Use GCC runtime files from Debian sysroot on aarch64 and x86-64

cpython-unix/build-cpython.sh

@@ -1094,8 +1094,9 @@ xcode_path = os.getenv("APPLE_SDK_PATH")
 if xcode_path:
     replace_in_all("-isysroot %s" % xcode_path, "")
 
-# -fdebug-default-version is Clang only. Strip so compiling works on GCC.
+# These flags are Clang only. Strip so compiling works on GCC.
 replace_in_all("-fdebug-default-version=4", "")
+replace_in_all("--rtlib=compiler-rt", "")
 
 # Downstream extension builds can use their compiler's default linker and need
 # not have LLVM installed.

cpython-unix/build.debian13-x86_64.Dockerfile

@@ -24,9 +24,9 @@ RUN printf '%s\n' \
     '4ed764a6a2317c27e644b6502ac0f3a4d3eb25a859c5199e29071b11f332ac75  snapshot.debian.org_archive_debian-security_20230322T152120Z_dists_jessie_updates_InRelease' \
     > /jessie-metadata.sha256
 
-# Create a sysroot with glibc, kernel headers and their dependencies from a
-# Jessie snapshot. Do not run maintainer scripts. The expired Jessie signing
-# key is verified against the RSA key from a keyring with known removed keys.
+# Create a sysroot with glibc, GCC runtime files, kernel headers and their
+# dependencies from a Jessie snapshot. Do not run maintainer scripts. The expired
+# Jessie signing key is verified against a keyring with known removed keys.
 # Run APT hooks outside the unpopulated sysroot so the checksum check uses
 # Trixie's shell and sha256sum.
 # Skip APT list cleanup: it runs another update with empty sources, which
@@ -42,7 +42,7 @@ RUN mmdebstrap --variant=extract --mode=root \
     --aptopt='DPkg::Chroot-Directory ""' \
     --aptopt='Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \
     --aptopt='APT::Update::Post-Invoke { "cd /sysroot/var/lib/apt/lists && sha256sum --check --strict /jessie-metadata.sha256"; }' \
-    --include=libc6,libc6-dev,linux-libc-dev,symlinks \
+    --include=libc6,libc6-dev,libgcc-4.9-dev,linux-libc-dev,symlinks \
     jessie /sysroot \
     'deb [signed-by=126C0D24BD8A2942CC7DF8AC7638D0442B90D010!] https://snapshot.debian.org/archive/debian/20230322T152120Z/ jessie main' \
     'deb [signed-by=D21169141CECD440F2EB8DDA9D6D8F6BC857C906!] https://snapshot.debian.org/archive/debian-security/20230322T152120Z/ jessie/updates main'

cpython-unix/build.debian13.Dockerfile

@@ -22,9 +22,9 @@ RUN printf '%s\n' \
     'cb3eb154bf0311d53c98eab79692e55aae49a4bcf13c23bd12943a4fb5a0b05f  snapshot.debian.org_archive_debian-security_20230423T032736Z_dists_stretch_updates_InRelease' \
     > /stretch-metadata.sha256
 
-# Create a sysroot with glibc, kernel headers and their dependencies from
-# a Stretch snapshop. Do not run maintainer scripts. The expired Stretch signing
-# key is verified against the RSA key from a keyring with known removed keys.
+# Create a sysroot with glibc, GCC runtime files, kernel headers and their
+# dependencies from a Stretch snapshot. Do not run maintainer scripts. The expired
+# Stretch signing key is verified against a keyring with known removed keys.
 # Run APT hooks outside the unpopulated sysroot using Trixie's shell and tools.
 # Skip APT list cleanup: it runs another update with empty sources, which
 # would remove the pinned metadata and cause the checksum hook to fail.
@@ -39,7 +39,7 @@ RUN mmdebstrap --variant=extract --mode=root \
     --aptopt='DPkg::Chroot-Directory ""' \
     --aptopt='Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \
     --aptopt='APT::Update::Post-Invoke { "cd /sysroot/var/lib/apt/lists && sha256sum --check --strict /stretch-metadata.sha256"; }' \
-    --include=libc6,libc6-dev,linux-libc-dev,symlinks \
+    --include=libc6,libc6-dev,libgcc-6-dev,linux-libc-dev,symlinks \
     stretch /sysroot \
     'deb [signed-by=16E90B3FDF65EDE3AA7F323C04EE7237B7D453EC!] https://snapshot.debian.org/archive/debian/20230423T032736Z/ stretch main' \
     'deb [signed-by=379483D8B60160B155B372DDAA8E81B4331F7F50!] https://snapshot.debian.org/archive/debian-security/20230423T032736Z/ stretch/updates main'

