From f96a915828547cf6631a50dd46d5c96409d03249 Mon Sep 17 00:00:00 2001 From: zaniebot <242828183+zaniebot@users.noreply.github.com> Date: Wed, 21 Oct 2026 19:00:31 +0000 Subject: [PATCH 1/4] Validate GCC runtime symbol versions in Linux distributions --- src/validation.rs | 145 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 126 insertions(+), 19 deletions(-) diff --git a/src/validation.rs b/src/validation.rs index fa30a1d3e..715ddc51c 100644 --- a/src/validation.rs +++ b/src/validation.rs @@ -271,6 +271,27 @@ static GLIBC_MAX_VERSION_BY_TRIPLE: Lazy>> = + Lazy::new(|| { + // Runtime ABI ceilings for the manylinux2014 targets, as recorded by + // https://github.com/pypa/auditwheel/blob/main/src/auditwheel/policy/manylinux-policy.json + // RISC-V uses the GCC 8 runtime from the Buster sysroot, whose newest + // symbol version is `GCC_7.0.0`. + [ + ("aarch64-unknown-linux-gnu", "4.7.0"), + ("armv7-unknown-linux-gnueabi", "4.7.0"), + ("armv7-unknown-linux-gnueabihf", "4.7.0"), + ("riscv64-unknown-linux-gnu", "7.0.0"), + ("x86_64-unknown-linux-gnu", "4.8.0"), + ("x86_64_v2-unknown-linux-gnu", "4.8.0"), + ("x86_64_v3-unknown-linux-gnu", "4.8.0"), + ("x86_64_v4-unknown-linux-gnu", "4.8.0"), + ] + .into_iter() + .map(|(triple, version)| (triple, version_compare::Version::from(version).unwrap())) + .collect() + }); + static ELF_ALLOWED_LIBRARIES_BY_TRIPLE: Lazy>> = Lazy::new(|| { [ @@ -969,6 +990,33 @@ impl ValidationContext { } } +fn validate_elf_symbol_version( + target_triple: &str, + path: &Path, + name: &str, + version: &str, +) -> Option { + let (namespace, version) = version.split_once('_')?; + let (library, max_version) = match namespace { + "GLIBC" => ( + "glibc", + GLIBC_MAX_VERSION_BY_TRIPLE + .get(target_triple) + .expect("max glibc version not defined for target triple"), + ), + "GCC" => ("libgcc", GCC_MAX_VERSION_BY_TRIPLE.get(target_triple)?), + _ => return None, + }; + let version = version_compare::Version::from(version).expect("unable to parse version"); + + (&version > max_version).then(|| { + format!( + "{} references too new {library} symbol {name:?} ({version} > {max_version})", + path.display(), + ) + }) +} + fn validate_elf>( context: &mut ValidationContext, json: &PythonJsonMain, @@ -1087,10 +1135,6 @@ fn validate_elf>( } } - let wanted_glibc_max_version = GLIBC_MAX_VERSION_BY_TRIPLE - .get(target_triple) - .expect("max glibc version not defined for target triple"); - let sections = elf.sections(endian, data)?; let versions = sections.versions(endian, data)?; @@ -1226,21 +1270,10 @@ fn validate_elf>( } if let Some(version) = version_version { - let parts: Vec<&str> = version.splitn(2, '_').collect(); - - if parts.len() == 2 && parts[0] == "GLIBC" { - let v = version_compare::Version::from(parts[1]) - .expect("unable to parse version"); - - if &v > wanted_glibc_max_version { - context.errors.push(format!( - "{} references too new glibc symbol {:?} ({} > {})", - path.display(), - name, - v, - wanted_glibc_max_version, - )); - } + if let Some(error) = + validate_elf_symbol_version(target_triple, path, &name, &version) + { + context.errors.push(error); } } } @@ -2463,3 +2496,77 @@ pub fn command_validate_distribution(args: &ArgMatches) -> Result<()> { Err(anyhow!("errors found")) } } + +#[cfg(test)] +mod tests { + use super::*; + + fn symbol_error(target: &str, symbol: &str, version: &str) -> Option { + validate_elf_symbol_version( + target, + Path::new("python/install/lib/libpython3.16.so.1.0"), + symbol, + version, + ) + } + + #[test] + fn libgcc_symbols_respect_target_runtime_limits() { + for (target, allowed, rejected) in [ + ("aarch64-unknown-linux-gnu", "GCC_4.7.0", "GCC_4.8.0"), + ("armv7-unknown-linux-gnueabi", "GCC_4.7.0", "GCC_4.8.0"), + ("armv7-unknown-linux-gnueabihf", "GCC_4.7.0", "GCC_4.8.0"), + ("x86_64-unknown-linux-gnu", "GCC_4.8.0", "GCC_7.0.0"), + ("x86_64_v2-unknown-linux-gnu", "GCC_4.8.0", "GCC_7.0.0"), + ("x86_64_v3-unknown-linux-gnu", "GCC_4.8.0", "GCC_7.0.0"), + ("x86_64_v4-unknown-linux-gnu", "GCC_4.8.0", "GCC_7.0.0"), + ("riscv64-unknown-linux-gnu", "GCC_7.0.0", "GCC_11.0"), + ] { + assert!