Bug#859424: mapnik shouldn't disable PIE

Adrian Bunk bunk at debian.org
Mon Apr 3 12:12:37 UTC 2017


Source: mapnik
Version: 3.0.12+ds-2
Severity: important
Tags: patch

With gcc in stretch defaulting to PIE, hardening=+all,-pie changed
semantics from "enable hardening but not PIE" to "enable all hardening
and explicitely disable the default PIE".
The latter is usually not intended.

For packages like mapnik that include static libraries the situation
is even worse, since non-PIE static libraries cannot be used with
the stretch gcc unless -no-pie is explicitly passed when linking.

The -pie in hardening flags was in some cases required in pre-stretch
releases to avoid build failures caused by (incorrectly) passing -fPIE
to the compiler when building shared libraries or plugins.
This problem does no longer exist.

I verified that python-mapnik still builds after this change.

Please apply the following patch:

--- debian/rules.old	2017-04-03 11:04:40.000000000 +0000
+++ debian/rules	2017-04-03 11:04:53.000000000 +0000
@@ -4,9 +4,8 @@
 # Uncomment this to turn on verbose mode.
 #export DH_VERBOSE=1
 
-# Enable hardening build flags, except:
-#  pie: causes python-mapnik build failure
-export DEB_BUILD_MAINT_OPTIONS=hardening=+all,-pie
+# Enable hardening build flags:
+export DEB_BUILD_MAINT_OPTIONS=hardening=+all
 
 NJOBS := -j1
 ifneq (,$(filter parallel=%,$(subst $(COMMA), ,$(DEB_BUILD_OPTIONS))))



More information about the Pkg-grass-devel mailing list