Deuxfleurs/garage
41
56
Fork 73
Code Issues 99 Pull requests 14 Releases 30 Wiki Activity

Check that compiled binaries are static + fix static compilation #344

Closed
quentin wants to merge 3 commits from bug/check_static into main
pull from: bug/check_static
merge into: Deuxfleurs:main
Conversation 1 Commits 3 Files changed 5 +129 -93
quentin commented 2022-07-23 15:15:02 +00:00
Owner
Copy link

The problem

linux/arm + linux/arm64 binaries were dynamically compiled instead of statically compiled.
It is due to this commit b54a938724
that change the override from the garage crate to the garage_rpc crate.
The change was targeted at the GIT_VERSION variable but impacted the nix hardening configuration too.
After the patch, the PIE feature was not anymore deactivated during the linking of the garage binary,
which lead to a conflict: static pie is not supported on arm/arm64 and thus lead the compiler to ignore the static parameter in favor of the pie parameter.
We did not notice this bug until it was reported recently because we don't ensure that compiled binaries are static.

The fix

  • I rewrote the overrides to deactivate again the PIE hardening.
  • I also added a check to ensure that the compiled binary is static
  • I have refactored the shell.nix file to be both simpler and more idiomatic. Now you can spawn a specific shell with:
    • nix-shell -A rust to have a compilation shell
    • nix-shell -A integration to have a shell with all binaries required by the "smoke test"
    • nix-shell -A release to have a shell with kaniko and bash functions dedicated to binary/container publishing

Out of scope

Running functional+smoke tests with qemu-user is outside of this PR scope.

Note

We can not use ldd as it does not work with cross compiled binaries. file seems to work as intended.

## The problem linux/arm + linux/arm64 binaries were dynamically compiled instead of statically compiled. It is due to this commit https://git.deuxfleurs.fr/Deuxfleurs/garage/commit/b54a938724e5551f6436f551cafec3d1324a6260 that change the override from the `garage` crate to the `garage_rpc` crate. The change was targeted at the GIT_VERSION variable but impacted the nix hardening configuration too. After the patch, the PIE feature was not anymore deactivated during the linking of the `garage` binary, which lead to a conflict: static pie is not supported on arm/arm64 and thus lead the compiler to ignore the static parameter in favor of the pie parameter. We did not notice this bug until it was reported recently because we don't ensure that compiled binaries are static. ## The fix - I rewrote the overrides to deactivate again the PIE hardening. - I also added a check to ensure that the compiled binary is static - Example of a failed build due to a dynamic binary -> https://drone.deuxfleurs.fr/Deuxfleurs/garage/2299/3/3 - Example of a successful build once my patch has been applied -> https://drone.deuxfleurs.fr/Deuxfleurs/garage/2310/3/3 - I have refactored the `shell.nix` file to be both simpler and more idiomatic. Now you can spawn a specific shell with: - `nix-shell -A rust` to have a compilation shell - `nix-shell -A integration` to have a shell with all binaries required by the "smoke test" - `nix-shell -A release` to have a shell with kaniko and bash functions dedicated to binary/container publishing ## Out of scope Running functional+smoke tests with qemu-user is outside of this PR scope. ## Note We can not use `ldd` as it does not work with cross compiled binaries. `file` seems to work as intended.
quentin added 3 commits 2022-07-23 15:15:10 +00:00
Fail if compiled binary is dynamic
Some checks failed
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone Build is failing
Details
4d269787b2
Put log-lines in nix.conf
All checks were successful
continuous-integration/drone/push Build is passing
Details
e680efb361
Fix: compile aarch64+armv6 as static binaries
All checks were successful
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone Build is passing
Details
continuous-integration/drone/pr Build is passing
Details
fe053957e5
quentin commented 2022-07-26 16:27:04 +00:00
Author
Owner
Copy link

Closing in favor of #345

Closing in favor of #345
quentin closed this pull request 2022-07-26 16:27:05 +00:00
Some checks are pending
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone Build is passing
Details
continuous-integration/drone/pr Build is passing
Details
ci/woodpecker/pr/debug
Required

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
action
check-aws
The behaviour should be checked against AWS S3

  
action
discussion-needed
We need to discuss if the feature is desirable and/or better specify the envisioned behavior or technical implementation

  
action
for-external-contributors
Core team does not plan working on this in the near future however an external contribution will be reviewed & merged

  
action
for-newcomers
An issue that should be newcomer friendly.

  
action
more-info-needed
More information is needed to investigate this issue

  
action
need-funding
This issue represents lots of work, we need to find money to pay our core team work

  
action
triage-required
It's not very clear what we want to do with this issue yet, more thoughts is required

  
kind
correctness
Issues of theoretical correctness that may impact edge-case scenarios

  
kind
ideas
For abstract ideas/proposal to make Garage better, to better communicate our not yet achieved aims

  
kind
improvement
Feature requests that do not fall in other categories

  
kind
performance
Deceptive performance observed OR idea to improve performances

  
kind
testing
Functional tests, integration tests, Jepsen, etc.

  
kind
usability
Propositions to make Garage easier to operate, by improving error reporting, CLI, etc.

  
kind
wrong-behavior
Unintended behavior

  
prio
critical
Could impact integrity or availability of production clusters

  
prio
low
For issues that we don't want to spend time on until made absolutely necessary

  
scope
admin-api
Issues concerning the administration API

  
scope
background-healing
Background healing covers repair tasks, anti-entropy, merkle trees, etc. ; everything related to replicating data appropriately.

  
scope
build
Issues with Nix, Drone, Rust Compiler, etc.

  
scope
documentation

  
scope
k8s
Kubernetes related, including Helm Charts

  
scope
layout
Linked to the cluster layout and storage management

  
scope
metadata
Metadata Engine (LMDB, sqlite, etc.)

  
scope
ops
Operations related to operations/maintenance issue, tooling related (like CLI missing info ; impossible, too dangerous, too complicated migration, etc.)

  
scope
rpc
Linked to RPC

  
scope
s3-api
Related to the S3 API (especially compatibility issues).

  
scope
security
Cryptography-related, auth-related, authorization-related issues

  
scope
telemetry
OpenTelemetry (traces, metrics, etc.)

No labels
action
check-aws
action
discussion-needed
action
for-external-contributors
action
for-newcomers
action
more-info-needed
action
need-funding
action
triage-required
kind
correctness
kind
ideas
kind
improvement
kind
performance
kind
testing
kind
usability
kind
wrong-behavior
prio
critical
prio
low
scope
admin-api
scope
background-healing
scope
build
scope
documentation
scope
k8s
scope
layout
scope
metadata
scope
ops
scope
rpc
scope
s3-api
scope
security
scope
telemetry
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Deuxfleurs/garage#344
No description provided.
Delete branch "bug/check_static"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?