(symbol_error(target, "runtime_symbol", "GCC_3.0").is_none()); + assert!(symbol_error(target, "runtime_symbol", allowed).is_none()); + assert!(symbol_error(target, "runtime_symbol", rejected).is_some()); + } + } + + #[test] + fn rejects_native_half_float_runtime_symbols() { + for symbol in ["__extendhfsf2", "__extendhfxf2", "__truncdfhf2"] { + assert_eq!( + symbol_error("x86_64-unknown-linux-gnu", symbol, "GCC_12.0.0").unwrap(), + format!( + "python/install/lib/libpython3.16.so.1.0 references too new libgcc symbol \ + {symbol:?} (12.0.0 > 4.8.0)" + ) + ); + } + assert_eq!( + symbol_error("aarch64-unknown-linux-gnu", "__extendhftf2", "GCC_11.0").unwrap(), + "python/install/lib/libpython3.16.so.1.0 references too new libgcc symbol \ + \"__extendhftf2\" (11.0 > 4.7.0)" + ); + } + + #[test] + fn glibc_symbols_respect_target_runtime_limits() { + assert!(symbol_error("x86_64-unknown-linux-gnu", "runtime_symbol", "GLIBC_2.17").is_none()); + assert!(symbol_error("x86_64-unknown-linux-gnu", "runtime_symbol", "GLIBC_2.18").is_some()); + assert!( + symbol_error("riscv64-unknown-linux-gnu", "runtime_symbol", "GLIBC_2.28").is_none() + ); + assert!( + symbol_error("riscv64-unknown-linux-gnu", "runtime_symbol", "GLIBC_2.29").is_some() + ); + assert!( + symbol_error("x86_64-unknown-linux-musl", "runtime_symbol", "GLIBC_2.2.5").is_some() + ); + } + + #[test] + fn every_target_allowing_libgcc_has_a_runtime_limit() { + for (target, libraries) in ELF_ALLOWED_LIBRARIES_BY_TRIPLE.iter() { + if libraries.contains(&"libgcc_s.so.1") { + assert!(GCC_MAX_VERSION_BY_TRIPLE.contains_key(target), "{target}"); + } + } + } +} From 26ddaef626485e0d2025640a492b0743652a8a14 Mon Sep 17 00:00:00 2001 From: "Jonathan J. Helmus" Date: Wed, 21 Oct 2026 14:54:24 -0500 Subject: [PATCH 2/4] Use GCC runtime files from sysroot on aarch64 and x86-64 Install and use the GCC runtime files from older Debian releases in a sysroot when building aarch64 and x86-64 distributions on Linux. Avoid the GCC runtime files in the LLVM bundle which if dynamically linked would required a newer version of these libraries than expected. --- cpython-unix/build.debian13-x86_64.Dockerfile | 8 ++++---- cpython-unix/build.debian13.Dockerfile | 8 ++++---- cpython-unix/targets.yml | 20 ++++++++++++++----- 3 files changed, 23 insertions(+), 13 deletions(-) diff --git a/cpython-unix/build.debian13-x86_64.Dockerfile b/cpython-unix/build.debian13-x86_64.Dockerfile index 4ebbfb026..2ddc842f3 100644 --- a/cpython-unix/build.debian13-x86_64.Dockerfile +++ b/cpython-unix/build.debian13-x86_64.Dockerfile @@ -24,9 +24,9 @@ RUN printf '%s\n' \ '4ed764a6a2317c27e644b6502ac0f3a4d3eb25a859c5199e29071b11f332ac75 snapshot.debian.org_archive_debian-security_20230322T152120Z_dists_jessie_updates_InRelease' \ > /jessie-metadata.sha256 -# Create a sysroot with glibc, kernel headers and their dependencies from a -# Jessie snapshot. Do not run maintainer scripts. The expired Jessie signing -# key is verified against the RSA key from a keyring with known removed keys. +# Create a sysroot with glibc, GCC runtime files, kernel headers and their +# dependencies from a Jessie snapshot. Do not run maintainer scripts. The expired +# Jessie signing key is verified against a keyring with known removed keys. # Run APT hooks outside the unpopulated sysroot so the checksum check uses # Trixie's shell and sha256sum. # Skip APT list cleanup: it runs another update with empty sources, which @@ -42,7 +42,7 @@ RUN mmdebstrap --variant=extract --mode=root \ --aptopt='DPkg::Chroot-Directory ""' \ --aptopt='Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \ --aptopt='APT::Update::Post-Invoke { "cd /sysroot/var/lib/apt/lists && sha256sum --check --strict /jessie-metadata.sha256"; }' \ - --include=libc6,libc6-dev,linux-libc-dev,symlinks \ + --include=libc6,libc6-dev,libgcc-4.9-dev,linux-libc-dev,symlinks \ jessie /sysroot \ 'deb [signed-by=126C0D24BD8A2942CC7DF8AC7638D0442B90D010!] https://snapshot.debian.org/archive/debian/20230322T152120Z/ jessie main' \ 'deb [signed-by=D21169141CECD440F2EB8DDA9D6D8F6BC857C906!] https://snapshot.debian.org/archive/debian-security/20230322T152120Z/ jessie/updates main' diff --git a/cpython-unix/build.debian13.Dockerfile b/cpython-unix/build.debian13.Dockerfile index 267100005..15db0f39b 100644 --- a/cpython-unix/build.debian13.Dockerfile +++ b/cpython-unix/build.debian13.Dockerfile @@ -22,9 +22,9 @@ RUN printf '%s\n' \ 'cb3eb154bf0311d53c98eab79692e55aae49a4bcf13c23bd12943a4fb5a0b05f snapshot.debian.org_archive_debian-security_20230423T032736Z_dists_stretch_updates_InRelease' \ > /stretch-metadata.sha256 -# Create a sysroot with glibc, kernel headers and their dependencies from -# a Stretch snapshop. Do not run maintainer scripts. The expired Stretch signing -# key is verified against the RSA key from a keyring with known removed keys. +# Create a sysroot with glibc, GCC runtime files, kernel headers and their +# dependencies from a Stretch snapshot. Do not run maintainer scripts. The expired +# Stretch signing key is verified against a keyring with known removed keys. # Run APT hooks outside the unpopulated sysroot using Trixie's shell and tools. # Skip APT list cleanup: it runs another update with empty sources, which # would remove the pinned metadata and cause the checksum hook to fail. @@ -39,7 +39,7 @@ RUN mmdebstrap --variant=extract --mode=root \ --aptopt='DPkg::Chroot-Directory ""' \ --aptopt='Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \ --aptopt='APT::Update::Post-Invoke { "cd /sysroot/var/lib/apt/lists && sha256sum --check --strict /stretch-metadata.sha256"; }' \ - --include=libc6,libc6-dev,linux-libc-dev,symlinks \ + --include=libc6,libc6-dev,libgcc-6-dev,linux-libc-dev,symlinks \ stretch /sysroot \ 'deb [signed-by=16E90B3FDF65EDE3AA7F323C04EE7237B7D453EC!] https://snapshot.debian.org/archive/debian/20230423T032736Z/ stretch main' \ 'deb [signed-by=379483D8B60160B155B372DDAA8E81B4331F7F50!] https://snapshot.debian.org/archive/debian-security/20230423T032736Z/ stretch/updates main' diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml index 7d73dbaae..fb62a0af9 100644 --- a/cpython-unix/targets.yml +++ b/cpython-unix/targets.yml @@ -149,8 +149,9 @@ aarch64-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Keep target headers and glibc independent of the modern build container. + # Use the target sysroot for libc and GCC runtime files. - '--sysroot=/usr/aarch64-linux-gnu' + - '--gcc-install-dir=/usr/aarch64-linux-gnu/usr/lib/gcc/aarch64-linux-gnu/6' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -164,6 +165,7 @@ aarch64-unknown-linux-gnu: - '-fdebug-default-version=4' target_ldflags: - '--sysroot=/usr/aarch64-linux-gnu' + - '--gcc-install-dir=/usr/aarch64-linux-gnu/usr/lib/gcc/aarch64-linux-gnu/6' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' @@ -719,8 +721,9 @@ x86_64-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Keep target libc independent of the modern build container. + # Use the target sysroot for libc and GCC runtime files. - '--sysroot=/usr/x86_64-linux-gnu' + - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -734,6 +737,7 @@ x86_64-unknown-linux-gnu: - '-fdebug-default-version=4' target_ldflags: - '--sysroot=/usr/x86_64-linux-gnu' + - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' @@ -788,8 +792,9 @@ x86_64_v2-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Keep