From e8dc6bc604748424d05870b5486c5b0fd1f3d62a Mon Sep 17 00:00:00 2001 From: Mune Buye Date: Tue, 20 Oct 2026 15:42:09 +0800 Subject: [PATCH 1/2] Unrot the libapparmor1 and libexpat1 qemu pins Security updates replaced libapparmor1 4.0.1really4.0.1-0ubuntu0.24.04.7 with .9 and libexpat1 2.6.1-2ubuntu0.4 with ubuntu0.6, and the pool kept only the new files, so the cold-cache Fetch x86_64 job answers 404 and every x86-64 job behind it is skipped. Both pins move to the versions noble-updates ships now; their SHA256s match the archive's Packages index. The other twelve pins are still served. --- build.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.py b/build.py index 415043d..806911d 100644 --- a/build.py +++ b/build.py @@ -1307,7 +1307,7 @@ def downloadPackage(name, url, filename, sha256): ("systemd_deb", f"{qemu_ubuntu_pool}/s/systemd/systemd_255.4-1ubuntu8.17_amd64.deb", "systemd_255.4-1ubuntu8.17_amd64.deb", "250345b73e42a97ee71cae7c1e470897dfad3c639eb0a7aafe4f9a3a29871cb2"), ("libsystemd_shared_deb", f"{qemu_ubuntu_pool}/s/systemd/libsystemd-shared_255.4-1ubuntu8.17_amd64.deb", "libsystemd-shared_255.4-1ubuntu8.17_amd64.deb", "8722a69d99c1a7e6f72c5389e9c6d8053d95d2f5f4fede5dc83118f735812518"), ("libsystemd0_deb", f"{qemu_ubuntu_pool}/s/systemd/libsystemd0_255.4-1ubuntu8.17_amd64.deb", "libsystemd0_255.4-1ubuntu8.17_amd64.deb", "4776d2ac7e21efe2ae31f3f7955a7ccd97277225eecf36910a26faf4544979ae"), - ("libapparmor1_deb", f"{qemu_ubuntu_pool}/a/apparmor/libapparmor1_4.0.1really4.0.1-0ubuntu0.24.04.7_amd64.deb", "libapparmor1_4.0.1really4.0.1-0ubuntu0.24.04.7_amd64.deb", "4205351c37f4e813f1ca81b6d59a00071f0f70869e652f4ab9e5ba7e5e895d34"), + ("libapparmor1_deb", f"{qemu_ubuntu_pool}/a/apparmor/libapparmor1_4.0.1really4.0.1-0ubuntu0.24.04.9_amd64.deb", "libapparmor1_4.0.1really4.0.1-0ubuntu0.24.04.9_amd64.deb", "75b570d7517e24c3693c4503b4691ac1fd82934d93faa91460309f22104c5617"), ("libcryptsetup12_deb", f"{qemu_ubuntu_pool}/c/cryptsetup/libcryptsetup12_2.7.0-1ubuntu4.2_amd64.deb", "libcryptsetup12_2.7.0-1ubuntu4.2_amd64.deb", "f6f6a7f35104da711997b52c92ab91ce1f47dd039d276d5beb797d713447c9f2"), ("libfdisk1_deb", f"{qemu_ubuntu_pool}/u/util-linux/libfdisk1_2.39.3-9ubuntu6.6_amd64.deb", "libfdisk1_2.39.3-9ubuntu6.6_amd64.deb", "7f67b127d239f51218c1eb63c3b0c219bbf26f450349bed9ad5d9f10a6b80c1b"), ("libkmod2_deb", f"{qemu_ubuntu_pool}/k/kmod/libkmod2_31+20240202-2ubuntu7.2_amd64.deb", "libkmod2_31+20240202-2ubuntu7.2_amd64.deb", "a9cbdc424bc0a5c8af3d6445488a48de76df5ff4d76b7dab8aaf88f712358bbc"), @@ -1317,7 +1317,7 @@ def downloadPackage(name, url, filename, sha256): ("dbus_session_bus_common_deb", f"{qemu_ubuntu_pool}/d/dbus/dbus-session-bus-common_1.14.10-4ubuntu4.1_all.deb", "dbus-session-bus-common_1.14.10-4ubuntu4.1_all.deb", "aa88bf2f2107e7d948d0e01001b447fc6cae81b285a6e7daf33dcb62737de62f"), ("dbus_system_bus_common_deb", f"{qemu_ubuntu_pool}/d/dbus/dbus-system-bus-common_1.14.10-4ubuntu4.1_all.deb", "dbus-system-bus-common_1.14.10-4ubuntu4.1_all.deb", "4db2e3e18c6abee1a1d1e2f91289e229dd862e6e1ef00463c5533c612c4f1809"), ("libdbus_1_3_deb", f"{qemu_ubuntu_pool}/d/dbus/libdbus-1-3_1.14.10-4ubuntu4.1_amd64.deb", "libdbus-1-3_1.14.10-4ubuntu4.1_amd64.deb", "5d630480f04b4b442300ce847a3fa705ea4d14d80ba6de91f99b51a4e4953b08"), - ("libexpat1_deb", f"{qemu_ubuntu_pool}/e/expat/libexpat1_2.6.1-2ubuntu0.4_amd64.deb", "libexpat1_2.6.1-2ubuntu0.4_amd64.deb", "126a5612e652bdc2edee19ae8fe4308db72b5b3b0a5581bf885b44a093baf3e5"), + ("libexpat1_deb", f"{qemu_ubuntu_pool}/e/expat/libexpat1_2.6.1-2ubuntu0.6_amd64.deb", "libexpat1_2.6.1-2ubuntu0.6_amd64.deb", "494b8e672f722130c6bca6a7bc4cc31a43ca891a31d60d868bfdd699a3c20b13"), ], "aarch64": [], }[machine] From c388e1ac8ce146175926ddf38ade137f1c52c30f Mon Sep 17 00:00:00 2001 From: Mune Buye Date: Sat, 17 Oct 2026 20:08:08 +0800 Subject: [PATCH 2/2] Build the static world with -fcf-protection=none Ubuntu's GCC enables -fcf-protection by default. That defines __CET__, and libunwind's assembly then includes the compiler's , which the runtime's -nostdinc cannot reach, so `./build` stops at UnwindRegistersSave.S on a stock Ubuntu with GCC. musl carries no CET markers, so the static world never ran with IBT or shadow stacks anyway; switching the protection off for the vendored targets only changes what the compiler is allowed to assume. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 8 ++++++++ build.py | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cb6ad89..2f81ed6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -225,6 +225,14 @@ jobs: key: corpus-x86_64-${{ hashFiles('tst/corpus_x86_64.json', 'build.py') }} restore-keys: corpus-x86_64- + # Ubuntu's GCC defaults to -fcf-protection, which the static world + # has to opt out of; no other job builds with it. + - name: GCC + env: + CC: gcc + CXX: g++ + run: ./build -j12 solo + - name: Bridge env: CC: clang diff --git a/build.py b/build.py index 806911d..b24d00d 100644 --- a/build.py +++ b/build.py @@ -271,6 +271,12 @@ def muslSources(): "-fdata-sections", "-fno-stack-protector", "-fno-omit-frame-pointer", + # Distribution compilers may default to -fcf-protection (Ubuntu's GCC + # does), which defines __CET__ and makes libunwind's assembly include + # the compiler's — unreachable under -nostdinc. musl carries no + # CET markers, so the static world cannot run with IBT or shadow stacks + # anyway. + "-fcf-protection=none", ] if machine == "aarch64": # The static world links no libgcc, so the LSE outline-atomic helpers