static-pie {x86_64,aarch64}-linux-gnu builds

CMakeLists.txt

@@ -1055,8 +1055,7 @@ else()
       # this leaves only deps on /c/Windows/system32/*.dll
       set(STATIC_FLAGS "-static")
     elseif (NOT (APPLE OR FREEBSD OR OPENBSD OR DRAGONFLY))
-      # On Linux, we don't support fully static build, but these can be static
-      set(STATIC_FLAGS "-static-libgcc -static-libstdc++")
+      set(STATIC_FLAGS "-static-pie")
     endif()
     set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${STATIC_FLAGS} ")
   endif()

contrib/guix/libexec/build.sh

@@ -184,6 +184,8 @@ esac
 
 # Determine the correct value for -Wl,--dynamic-linker for the current $HOST
 case "$HOST" in
+    x86_64-linux-gnu) ;;
+    aarch64-linux-gnu) ;;
     *linux-gnu*)
         glibc_dynamic_linker=$(
             case "$HOST" in
@@ -220,6 +222,8 @@ esac
 
 # LDFLAGS
 case "$HOST" in
+    x86_64-linux-gnu) HOST_LDFLAGS="-static-libgcc -static-pie -Wl,-O2" ;;
+    aarch64-linux-gnu) HOST_LDFLAGS="-static-libgcc -static-pie -Wl,-O2" ;;
     *linux-gnu*)  HOST_LDFLAGS="-Wl,--as-needed -Wl,--dynamic-linker=$glibc_dynamic_linker -static-libstdc++ -Wl,-O2" ;;
     *mingw*)  HOST_LDFLAGS="-Wl,--no-insert-timestamp" ;;
 esac

contrib/guix/manifest.scm

@@ -90,7 +90,7 @@ chain for " target " development."))
       (home-page (package-home-page xgcc))
       (license (package-license xgcc)))))
 
-(define base-gcc gcc-10)
+(define base-gcc gcc-12)
 (define base-linux-kernel-headers linux-libre-headers-6.1)
 
 (define* (make-monero-cross-toolchain  target
@@ -176,6 +176,37 @@ chain for " target " development."))
                  (("-rpath=") "-rpath-link="))
                #t))))))))
 
+
+(define (glibc-patches glibc)
+  (package-with-extra-patches glibc
+    (search-our-patches "fPIE.patch")))
+
+(define-public glibc-2.35
+  (package
+    (inherit glibc) ;; 2.35
+    (version "2.35")
+    (arguments
+      (substitute-keyword-arguments (package-arguments glibc)
+        ((#:configure-flags flags)
+          `(append ,flags
+            ;; https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html
+            (list "--enable-stack-protector=all",
+                  "--enable-bind-now",
+                  "--disable-werror",
+                  "--enable-fortify-source=2", ;; Need better compiler support for 3?
+                  "--enable-crypt", ;; no-longer built by default, but used by GCC libsanitizer
+                  "--enable-cet=yes",
+                  "--enable-nscd=no",
+                  "--enable-static-nss=yes",
+                  "--enable-static-pie=yes",
+                  building-on)
+            )
+        )
+      )
+    )
+  )
+)
+
 (define-public glibc-2.27
   (package
     (inherit glibc-2.31)
@@ -250,8 +281,8 @@ chain for " target " development."))
         gettext-minimal
         cmake-minimal
         ;; Native GCC 10 toolchain
-        gcc-toolchain-10
-        (list gcc-toolchain-10 "static")
+        gcc-toolchain-12
+        (list gcc-toolchain-12 "static")
         ;; Scripting
         perl
         python-minimal
@@ -263,7 +294,9 @@ chain for " target " development."))
            ;; Windows
            (list (make-mingw-pthreads-cross-toolchain target)))
           ((string-contains target "-linux-gnu")
-           (list (make-monero-cross-toolchain target)))
+           (list (make-monero-cross-toolchain target
+                                               #:base-libc (glibc-patches glibc-2.35)
+                                               #:base-gcc linux-base-gcc)))
           ((string-contains target "freebsd")
            (list clang-toolchain-11 binutils))
           ((string-contains target "darwin")

contrib/guix/patches/fPIE.patch

@@ -0,0 +1,27 @@
+diff --git a/Makeconfig b/Makeconfig
+index 47db08d6ae..0e6edd4640 100644
+--- a/Makeconfig
++++ b/Makeconfig
+@@ -1054,7 +1054,7 @@ pic-ccflag = -fPIC
+ PIC-ccflag = -fPIC
+ endif
+ # This can be changed by a sysdep makefile
+-pie-ccflag = -fpie
++pie-ccflag = -fPIE
+ no-pie-ccflag = -fno-pie
+ # This one should always stay like this unless there is a very good reason.
+ PIE-ccflag = -fPIE
+diff --git a/sysdeps/sparc/Makefile b/sysdeps/sparc/Makefile
+index 12c2c1b085..26b4a84606 100644
+--- a/sysdeps/sparc/Makefile
++++ b/sysdeps/sparc/Makefile
+@@ -1,9 +1,6 @@
+ # The Sparc `long double' is a distinct type we support.
+ long-double-fcts = yes
+ 
+-pie-ccflag = -fPIE
+-no-pie-ccflag = -fno-PIE
+-
+ ifeq ($(subdir),gmon)
+ sysdep_routines += sparc-mcount
+ endif

external/CMakeLists.txt

@@ -39,6 +39,7 @@ find_package(Miniupnpc REQUIRED)
 
 message(STATUS "Using in-tree miniupnpc")
 set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
+set(UPNPC_BUILD_SHARED FALSE CACHE BOOL "Disable shared miniupnp libraries" FORCE)
 add_subdirectory(miniupnp/miniupnpc)
 set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
 set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)