Re: [Xenomai] Debian package of Xenomai 2.6.4

[Leopold Palomo-Avellaneda <leo@alaxarxa.net>]

El Dijous, 25 de juny de 2015, a les 14:01:16, Gilles Chanteperdrix va 
escriure:
> On Thu, Jun 25, 2015 at 01:43:51PM +0200, Leopold Palomo-Avellaneda wrote:
> > Hi,
> > 
> > in the lasts days I have been working in the Debian package of xenomai. By
> > now 2.6.4, but 3.0 is in the agenda, so I will begin to work on it soon.
> > 
> > I'm working for the "officially" Debian package for the Debian
> > organization. I'm not alone, I'm collaborating with official maintainer
> > (Roland Stigge). So, my main target is to have one good package for
> > Debian.
> > 
> > However, say that, IMHO it's important that the package could solve the
> > needs of more people, so, I'm open to adapt, modify or whatever in a good
> > manner to help the needs of the users of that package: Debian users or
> > Debian derivatives users.
> > 
> > The Debian package follows mainly the upstream (Xenomai project) package.
> > However, I have introduced several changes from the original Debian one:
> > 
> > - Renamed linux-patch-xenomai by xenomai-kernel-source
> > We are using Upstream nomenclature.
> 
> The move from linux-patch-xenomai to xenomai-kernel-source is not a
> simple rename. Providing patches as linux-patch-xenomai did has been
> obsolete for several debian releases (3 or 4, something like that),
> and so no longer justified the costly maintenance of the script
> generating those patches. So, the xenomai-kernel-source package
> simply contains the part of the xenomai sources and the
> prepare-kernel.sh script allowing to build a kernel with xenomai
> support, making the preparation of a kernel the same as the one
> documented by the upstream package.

Good. I agree.

> > - Renamed xenomai-runtime by xenomai-system-tools.
> > Udev files, init file, test utilities, modprobe utilities. All this stuff
> > goes to that package.
> > 
> > - Drop /dev from libxenomai1.
> > The /dev directory is created by udev. All debian systems have udev.
> > However, I'm thinking to have another package with this stuff. What do
> > you think?

You didn't answer this ..

[...]

> > N:
> configure.in has been renamed configure.ac in xenomai 3.x. It will
> not be renamed in xenomai 2.6.x.
> 
> > P: xenomai source: source-contains-prebuilt-javascript-object
> > doc/generated/html/api/jquery.js mean line length is about 16131
> > characters
> > N:
> > N:    The source tarball contains a prebuilt (minified) JavaScript object.
> > N:    They are usually left by mistake when generating the tarball by not
> > N:    cleaning the source directory first. You may want to report this as
> > an N:    upstream bug, in case there is no sign that this was intended.
> No, this is intended, this file is part of the documentation
> generated by doxygen, and we want that documentation to be
> installable on the users system without any need to install doxygen.

Ok, I know.

> > W: xenomai-system-tools: hardening-no-relro usr/bin/cmd_bits
> > N:
> > N:    This package provides an ELF binary that lacks the "read-only
> > N:    relocation" link flag. This package was likely not built with the
> > N:    default Debian compiler flags defined by dpkg-buildflags. If built
> > using N:    dpkg-buildflags directly, be sure to import LDFLAGS.
> > N:
> > N:    Refer to https://wiki.debian.org/Hardening for details.
> > N:
> > N:    Severity: normal, Certainty: certain
> > N:
> > N:    Check: binaries, Type: binary, udeb
> > N:
> > W: xenomai-system-tools: hardening-no-relro usr/bin/cmd_read
> > W: xenomai-system-tools: hardening-no-relro usr/bin/cmd_write
> > W: xenomai-system-tools: hardening-no-relro usr/bin/insn_bits
> > W: xenomai-system-tools: hardening-no-relro usr/bin/insn_read
> > W: xenomai-system-tools: hardening-no-relro usr/bin/insn_write
> > W: xenomai-system-tools: hardening-no-relro usr/bin/rtcanrecv
> > W: xenomai-system-tools: hardening-no-relro usr/bin/rtcansend
> > W: xenomai-system-tools: hardening-no-relro usr/bin/wf_generate
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/native+posix/mq_select
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/native/heap
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/native/leaks
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/native/sigdebug
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/native/tsc
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/posix/leaks
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/posix/mprotect
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/posix/nano_test
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/posix/shm
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/posix/test_pip_exit
> > W: xenomai-system-tools: hardening-no-relro usr/lib/x86_64-linux-
> > gnu/xenomai/regression/posix/xddp_test
> > W: xenomai-system-tools: hardening-no-relro usr/sbin/analogy_config
> > W: xenomai-system-tools: hardening-no-relro usr/sbin/rtcanconfig
> > 
> 
> Please provide the patch to the debian/rules to apply this change. I
> do not think we did anything special to avoid using the default flags.


