/lib_util.c.o CMakeFiles/yubihsm.dir/yubihsm.c.o
CMakeFiles/yubihsm.dir/data_compress.c.o -L/usr/lib/x86_64-linux-gnu -lcrypto
-ldl /usr/lib/x86_64-linux-gnu/libz.so
... i.e. the "-shared" option has been moved before "-Wl,-z,relro
-fstack-protector-all -pie -Wl,-z,noexecstack -Wl,-z,relro,-z,now".
This appears to be enough to break the shared library link, but I can't
figure out where it was changed. -DCMAKE_POLICY_VERSION_MINIMUM=3.31
seems to make no difference. Do you have any pointers?
Thanks,
--
Colin Watson (he/him) [[email protected]]
