[PATCH] Link startup files without package-metadata

[Dimitri Ledkov]

On Thu, Feb 19, 2026 at 12:39 PM Sam James <sam@gentoo.org> wrote:
>
> Florian Weimer <fweimer@redhat.com> writes:
>
> > * Dimitri John Ledkov:
> >
> >> diff --git a/csu/Makefile b/csu/Makefile
> >> index 2afb70b687..cac2dc6cfc 100644
> >> --- a/csu/Makefile
> >> +++ b/csu/Makefile
> >> @@ -174,7 +174,7 @@ include ../Rules
> >>  subdir_lib: $(extra-objs:%=$(objpfx)%)
> >>
> >>  define link-relocatable
> >> -$(CC) -nostdlib -nostartfiles -r -o $@ $^
> >> +$(CC) -Wl,--package-metadata= -nostdlib -nostartfiles -r -o $@ $^
> >>  endef
> >>
> >>  ifndef start-installed-name-rule
> >
> > This seems to be quite specific to distribution build policy.  I expect
> > not everyone will want to hide provenance in this way.
>
> Reading https://uapi-group.org/specifications/specs/package_metadata_for_executable_files/
> gave the impression that it's supposed to be singular (and I assumed it
> was before now), but I accept that it doesn't seem to explicitly
> require that, and I can see why you may want the infectious behaviour.
>
> If multiple aren't supported, then I think the patch is required. If
> not, then OK.
>

How to declare multiple stanzas is underspecified right now. In
practice both https://jsonlines.org/ (multiple json documents \n
separate) and multiple singular json document notes do work correctly
across all parsers of these fields.

I really want to ensure there is adequately specified way to add
multiple stanzas, such that one can accurately document all statically
linked binaries (i dream a dream that a statically linked libz
libcrypto and so on, are tracable in binaries via this). But still
discussing this https://github.com/systemd/package-notes/issues/40 as
scanners only just started to pay attention to these notes and
starting to suppor the recentish appCpe field.

> >
> > Is there a reason why you can't use strip to remove the notes you don't
> > want?
>
> I think people are generally nervous about using strip even with
> specific arguments on relocatables so may shy away from it. But then
> it's a special case and it's not like packaging glibc doesn't have other
> things you need to be aware of.
>
> >
> > Thanks,
> > Florian
>
> sam