[PATCH] Link startup files without package-metadata

[Dimitri Ledkov]

On Thu, Feb 19, 2026 at 12:27 PM Florian Weimer <fweimer@redhat.com> wrote:
>
> * Dimitri John Ledkov:
>
> > diff --git a/csu/Makefile b/csu/Makefile
> > index 2afb70b687..cac2dc6cfc 100644
> > --- a/csu/Makefile
> > +++ b/csu/Makefile
> > @@ -174,7 +174,7 @@ include ../Rules
> >  subdir_lib: $(extra-objs:%=$(objpfx)%)
> >
> >  define link-relocatable
> > -$(CC) -nostdlib -nostartfiles -r -o $@ $^
> > +$(CC) -Wl,--package-metadata= -nostdlib -nostartfiles -r -o $@ $^
> >  endef
> >
> >  ifndef start-installed-name-rule
>
> This seems to be quite specific to distribution build policy.  I expect
> not everyone will want to hide provenance in this way.

Most provenance is preserved for the vast majority of artefacts
produced by the build.

>
> Is there a reason why you can't use strip to remove the notes you don't
> want?

I attempted to use --remove-section=.note.package on the startup
files; which breaks them and certain hardening no longer works.
Doing such a strip after an individual binary build is possible - but
not very feasible for all distribution binaries if one wants to keep
app note but without the glibc startup file note.

Note I do hope with my patch the package note still propagates into
application binaries that are statically linked with glibc. I am not
very familiar with all the files that csu/ produces with these link
flags. If there are startup files that are only used for statically
linked application, those should keep package-note as long as they are
not used when dynamically linking libc.

An alternative solution can be as follows:
- add two compile options similar to --with-pkgversion=, for example
--package-metadata --package-metadata-csu
- if --package-medata-csu is not set, default to --package-metadata
value, or default to empty like in this patch
- then use package-metadata-csu value when linking things in
link-relocatable for csu; and use package-metadata for most other
linking

Allow passing in desired package-metadata link values at configuration
time; with ability to have different ones for most binaries & startup
files. This would enable provenance across the board, with ability to
have separate metadata for startup and non-startup files.

Note current situation is leading to a lot of false positive CVEs, and
is currently leading to many distributions to turn off
package-metadata for the whole glibc build. As finding out where to
toggle this off is not very obvious. For example see
https://launchpad.net/ubuntu/+source/glibc/2.42-2ubuntu1 and
https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/2109333

I think fedora also hit similar issues and turned off package-metadata
for all of glibc based on comments on
https://github.com/systemd/package-notes/issues/48 I believe Suse and
Amazon Linux are similarly affected.

>
> Thanks,
> Florian
>