Hi,

While investigating a build-path leakage issue, I noticed that
-fplugin=<path> and -fplugin-arg-* options are currently recorded in
DW_AT_producer when -grecord-gcc-switches is enabled.

As a result, an absolute plugin path may become embedded in debug
metadata.

For example:

gcc -g -grecord-gcc-switches \
-fplugin=/path/to/plugin.so \
-c hello.c

produces an object file whose DW_AT_producer contains:

GNU C23 ... -g -fplugin=/path/to/plugin.so

In my case, the recorded path was an absolute build-system path to a
GCC plugin:

-fplugin=/local/.../scripts/gcc-plugins/stackleak_plugin.so

This introduces host-specific path information into the generated
artifact and may negatively affect reproducibility.

I noticed that GCC already has the NoDWARFRecord mechanism for options
that should not be recorded in the producer string. Looking through the
history, it appears that this mechanism was introduced partly to address
reproducibility concerns involving path-containing options, and there
are also examples where specific options are intentionally excluded from
producer-string recording.

As an experiment, I modified:

gcc/common.opt

and marked:

-fplugin=
-fplugin-arg-*

with NoDWARFRecord.

With this change:

Before:
DW_AT_producer:
GNU C23 ... -g \
-fplugin=/local/.../stackleak_plugin.so

After:
DW_AT_producer:
GNU C23 ... -g

The plugin is still loaded correctly, plugin arguments are still passed,
and generated code/debug information remain unchanged. The only observed
difference is that plugin-related command-line options are no longer
recorded in DW_AT_producer.

The tradeoff appears to be:

Benefits:
- Avoids recording host-specific absolute plugin paths.
- Improves reproducibility of producer strings.
- Reduces leakage of local build environment details.

Downsides:
- Reduces provenance information available from DW_AT_producer.
- Makes it harder to determine from the binary alone which GCC plugin
(and plugin arguments) were used during compilation.

Before preparing a formal patch submission, I would like feedback on the
policy aspect:

Should -fplugin and -fplugin-arg-* be treated similarly to other
path-sensitive options and be excluded from producer-string
recording?

or

Is preserving plugin provenance in DW_AT_producer considered more
valuable than avoiding path leakage and reproducibility issues?

Comments and guidance would be appreciated.

Thanks,
Jaihind Yadav

Reply via email to