systemd build failure with gcc 15 / tpm2 / aarch64: gcs required

[Max Krummenacher <max.oss.09@gmail.com>]

Hello

I'm seeing a strange warning resulting in a failed build when building
systemd with tpm2 in DISTRO_FEATURES.

GCS seems to be a new feature supported with GCC 15 and friends
targeting the AARCH64 architecture. Whatever it does ;-).

Ways to reproduce:

Add the needed layers for tpm2, add tpm2 to distro features and build
systemd.
E.g. 
bblayers.conf additions:

  ${TOPDIR}/../meta-security/meta-tpm \
  ${TOPDIR}/../meta-openembedded/meta-oe \
  ${TOPDIR}/../meta-openembedded/meta-python \

local.conf additions:

DISTRO_FEATURES:append = " tpm2"
INIT_MANAGER = "systemd"

MACHINE=qemuarm64 bitbake systemd

Results in:

| FAILED: src/shared/libsystemd-shared-257.so
| aarch64-poky-linux-gcc -mcpu=cortex-a57+crc -mbranch-protection=standard -fstack-protector-strong
  -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=...systemd/257.5/recipe-sysroot
  -o src/shared/libsystemd-shared-257.so -Wl,--as-needed -Wl,--no-undefined -shared -fPIC
  -Wl,-soname,libsystemd-shared-257.so -Wl,--whole-archive -Wl,--start-group src/shared/libsystemd-shared-257.a
  src/basic/libbasic.a src/libsystemd/libsystemd_static.a -Wl,--no-whole-archive -fstack-protector
  -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -ffile-prefix-map=...systemd/257.5/git=/usr/src/debug/systemd/257.5
  -ffile-prefix-map...systemd/257.5/build=/usr/src/debug/systemd/257.5 -ffile-prefix-map=...systemd/257.5/recipe-sysroot=
  -ffile-prefix-map=...systemd/257.5/recipe-sysroot-native= -Wl,-z,relro,-z,now -shared
  -Wl,--version-script=...systemd/257.5/git/src/shared/libshared.sym -pthread ...systemd/257.5/recipe-sysroot/usr/lib/libacl.so
  ...systemd/257.5/recipe-sysroot/usr/lib/libblkid.so ...systemd/257.5/recipe-sysroot/usr/lib/libcap.so
  ...systemd/257.5/recipe-sysroot/usr/lib/libcrypt.so -ldl ...systemd/257.5/recipe-sysroot/usr/lib/libmount.so
  ...systemd/257.5/recipe-sysroot/usr/lib/libssl.so ...systemd/257.5/recipe-sysroot/usr/lib/libcrypto.so -lrt
  ...systemd/257.5/recipe-sysroot/usr/lib/libseccomp.so -Wl,--fatal-warnings -Wl,-z,now -Wl,-z,relro -Wl,--warn-common
  -Wl,--gc-sections -Wl,--fatal-warnings -Wl,-z,now -Wl,-z,relro -Wl,--warn-common -Wl,--gc-sections -lm
  -Wl,--end-group -Wl,--fatal-warnings -Wl,-z,now -Wl,-z,relro -Wl,--warn-common -Wl,--gc-sections
  -Wl,--fatal-warnings -Wl,-z,now -Wl,-z,relro -Wl,--warn-common -Wl,--gc-sections
| ...systemd/257.5/recipe-sysroot/usr/lib/libcrypto.so: warning: GCS is required by -z gcs,
  but this shared library lacks the necessary property note. The dynamic loader might not enable GCS
  or refuse to load the program unless all the shared library dependencies have the GCS marking.
| collect2: error: ld returned 1 exit status


I already found that adding to the systemd recipe

'CFLAGS:append = " -Wl,-z,gcs-report-dynamic=none"'

prevents the build error. However I'm not sure if that would be a good
way forward and if there are other recipes / configurations which would
result in similar build errors.

Any comments? Thanks.

Regards
Max