On Thu, Oct 29, 2026 at 10:00:45AM +0100, Stefan Sperling wrote: > On Wed, Oct 28, 2026 at 11:16:45PM +0100, Theo Buehler wrote: > > This builds fine here, but I have not spent much time thinking about > > the diff. > > > > Only two small things for now: > > > > > @@ -1,12 +1,17 @@ > > > COMMENT = reverse-proxy with built-in authentication and auditing > > > > > > +# Intersection of GO_ARCHS and RUST_ARCHS, and without i386 and 32-bit > > > arm > > > +# because Teleport disables those on purpose in its RDP client build > > > rules. > > > +ONLY_FOR_ARCHS = aarch64 amd64 > > > + > > > > Pretty sure you can skip this. You have bdeps on lang/rust and lang/go > > from their use in the modules, so you already get the intersection of > > the two architectures from their respective ONLY_FOR_ARCHS, and this > > excludes i386 because i386 is not in RUST_ARCHS. > > What you're saying is correct, though there is another reason for > setting ONLY_FOR_ARCHS: The linker flags we're adding for cgo are > architecture-specific, and we currently only cover amd64 and arm64 > in our patches. Any other architecture would fail to link the binaries > due to missing symbols required by the RDP library. > I have updated the comment on top of ONLY_FOR_ARCHS accordingly.
Yes, that makes sense. > > > Do you know how aws-lc is used? If it is used as the backend for rustls. > > If so, you will probably need USE_NOBTCFI, see e.g., the top of > > devel/zizmor. > > Thanks. The rustls version used here dates from before the aws-lc fix > for this problem was merged so it is possible that we would hit this. > I am now setting USE_NOEXECONLY (not USE_NOBTCFI, since devel/zizmor > is not setting that and i believe you mixed them up). Right. The merge is slightly misleading since that's in s2n-bignum which is upstream, not aws-lc itself. aws-lc 5.12.0 has now updated its sources and also fixed some perlasm. It uses openbsd for testing and has addressed all the .rodata vs .text issues I am aware of. aws-lc-sys 0.47.0 (#1274) pins its aws-lc submodule to aws-lc 5.12: https://github.com/aws/aws-lc-rs/commit/e9f03440bdf4b900b86c5b365d7e29ac5cf77148 so once things start picking that most recent version up we should be able drop the noexeconly sprinkled throughout the tree. Until then I think it's best we play it safe. I think your approach is about as clean as it can be. I'm not terribly fond of the MODCARGO_configure call in post-configure though. I don't have a better idea. I'm ok with moving forward with this diff, but perhaps you give it a day or two to see if someone has a bright idea.
