Path: csiph.com!1.us.feeder.erje.net!2.eu.feeder.erje.net!3.eu.feeder.erje.net!feeder.erje.net!news.in-chemnitz.de!news2.arglkargh.de!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod From: Julian Gilbey Newsgroups: linux.debian.maint.python Subject: Re: Lintian info message "hardening-no-bindnow" with vanilla debian/rules Date: Wed, 31 Aug 2022 10:20:01 +0200 Message-ID: References: X-Original-To: Gregor Riepl X-Mailbox-Line: From debian-python-request@lists.debian.org Wed Aug 31 08:12:20 2022 Old-Return-Path: X-Amavis-Spam-Status: No, score=-7.21 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, LDO_WHITELIST=-5, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -4.6 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Mailing-List: archive/latest/20253 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/Yw8Xzrj2yP5ItCur@d-and-j.net Approved: robomod@news.nic.it Lines: 28 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org X-Original-Date: Wed, 31 Aug 2022 09:11:58 +0100 X-Original-Message-ID: X-Original-References: <8db57d64-7cf9-f195-38a5-535715f4c89f@gmail.com> Xref: csiph.com linux.debian.maint.python:14415 On Tue, Aug 30, 2022 at 07:33:07PM +0200, Gregor Riepl wrote: > > I: python3-pyxdameraulevenshtein: hardening-no-bindnow [usr/lib/python3/dist-packages/pyxdameraulevenshtein.cpython-310-x86_64-linux-gnu.so] > > > > and there is nothing about CFLAGS or the like in the setup.py file. > > So if having this hardening flag enabled is a good thing, it should > > probably be enabled somewhere within the pybuild system, rather than > > every individual package with an extension file doing it. > > Hardening is generally a good thing, but can break code in subtle ways. > I suppose that's why it was decided that enabling it by default in Debian > was deemed too risky. > > Enabling it is quite easy, though: Just add > > export DEB_BUILD_MAINT_OPTIONS = hardening=+all > [...] Thanks Gregor, I'll try that! > Also, note that hardening-no-bindnow is an Informational message, so not > strictly something that needs to be acted upon: > https://lintian.debian.org/tags/hardening-no-bindnow Indeed, hence the title of this message :-) Best wishes, Julian