Re: F45 Change Proposal: Enable Shadow Stack by Default on x86_64 (system-wide)

--===============3560217245396324116==
Content-Type: multipart/signed; boundary="nextPartuW7O1zKlSV-enf_1ogW-LQ";
 micalg="pgp-sha256"; protocol="application/pgp-signature"

--nextPartuW7O1zKlSV-enf_1ogW-LQ
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="utf-8"; protected-headers="v1"
From: Christoph Erhardt <[email protected]>
To: [email protected]
Cc: Arjun Shankar <[email protected]>
Date: Fri, 31 Jul 2026 18:46:20 +0200
Message-ID: <[email protected]>
In-Reply-To: 
 <CAG_osaZidhrPQMT-oQK9xnFVrF_rUsry0dmPHKnR6xxYhdvwfw@mail.gmail.com>
MIME-Version: 1.0

Hi Arjun,

On Tuesday, 28 July 2026 18:59:55 Central European Summer Time Arjun Shankar 
via devel wrote:
> 2. pypi wheels and other Python extensions:
> 
> I think the way to tackle this is to discuss an upstream change in
> cpython CFLAGS (which are, e.g. inherited by manylinux which is used
> to build wheels). I have a patch ready, and have started this
> discussion:
> https://discuss.python.org/t/add-x86-64-shadow-stack-support-for-linux/1083
> 09 and filed a (for now closed, but I'd say there is no definitive
> verdict until the discussion proceeds) issue:
> https://github.com/python/cpython/issues/154820

in my understanding, the correct place for this is the PyPA's manylinux 
project. I have opened a draft pull request with them:
https://github.com/pypa/manylinux/pull/1970

... and was asked to launch a discussion thread in the Python Packaging forum:
https://discuss.python.org/t/building-extensions-with-hardening-flags-via-manylinux/108354

Best regards,
Christoph
--nextPartuW7O1zKlSV-enf_1ogW-LQ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEwp5/nkNlccrQ2UKH4yzDBS9Gs8IFAmps0VwACgkQ4yzDBS9G
s8LFoBAAmpNN5xR8wtibBhTwjKn5UI5ofnIHPrAgS6lPCuAL9nMcGANM8Bqi9klE
XTywDHQXIbLlv5WT9WDgv+1ULnj3R6GxEbYolcMX7SKiMsqWnCocGB3zBbhwpfKy
JrFpEo0I+BS19F8R47lDuK8VBJmRMtNEru8ePeOh8PFk2ey7XLDwOovGyHkMfr2+
kfn38Zw3YoCLaTPdh7qo+tatP8wyuekNycRurjgfkeMyz3CUOAdyfa2XI8ZDRuYf
4zHRCdVRCc3+9zQ/jZ1csmrLD0+vSfnvSSJqB7HuTjrXM89Mzipqv78Q8ad84HYH
uReB2xScMzhZpUvzJTrjI9QUYOG2IPmGaYp6YYNPl3X7sJr3j5TY4DIbmV3OYFTj
WSuZ3Qrp6MgmjiY7l/2anev8OzXunqlDjdWKQ8lr/l0QfpiT1F5VX+0+QRxvG6xQ
N5a786arimMtymndXIwA3NLkLkg3NrJmgOgDWivXrrtUhEV+eUGKhFVlMBTVQR+u
4J7wC02HlJHoydsuULDOAHVkE/CplLd+pVpbv8MKtS9J10+T+i4/l2vbGKqwapYo
GQ/9RTjLpKiwPIPCKR6QZamIySckWRuFVvZVyxbszGV6UiPIqNEL/Mna0gccJ05h
B9GxjUu3/9sUwFQXrqBQGXeQ9AeBxvoHN8EeSR3C0np+v067td0=
=t2Zx
-----END PGP SIGNATURE-----

--nextPartuW7O1zKlSV-enf_1ogW-LQ--




--===============3560217245396324116==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmRldmVs
IG1haWxpbmcgbGlzdCAtLSBkZXZlbEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1YnNj
cmliZSBzZW5kIGFuIGVtYWlsIHRvIGRldmVsLWxlYXZlQGxpc3RzLmZlZG9yYXByb2plY3Qub3Jn
CkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9l
bi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRwczovL2Zl
ZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBBcmNoaXZl
czogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L2RldmVsQGxp
c3RzLmZlZG9yYXByb2plY3Qub3JnCkRvIG5vdCByZXBseSB0byBzcGFtLCByZXBvcnQgaXQ6IGh0
dHBzOi8vZm9yZ2UuZmVkb3JhcHJvamVjdC5vcmcvaW5mcmEvdGlja2V0cy9pc3N1ZXMvbmV3Cg==

--===============3560217245396324116==--