Re: [PATCH v3] Support static-only builds

[Daniel Burgener <dburgener@linux.microsoft.com>]

On 2/12/2025 4:16 AM, Alyssa Ross wrote:
> Daniel Burgener <dburgener@linux.microsoft.com> writes:
> 
>> On 2/11/2025 4:16 PM, Alyssa Ross wrote:
>>> diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile
>>> index 32ad0201..7acd51dd 100644
>>> --- a/policycoreutils/Makefile
>>> +++ b/policycoreutils/Makefile
>>> @@ -1,5 +1,10 @@
>>>    SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setsebool scripts po man hll unsetfiles
>>>    
>>> +PKG_CONFIG ?= pkg-config
>>> +
>>> +LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux)
>>> +export LIBSELINUX_LDLIBS
>>> +
>>
>> I think that in the DISABLE_SHARED case, the pkg-config command needs
>> --static as well.  I tried your patch, and I get errors that the
>> downstream users of libselinux have undefined references to libpcre2,
>> and they are being build without -lpcre2-8.  Based on the pkg-config man
>> page, it looks like Requires.private libraries are only included if the
>> --static flag is passed.
> 
> I think it's generally expected that the user set
> PKG_CONFIG="pkg-config --static" when they want static linking.  See
> e.g. <https://bugs.freedesktop.org/show_bug.cgi?id=19541#c3>.

Thanks for clarifying.  Yes, this command builds everything for me:

make DESTDIR=~/obj PKG_CONFIG="pkg-config --static" DISABLE_SHARED=y install

However, the binaries still appear dynamically linked when I investigate 
them with the "file" command.  Am I missing some other step?

> 
>> I also see that restorecond is not including -lpcre2-8.  It probably
>> needs the same treatment as policycoreutils/*.
> 
> Does it fail to build for you?  It builds DISABLE_SHARED=y for me

Now that I added PKG_CONFIG="pkg-config --static", restorecond is 
building.  However, as above, it appears dynamically linked.

> 
>> Finally, I was unable to get the install-rubywrap and install-pywrap
>> targets to build with DISABLE_SHARED=y.  I wasn't able to figure out the
>> ultimate issue there.
> 
> I think Ruby and Python bindings need to be shared libraries, so it
> doesn't make sense to build them with DISABLE_SHARED=y.

Fair enough. I think it would be helpful if these caveats could all get 
documented.  I just tried following the README.md instructions and 
adding "DISABLE_SHARED=y", which as mentioned, didn't work.  If 
"DISABLE_SHARED" requires other options to work, it seems like that 
should at a minimum be documented.

-Daniel