Re: [PATCH v2] libebl: recognize FDO Packaging Metadata ELF note

[Luca Boccassi <bluca@debian.org>]

[-- Attachment #1: Type: text/plain, Size: 2819 bytes --]

On Fri, 2022-03-25 at 14:39 +0100, Mark Wielaard wrote:
> Hi Luca,
> 
> On Fri, 2022-03-25 at 11:17 +0000, Luca Boccassi wrote:
> > On Fri, 2022-03-25 at 00:14 +0100, Mark Wielaard wrote:
> > > I took the elf.h update separately. Tweaked your patch a little and
> > > added a patch of my own to make elflint recognize the new note
> > > type.
> > > 
> > >   [PATCH 1/3] libelf: Sync elf.h from glibc.
> > >   [PATCH 2/3] libebl: recognize FDO Packaging Metadata ELF note
> > >   [PATCH 3/3] elflint: Recognize NT_FDO_PACKAGING_METADATA
> > 
> > No problem at all, change looks good, thanks for following up.
> 
> Thanks, I pushed these three patches.
> But I noticed an issue on s390x fedora 36.
> This isn't just elfutils though, binutils also has trouble:
> 
> Displaying notes found in: .note.package
>   Owner                Data size        Description
> readelf: /usr/bin/bash: Warning: note with invalid namesz and/or descsz
> found at offset 0x0
> readelf: /usr/bin/bash: Warning:  type: 0x7e1afeca, namesize:
> 0x04000000, descsize: 0x78000000, alignment: 4
> 
> Note how it seems the sizes are swapped. s390x is a big endian
> platform.
> 
> Do you happen to know what/how the notes are created and if that
> process might produce bad little/big encoding issues?

Agh - I knew big endianess was a bad idea! :-)
We have completely overlooked that, the note is created by a linker
script, which is generated at build time by this:

https://github.com/systemd/package-notes/blob/main/generate-package-notes.sh#L254

(well an older version in Fedora, but similar enough)

I'll flag this, thanks for the report

> > I have included the field in the first PoC that uses the spec in
> > Debian, for the systemd packages:
> > 
> > $ readelf --notes /usr/lib/systemd/systemd | grep Packaging
> >     Packaging Metadata:
> > {"type":"deb","os":"debian","name":"systemd","architecture":"amd64","
> > version":"250.4-1","debugInfoUrl":"https://debuginfod.debian.net"}
> 
> Nice, thanks. I'll look into how to pick up the debugInfoUrl and use
> that automagically if possible.
>
> BTW. I notice that Fedora has an osCpe field where Debian has an os
> field. It would imho be good if one or the other got standardized.

Debian has not adopted the CPE spec in its os-release, so there's no
way to 'source' the appropriate value. Also bear in mind the Debian
version is purely a PoC, opt-in and used only in the systemd package,
there's no proposal for distro-wide adoption. I plan to propose that
eventually, but it will not be anytime soon, other distros need to
adopt it first otherwise chances are it will just be rejected outright,
for no particular reason other than "it's a change, we don't like
change".

-- 
Kind regards,
Luca Boccassi

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]