cpython-unix/targets.yml

@@ -149,8 +149,11 @@ aarch64-unknown-linux-gnu:
   target_cc: clang
   target_cxx: clang++
   target_cflags:
-    # Keep target headers and glibc independent of the modern build container.
+    # Use the target sysroot for libc and GCC installation files.
     - '--sysroot=/usr/aarch64-linux-gnu'
+    - '--gcc-install-dir=/usr/aarch64-linux-gnu/usr/lib/gcc/aarch64-linux-gnu/6'
+    # Supply compiler helpers missing from the sysroot's older libgcc.
+    - '--rtlib=compiler-rt'
     # Hardening
     - '-fstack-protector'
     - '-fstack-clash-protection'
@@ -164,6 +167,8 @@ aarch64-unknown-linux-gnu:
     - '-fdebug-default-version=4'
   target_ldflags:
     - '--sysroot=/usr/aarch64-linux-gnu'
+    - '--gcc-install-dir=/usr/aarch64-linux-gnu/usr/lib/gcc/aarch64-linux-gnu/6'
+    - '--rtlib=compiler-rt'
     # Hardening
     - '-Wl,-z,noexecstack'
     - '-Wl,-z,relro'
@@ -719,8 +724,13 @@ x86_64-unknown-linux-gnu:
   target_cc: clang
   target_cxx: clang++
   target_cflags:
-    # Keep target libc independent of the modern build container.
+    # Use the target sysroot for libc and GCC installation files.
     - '--sysroot=/usr/x86_64-linux-gnu'
+    - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9'
+    # Supply compiler helpers missing from the sysroot's older libgcc.
+    - '--rtlib=compiler-rt'
+    # The runtime flag is unused during compile-only checks with -Werror.
+    - '-Wno-unused-command-line-argument'
     # Hardening
     - '-fstack-protector'
     - '-fstack-clash-protection'
@@ -734,6 +744,8 @@ x86_64-unknown-linux-gnu:
     - '-fdebug-default-version=4'
   target_ldflags:
     - '--sysroot=/usr/x86_64-linux-gnu'
+    - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9'
+    - '--rtlib=compiler-rt'
     # Hardening
     - '-Wl,-z,noexecstack'
     - '-Wl,-z,relro'
@@ -788,8 +800,13 @@ x86_64_v2-unknown-linux-gnu:
   target_cc: clang
   target_cxx: clang++
   target_cflags:
-    # Keep target libc independent of the modern build container.
+    # Use the target sysroot for libc and GCC installation files.
     - '--sysroot=/usr/x86_64-linux-gnu'
+    - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9'
+    # Supply compiler helpers missing from the sysroot's older libgcc.
+    - '--rtlib=compiler-rt'
+    # The runtime flag is unused during compile-only checks with -Werror.
+    - '-Wno-unused-command-line-argument'
     # Hardening
     - '-fstack-protector'
     - '-fstack-clash-protection'
@@ -804,6 +821,8 @@ x86_64_v2-unknown-linux-gnu:
     - '-fdebug-default-version=4'
   target_ldflags:
     - '--sysroot=/usr/x86_64-linux-gnu'
+    - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9'
+    - '--rtlib=compiler-rt'
     # Hardening
     - '-Wl,-z,noexecstack'
     - '-Wl,-z,relro'
@@ -858,8 +877,13 @@ x86_64_v3-unknown-linux-gnu:
   target_cc: clang
   target_cxx: clang++
   target_cflags:
-    # Keep target libc independent of the modern build container.
+    # Use the target sysroot for libc and GCC installation files.
     - '--sysroot=/usr/x86_64-linux-gnu'
+    - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9'
+    # Supply compiler helpers missing from the sysroot's older libgcc.
+    - '--rtlib=compiler-rt'
+    # The runtime flag is unused during compile-only checks with -Werror.
+    - '-Wno-unused-command-line-argument'
     # Hardening
     - '-fstack-protector'
     - '-fstack-clash-protection'
@@ -874,6 +898,8 @@ x86_64_v3-unknown-linux-gnu:
     - '-fdebug-default-version=4'
   target_ldflags:
     - '--sysroot=/usr/x86_64-linux-gnu'
+    - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9'
+    - '--rtlib=compiler-rt'
     # Hardening
     - '-Wl,-z,noexecstack'
     - '-Wl,-z,relro'
@@ -930,8 +956,13 @@ x86_64_v4-unknown-linux-gnu:
   target_cc: clang
   target_cxx: clang++
   target_cflags:
-    # Keep target libc independent of the modern build container.
+    # Use the target sysroot for libc and GCC installation files.
     - '--sysroot=/usr/x86_64-linux-gnu'
+    - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9'
+    # Supply compiler helpers missing from the sysroot's older libgcc.
+    - '--rtlib=compiler-rt'
+    # The runtime flag is unused during compile-only checks with -Werror.
+    - '-Wno-unused-command-line-argument'
     # Hardening
     - '-fstack-protector'
     - '-fstack-clash-protection'
@@ -946,6 +977,8 @@ x86_64_v4-unknown-linux-gnu:
     - '-fdebug-default-version=4'
   target_ldflags:
     - '--sysroot=/usr/x86_64-linux-gnu'
+    - '--gcc-install-dir=/usr/x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/4.9'
+    - '--rtlib=compiler-rt'
     # Hardening
     - '-Wl,-z,noexecstack'
     - '-Wl,-z,relro'

