Re: Bug#1113774: Disabling -fcf-protection in sudo for bookworm

--TSXNZtTbQYzuUEYL
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi Christoph,

On Wed, Nov 19, 2025 at 08:31:28PM +0100, Christoph Berg wrote:
> The TC has been discussing the issue with all involved parties and Marc, =
the
> sudo maintainer has agreed to accept advice, so we will just do that inst=
ead of
> overruling him.

Thank you for the summary. With the exception of the interaction with
Ben (which I appear to have missed), it accurately matches my
understanding of the matter at hand. A minor aspect missing in the
summary is that -fcf-protection is actually controlling two distinct
features with one flag, one of which poses the problem we've been
discussing. The other feature likewise does not apply to i386.
Therefore, this addition does not affect the conclusion.

> I am calling for votes on this ballot:
>=20
>   [A] The TC advises the sudo maintainer to update the sudo package in bo=
okworm
>   such that on the i386 architecture, the `-fcf-protection` compiler flag=
 is no
>   longer used.
>=20
>   [F] Further discussion.

I vote A > F.

Helmut

--TSXNZtTbQYzuUEYL
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEETMLS2QqNFlTb+HOqLRqqzyREREIFAmke2rgACgkQLRqqzyRE
REIcrw//StqLjZxXzQVlLUIvBSb4kiCVNYHMKfhOOCE7TYEGyAQ2ZKxpu0R5YhBx
SJSd4zA69QacVKvOtk2lnEcnaofv0mgtokWeyVx7UHRiXEcoH9gc9DQJ3cxWMuVJ
+SPmpmGQvk2SJNSSqA1SSClkz9Q2T21pxoT1BLHXn4K5mYbCksAYdcDme3JkYz23
GPVOOtjah0o9O0EaCqOUPrhtnEPO7JBFpabwv+2RAdu/vjcDvp290I4qf/vlRhwq
lgp/4n2bbKIabf8bAJjMGMc15ENizBEqORQubVtqylTMztThGsLIHPBMtqmA43ef
lhOclNWB/sAa0lXA1I0CBnST4m1wp+6W4wN9qsH+rcd8JIC7QMs35QxxDJ9FGJg2
phC6OauFJk/4FcpwYZpG0Va6uVyawmT5nCL5PKUMzGW5DWI//kB54qaw0Ya70Z9H
QBaWYKzXAFSqJfYpGkOm2nm8Rok4ciY1S1YyV24kvSSdSvK3TVNQ0lyhmTI1Q14b
0QxS8xN+CEP1SaYuZflIlITiLAfR61Z6fDM+G24P6Z7gWG+1DVZC7bDJY5t9dZqA
4aqydWMzv/peqo+51quNAb9fbZbS94uJ8ic0gjhyKHaf5Med66QfoVhxNpfnWB5t
h62jTDXd8DSeRvAz9Qtkae1OWuo3JvAsMYfJHzPGAgVg/ABwA3w=
=f4os
-----END PGP SIGNATURE-----

--TSXNZtTbQYzuUEYL--