fedora-ci / general

#286 annocheck 'hardened' test fails for /usr/sbin/bpfmon on aarch64
Closed by msrb. Opened by bbonev1.

Closed
Reopen Issue

The message from the failed test:

Hardened: /usr/sbin/bpfmon: FAIL: dynamic-tags test because PAC_PLT flag is missing from the dynamic tags

Relevant part from the build log:

gcc -O3  -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -mbranch-protection=standard -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/include/   -Wall -Wextra -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 --std=gnu89 -fPIE -c bpfmon.c -o bpfmon.o
gcc -O3  -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -mbranch-protection=standard -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/include/   -Wall -Wextra -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 --std=gnu89 -fPIE -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fPIE -pie -o bpfmon bpfmon.o  -L/usr/lib64/ -lyascreen  -lpcap

Before filing this issue, I have checked that the -mbranch-protection=standard flag is there, both at compile and link time. I couldn't see further why the test is failing.

Build:

https://koji.fedoraproject.org/koji/search?terms=bpfmon-2.50-1.fc36&type=build&match=exact

The failed test:

https://osci-jenkins-1.ci.fedoraproject.org/job/fedora-ci/job/rpminspect-pipeline/job/master/45047/testReport/(root)/tests/_annocheck/

related: https://github.com/rpminspect/rpminspect/issues/520

This as an annobin bug fixed in annobin-annocheck-10.05-1.fc36. Fedora CI is still using 10.02 version https://osci-jenkins-1.ci.fedoraproject.org/job/fedora-ci/job/rpminspect-pipeline/job/master/49263/testReport/(root)/tests/_annocheck/. Please upgrade annobin-annocheck package.

New run with the latest-greatest rpminspect+annocheck: https://osci-jenkins-1.ci.fedoraproject.org/job/fedora-ci/job/rpminspect-pipeline/job/master/49641/

Metadata Update from @msrb:
- Issue assigned to msrb

Please upgrade annobin-annocheck package.

You got it, boss :)

Metadata Update from @msrb:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.