Hi, While investigating a build-path leakage issue, I noticed that -fplugin=<path> and -fplugin-arg-* options are currently recorded in DW_AT_producer when -grecord-gcc-switches is enabled.
As a result, an absolute plugin path may become embedded in debug metadata. For example: gcc -g -grecord-gcc-switches \ -fplugin=/path/to/plugin.so \ -c hello.c produces an object file whose DW_AT_producer contains: GNU C23 ... -g -fplugin=/path/to/plugin.so In my case, the recorded path was an absolute build-system path to a GCC plugin: -fplugin=/local/.../scripts/gcc-plugins/stackleak_plugin.so This introduces host-specific path information into the generated artifact and may negatively affect reproducibility. I noticed that GCC already has the NoDWARFRecord mechanism for options that should not be recorded in the producer string. Looking through the history, it appears that this mechanism was introduced partly to address reproducibility concerns involving path-containing options, and there are also examples where specific options are intentionally excluded from producer-string recording. As an experiment, I modified: gcc/common.opt and marked: -fplugin= -fplugin-arg-* with NoDWARFRecord. With this change: Before: DW_AT_producer: GNU C23 ... -g \ -fplugin=/local/.../stackleak_plugin.so After: DW_AT_producer: GNU C23 ... -g The plugin is still loaded correctly, plugin arguments are still passed, and generated code/debug information remain unchanged. The only observed difference is that plugin-related command-line options are no longer recorded in DW_AT_producer. The tradeoff appears to be: Benefits: - Avoids recording host-specific absolute plugin paths. - Improves reproducibility of producer strings. - Reduces leakage of local build environment details. Downsides: - Reduces provenance information available from DW_AT_producer. - Makes it harder to determine from the binary alone which GCC plugin (and plugin arguments) were used during compilation. Before preparing a formal patch submission, I would like feedback on the policy aspect: Should -fplugin and -fplugin-arg-* be treated similarly to other path-sensitive options and be excluded from producer-string recording? or Is preserving plugin provenance in DW_AT_producer considered more valuable than avoiding path leakage and reproducibility issues? Comments and guidance would be appreciated. Thanks, Jaihind Yadav