my configure line says:

CONFIG_OPTS += --prefix=/usr \
                    --includedir=/usr/include/xenomai \
                    --mandir=/usr/share/man \
                    --with-testdir=/usr/lib/$(DEB_HOST_MULTIARCH)/xenomai \
                    --enable-fortify \
                    --libdir='$${prefix}/lib/$(DEB_HOST_MULTIARCH)/'


plus some specific arch params. I have tested it with --enable-fortify and 
without.

I have also:
DEB_BUILD_MAINT_OPTIONS=hardening=+all,-pie

following

https://wiki.debian.org/Hardening

any help in this stuff will help.



> > 
> > Any volunteer?


> > W: xenomai-system-tools: binary-without-manpage usr/sbin/analogy_config
> > W: xenomai-system-tools: binary-without-manpage usr/bin/cmd_bits
> > W: xenomai-system-tools: binary-without-manpage usr/bin/cmd_read
> > W: xenomai-system-tools: binary-without-manpage usr/bin/cmd_write
> > W: xenomai-system-tools: binary-without-manpage usr/bin/insn_bits
> > W: xenomai-system-tools: binary-without-manpage usr/bin/insn_read
> > W: xenomai-system-tools: binary-without-manpage usr/bin/insn_write
> > W: xenomai-system-tools: binary-without-manpage usr/sbin/rtps
> > W: xenomai-system-tools: binary-without-manpage usr/bin/wf_generate
> > W: xenomai-system-tools: binary-without-manpage usr/bin/wrap-link
> > W: xenomai-system-tools: binary-without-manpage
> > usr/bin/xeno-regression-test
> > 
> > 
> > X: libxenomai1: shlib-calls-exit
> > usr/lib/x86_64-linux-gnu/libnative.so.3.0.0 N:
> > N:    The listed shared library calls the C library exit() or _exit()
> > N:    functions.
> > N:
> > N:    In the case of an error, the library should instead return an
> > N:    appropriate error code to the calling program which can then
> > determine N:    how to handle the error, including performing any
> > required clean-up. N:
> > N:    In most cases, removing the call should be discussed with upstream,
> > N:    particularly as it may produce an ABI change.
> > N:
> > N:    Severity: wishlist, Certainty: possible
> > N:
> > N:    Check: shared-libs, Type: binary, udeb
> > N:
> > N:    This tag is marked experimental, which means that the code that
> > N:    generates it is not as well-tested as the rest of Lintian and might
> > N:    still give surprising results. Feel free to ignore experimental tags
> > N:    that do not seem to make sense, though of course bug reports are
> > always N:    welcome.
> > N:
> > X: libxenomai1: shlib-calls-exit usr/lib/x86_64-linux-gnu/libpsos.so.0.0.0
> > X: libxenomai1: shlib-calls-exit usr/lib/x86_64-linux-
> > gnu/libpthread_rt.so.1.0.0
> > X: libxenomai1: shlib-calls-exit
> > usr/lib/x86_64-linux-gnu/libuitron.so.0.0.0 X: libxenomai1:
> > shlib-calls-exit usr/lib/x86_64-linux-gnu/libvrtx.so.0.0.0 X:
> > libxenomai1: shlib-calls-exit
> > usr/lib/x86_64-linux-gnu/libvxworks.so.1.0.0 X: libxenomai1:
> > shlib-calls-exit usr/lib/x86_64-linux-gnu/libxenomai.so.0.0.0
> > 
> > 
> > The package git is located here:
> > 
> > http://anonscm.debian.org/cgit/collab-maint/xenomai.git
> 
> Calling exit in those libs is intentional, and will not be modified.


OK,

Leopold

-- 
--
Linux User 152692     GPG: 05F4A7A949A2D9AA
Catalonia
-------------------------------------
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part.
URL: <http://xenomai.org/pipermail/xenomai/attachments/20150625/6e9bc49b/attachment.sig>