linux-kernel - Re: gcc 5 & 6 & others already out of date?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Oct 2022 20:39:13 +0200
From:   Florian Weimer <fweimer@...hat.com>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
Cc:     Mark Brown <broonie@...nel.org>, linux-toolchains@...r.kernel.org,
        Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: gcc 5 & 6 & others already out of date?

* Jason A. Donenfeld:

> It's also easy, nearly trivial, to download toolchains. Arnd provides a
> bunch with his crosstool. "Must use a toolchain from your distro" is a
> requirement that affects nobody.

But not everything will be built with the cross-compiler.  For the
kernel build tools and other userspace components, you'll need a native
toolchain that can build programs that can actually run on the build
host.  At the very least, this means that the right search paths have to
be baked into the tools, and I'm not sure this will happen automatically
for popular distributions.  (I only know that it wouldn't happen for
glibc, but you can't really rebuild that.)  This seems unexplored
territory to me.  The existence of working cross-tools doesn't tell us
much how native builds and integration with installed native libraries
will play out in practice.

There's also going to be much greater variance of compilers people
actually use if everyone just picks an upstream release branch snapshot
at some point in time.

None of this may be sufficient reason to support old toolchains.  But if
you require more recent versions, you really should tell people to
upgrade to new distributions, or use newer toolchain versions
specifically built for the distribution by their distribution vendor.
And not to try to build their own toolchain.

Thanks,
Florian