src/validation.rs

@@ -271,6 +271,27 @@ static GLIBC_MAX_VERSION_BY_TRIPLE: Lazy<HashMap<&'static str, version_compare::
         versions
     });
 
+static GCC_MAX_VERSION_BY_TRIPLE: Lazy<HashMap<&'static str, version_compare::Version<'static>>> =
+    Lazy::new(|| {
+        // Runtime ABI ceilings for the manylinux2014 targets, as recorded by
+        // https://github.com/pypa/auditwheel/blob/main/src/auditwheel/policy/manylinux-policy.json
+        // RISC-V uses the GCC 8 runtime from the Buster sysroot, whose newest
+        // symbol version is `GCC_7.0.0`.
+        [
+            ("aarch64-unknown-linux-gnu", "4.7.0"),
+            ("armv7-unknown-linux-gnueabi", "4.7.0"),
+            ("armv7-unknown-linux-gnueabihf", "4.7.0"),
+            ("riscv64-unknown-linux-gnu", "7.0.0"),
+            ("x86_64-unknown-linux-gnu", "4.8.0"),
+            ("x86_64_v2-unknown-linux-gnu", "4.8.0"),
+            ("x86_64_v3-unknown-linux-gnu", "4.8.0"),
+            ("x86_64_v4-unknown-linux-gnu", "4.8.0"),
+        ]
+        .into_iter()
+        .map(|(triple, version)| (triple, version_compare::Version::from(version).unwrap()))
+        .collect()
+    });
+
 static ELF_ALLOWED_LIBRARIES_BY_TRIPLE: Lazy<HashMap<&'static str, Vec<&'static str>>> =
     Lazy::new(|| {
         [
@@ -969,6 +990,33 @@ impl ValidationContext {
     }
 }
 
+fn validate_elf_symbol_version(
+    target_triple: &str,
+    path: &Path,
+    name: &str,
+    version: &str,
+) -> Option<String> {
+    let (namespace, version) = version.split_once('_')?;
+    let (library, max_version) = match namespace {
+        "GLIBC" => (
+            "glibc",
+            GLIBC_MAX_VERSION_BY_TRIPLE
+                .get(target_triple)
+                .expect("max glibc version not defined for target triple"),
+        ),
+        "GCC" => ("libgcc", GCC_MAX_VERSION_BY_TRIPLE.get(target_triple)?),
+        _ => return None,
+    };
+    let version = version_compare::Version::from(version).expect("unable to parse version");
+
+    (&version > max_version).then(|| {
+        format!(
+            "{} references too new {library} symbol {name:?} ({version} > {max_version})",
+            path.display(),
+        )
+    })
+}
+
 fn validate_elf<Elf: FileHeader<Endian = Endianness>>(
     context: &mut ValidationContext,
     json: &PythonJsonMain,
@@ -1087,10 +1135,6 @@ fn validate_elf<Elf: FileHeader<Endian = Endianness>>(
         }
     }
 
-    let wanted_glibc_max_version = GLIBC_MAX_VERSION_BY_TRIPLE
-        .get(target_triple)
-        .expect("max glibc version not defined for target triple");
-
     let sections = elf.sections(endian, data)?;
 
     let versions = sections.versions(endian, data)?;
@@ -1226,21 +1270,10 @@ fn validate_elf<Elf: FileHeader<Endian = Endianness>>(
                     }
 
                     if let Some(version) = version_version {
-                        let parts: Vec<&str> = version.splitn(2, '_').collect();
-
-                        if parts.len() == 2 && parts[0] == "GLIBC" {
-                            let v = version_compare::Version::from(parts[1])
-                                .expect("unable to parse version");
-
-                            if &v > wanted_glibc_max_version {
-                                context.errors.push(format!(
-                                    "{} references too new glibc symbol {:?} ({} > {})",
-                                    path.display(),
-                                    name,
-                                    v,
-                                    wanted_glibc_max_version,
-                                ));
-                            }
+                        if let Some(error) =
+                            validate_elf_symbol_version(target_triple, path, &name, &version)
+                        {
+                            context.errors.push(error);
                         }
                     }
                 }
@@ -2463,3 +2496,77 @@ pub fn command_validate_distribution(args: &ArgMatches) -> Result<()> {
         Err(anyhow!("errors found"))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn symbol_error(target: &str, symbol: &str, version: &str) -> Option<String> {
+        validate_elf_symbol_version(
+            target,
+            Path::new("python/install/lib/libpython3.16.so.1.0"),
+            symbol,
+            version,
+        )
+    }
+
+    #[test]
+    fn libgcc_symbols_respect_target_runtime_limits() {
+        for (target, allowed, rejected) in [
+            ("aarch64-unknown-linux-gnu", "GCC_4.7.0", "GCC_4.8.0"),
+            ("armv7-unknown-linux-gnueabi", "GCC_4.7.0", "GCC_4.8.0"),
+            ("armv7-unknown-linux-gnueabihf", "GCC_4.7.0", "GCC_4.8.0"),
+            ("x86_64-unknown-linux-gnu", "GCC_4.8.0", "GCC_7.0.0"),
+            ("x86_64_v2-unknown-linux-gnu", "GCC_4.8.0", "GCC_7.0.0"),
+            ("x86_64_v3-unknown-linux-gnu", "GCC_4.8.0", "GCC_7.0.0"),
+            ("x86_64_v4-unknown-linux-gnu", "GCC_4.8.0", "GCC_7.0.0"),
+            ("riscv64-unknown-linux-gnu", "GCC_7.0.0", "GCC_11.0"),
+        ] {
+            assert!(symbol_error(target, "runtime_symbol", "GCC_3.0").is_none());
+            assert!(symbol_error(target, "runtime_symbol", allowed).is_none());
+            assert!(symbol_error(target, "runtime_symbol", rejected).is_some());
+        }
+    }
+
+    #[test]
+    fn rejects_native_half_float_runtime_symbols() {
+        for symbol in ["__extendhfsf2", "__extendhfxf2", "__truncdfhf2"] {
+            assert_eq!(
+                symbol_error("x86_64-unknown-linux-gnu", symbol, "GCC_12.0.0").unwrap(),
+                format!(
+                    "python/install/lib/libpython3.16.so.1.0 references too new libgcc symbol \
+                     {symbol:?} (12.0.0 > 4.8.0)"
+                )
+            );
+        }
+        assert_eq!(
+            symbol_error("aarch64-unknown-linux-gnu", "__extendhftf2", "GCC_11.0").unwrap(),
+            "python/install/lib/libpython3.16.so.1.0 references too new libgcc symbol \
+             \"__extendhftf2\" (11.0 > 4.7.0)"
+        );
+    }
+
+    #[test]
+    fn glibc_symbols_respect_target_runtime_limits() {
+        assert!(symbol_error("x86_64-unknown-linux-gnu", "runtime_symbol", "GLIBC_2.17").is_none());
+        assert!(symbol_error("x86_64-unknown-linux-gnu", "runtime_symbol", "GLIBC_2.18").is_some());
+        assert!(
+            symbol_error("riscv64-unknown-linux-gnu", "runtime_symbol", "GLIBC_2.28").is_none()
+        );
+        assert!(
+            symbol_error("riscv64-unknown-linux-gnu", "runtime_symbol", "GLIBC_2.29").is_some()
+        );
+        assert!(
+            symbol_error("x86_64-unknown-linux-musl", "runtime_symbol", "GLIBC_2.2.5").is_some()
+        );
+    }
+
+    #[test]
+    fn every_target_allowing_libgcc_has_a_runtime_limit() {
+        for (target, libraries) in ELF_ALLOWED_LIBRARIES_BY_TRIPLE.iter() {
+            if libraries.contains(&"libgcc_s.so.1") {
+                assert!(GCC_MAX_VERSION_BY_TRIPLE.contains_key(target), "{target}");
+            }
+        }
+    }
+}