target libc independent of the modern build container. + # Use the target sysroot for libc and GCC runtime files. - '--sysroot=/usr/x86_64-linux-gnu' + - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -804,6 +809,7 @@ x86_64_v2-unknown-linux-gnu: - '-fdebug-default-version=4' target_ldflags: - '--sysroot=/usr/x86_64-linux-gnu' + - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' @@ -858,8 +864,9 @@ x86_64_v3-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Keep target libc independent of the modern build container. + # Use the target sysroot for libc and GCC runtime files. - '--sysroot=/usr/x86_64-linux-gnu' + - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -874,6 +881,7 @@ x86_64_v3-unknown-linux-gnu: - '-fdebug-default-version=4' target_ldflags: - '--sysroot=/usr/x86_64-linux-gnu' + - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' @@ -930,8 +938,9 @@ x86_64_v4-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Keep target libc independent of the modern build container. + # Use the target sysroot for libc and GCC runtime files. - '--sysroot=/usr/x86_64-linux-gnu' + - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -946,6 +955,7 @@ x86_64_v4-unknown-linux-gnu: - '-fdebug-default-version=4' target_ldflags: - '--sysroot=/usr/x86_64-linux-gnu' + - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' From b7741acf1701a909cb80834557915bbacbadbf2b Mon Sep 17 00:00:00 2001 From: "Jonathan J. Helmus" Date: Wed, 21 Oct 2026 16:21:52 -0500 Subject: [PATCH 3/4] use compiler-rt on aarch64 and x86-64 --- cpython-unix/build-cpython.sh | 3 ++- cpython-unix/targets.yml | 25 ++++++++++++++++++++----- 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh index 8dd0240b8..ad529bb7d 100755 --- a/cpython-unix/build-cpython.sh +++ b/cpython-unix/build-cpython.sh @@ -1094,8 +1094,9 @@ xcode_path = os.getenv("APPLE_SDK_PATH") if xcode_path: replace_in_all("-isysroot %s" % xcode_path, "") -# -fdebug-default-version is Clang only. Strip so compiling works on GCC. +# These flags are Clang only. Strip so compiling works on GCC. replace_in_all("-fdebug-default-version=4", "") +replace_in_all("--rtlib=compiler-rt", "") # Downstream extension builds can use their compiler's default linker and need # not have LLVM installed. diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml index fb62a0af9..6f4402ea6 100644 --- a/cpython-unix/targets.yml +++ b/cpython-unix/targets.yml @@ -149,9 +149,11 @@ aarch64-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Use the target sysroot for libc and GCC runtime files. + # Use the target sysroot for libc and GCC installation files. - '--sysroot=/usr/aarch64-linux-gnu' - '--gcc-install-dir=/usr/aarch64-linux-gnu/usr/lib/gcc/aarch64-linux-gnu/6' + # Supply compiler helpers missing from the sysroot's older libgcc. + - '--rtlib=compiler-rt' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -166,6 +168,7 @@ aarch64-unknown-linux-gnu: target_ldflags: - '--sysroot=/usr/aarch64-linux-gnu' - '--gcc-install-dir=/usr/aarch64-linux-gnu/usr/lib/gcc/aarch64-linux-gnu/6' + - '--rtlib=compiler-rt' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' @@ -721,9 +724,11 @@ x86_64-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Use the target sysroot for libc and GCC runtime files. + # Use the target sysroot for libc and GCC installation files. - '--sysroot=/usr/x86_64-linux-gnu' - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' + # Supply compiler helpers missing from the sysroot's older libgcc. + - '--rtlib=compiler-rt' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -738,6 +743,7 @@ x86_64-unknown-linux-gnu: target_ldflags: - '--sysroot=/usr/x86_64-linux-gnu' - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' + - '--rtlib=compiler-rt' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' @@ -792,9 +798,11 @@ x86_64_v2-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Use the target sysroot for libc and GCC runtime files. + # Use the target sysroot for libc and GCC installation files. - '--sysroot=/usr/x86_64-linux-gnu' - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' + # Supply compiler helpers missing from the sysroot's older libgcc. + - '--rtlib=compiler-rt' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -810,6 +818,7 @@ x86_64_v2-unknown-linux-gnu: target_ldflags: - '--sysroot=/usr/x86_64-linux-gnu' - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' + - '--rtlib=compiler-rt' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' @@ -864,9 +873,11 @@ x86_64_v3-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Use the target sysroot for libc and GCC runtime files. + # Use the target sysroot for libc and GCC installation files. - '--sysroot=/usr/x86_64-linux-gnu' - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' + # Supply compiler helpers missing from the sysroot's older libgcc. + - '--rtlib=compiler-rt' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -882,6 +893,7 @@ x86_64_v3-unknown-linux-gnu: target_ldflags: - '--sysroot=/usr/x86_64-linux-gnu' - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' + - '--rtlib=compiler-rt' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' @@ -938,9 +950,11 @@ x86_64_v4-unknown-linux-gnu: target_cc: clang target_cxx: clang++ target_cflags: - # Use the target sysroot for libc and GCC runtime files. + # Use the target sysroot for libc and GCC installation files. - '--sysroot=/usr/x86_64-linux-gnu' - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' + # Supply compiler helpers missing from the sysroot's older libgcc. + - '--rtlib=compiler-rt' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -956,6 +970,7 @@ x86_64_v4-unknown-linux-gnu: target_ldflags: - '--sysroot=/usr/x86_64-linux-gnu' - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' + - '--rtlib=compiler-rt' # Hardening - '-Wl,-z,noexecstack' - '-Wl,-z,relro' From 7dafd252da019295f1bc74ff4e7c079bec1754e3 Mon Sep 17 00:00:00 2001 From: "Jonathan J. Helmus" Date: Wed, 21 Oct 2026 17:34:02 -0500 Subject: [PATCH 4/4] allow unused command line args on x86-64 linux --- cpython-unix/targets.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml index 6f4402ea6..794a08088 100644 --- a/cpython-unix/targets.yml +++ b/cpython-unix/targets.yml @@ -729,6 +729,8 @@ x86_64-unknown-linux-gnu: - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Supply compiler helpers missing from the sysroot's older libgcc. - '--rtlib=compiler-rt' + # The runtime flag is unused during compile-only checks with -Werror. + - '-Wno-unused-command-line-argument' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -803,6 +805,8 @@ x86_64_v2-unknown-linux-gnu: - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Supply compiler helpers missing from the sysroot's older libgcc. - '--rtlib=compiler-rt' + # The runtime flag is unused during compile-only checks with -Werror. + - '-Wno-unused-command-line-argument' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -878,6 +882,8 @@ x86_64_v3-unknown-linux-gnu: - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Supply compiler helpers missing from the sysroot's older libgcc. - '--rtlib=compiler-rt' + # The runtime flag is unused during compile-only checks with -Werror. + - '-Wno-unused-command-line-argument' # Hardening - '-fstack-protector' - '-fstack-clash-protection' @@ -955,6 +961,8 @@ x86_64_v4-unknown-linux-gnu: - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9' # Supply compiler helpers missing from the sysroot's older libgcc. - '--rtlib=compiler-rt' + # The runtime flag is unused during compile-only checks with -Werror. + - '-Wno-unused-command-line-argument' # Hardening - '-fstack-protector' - '-fstack-clash-protection'