[gentoo-dev] Re: hardened glibc and gcc dependencies

[Duncan <1i5t5.duncan@cox.net>]

Paweł Hajdan, Jr. posted on Thu, 27 Oct 2011 18:08:36 +0200 as excerpted:

> On 10/27/11 11:03 AM, "Paweł Hajdan, Jr." wrote:
>> In glibc: DEPEND="gcc[hardened?]"
>> In gcc: PDEPEND="elibc_glibc? glibc[hardened?]"
> 
> I even got an OK on #gentoo-hardened, but I just realized that EAPI-0
> (that both packages in question use) doesn't allow use deps like
> [hardened?].
> 
> I guess bumping the EAPI on those packages is not an option (is it?), so
> I'm going to do some more experiments to see if there are more possible
> problems.

AFAIK, it's an option, but a tough one.  But as with profiles, at some 
point it's worth considering whether holding back on toolchain EAPI bumps 
is worth it any longer.  It'll need to happen eventually, and AFAIK, for 
a system without EAPI-1 or 2 or whatever, portage is already borked.  
Same with the tree in general, since a bash of that vintage isn't going 
to parse certain ebuilds due to the bash 4.1 thing.

Actually, but for the patience of toolchain maintainers, that bump might 
have already happened.  So I guess it's sort of up to them, tho getting 
the blessing of council on something that big is probably a reasonable 
idea.  But that's probably a good idea for moving toward hardened by 
default anyway, so I don't see that as a huge block.

I'm reminded of the move to cascading profiles...  Plus the bash 4.1 
thing.  At some point, you just accept current reality and move on.  But 
toolchain's say will matter a lot.  If they don't believe it's time to 
leave EAPI-0 for gcc and glibc, I don't think it's worth pushing against 
them on their own packages.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman