build: `-static-pie` builds no-longer working with CMake

fanquake commented at 3:08 pm on February 11, 2025: member

Using 28.x, it’s easy to produce a -static-pie binary doing:

0# aarch64 alpine, 28.x (32efe850438ef22e2de39e562af557872a402c31)
1make -C depends/ NO_QT=1 NO_WALLET=1 NO_ZMQ=1 NO_USDT=1 NO_UPNP=1 NO_NATPMP=1 LDFLAGS="-static-pie"
2./autogen.sh
3CONFIG_SITE=/bitcoin/depends/aarch64-unknown-linux-musl/share/config.site ./configure
4make src/bitcoind
5# link line
6libtool: link: /usr/bin/ccache g++ -std=c++20 <snip> -fPIE <snip> -pie -static-pie -o bitcoind bitcoind-bitcoind.o ....
7# file src/bitcoind
8src/bitcoind: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), static-pie linked, BuildID[sha1]=b2b5020870722780c89654169ae9e8d21fde955b, with debug_info, not stripped

This no-longer works with master (86528937e5c4da2e12c46085fc41e87ed759258e):

0# aarch64 alpine, master (86528937e5c4da2e12c46085fc41e87ed759258e)
1make -C depends/ NO_QT=1 NO_WALLET=1 NO_ZMQ=1 NO_USDT=1 LDFLAGS="-static-pie"
2cmake -B build --toolchain /bitcoin/depends/aarch64-unknown-linux-musl/toolchain.cmake
3cmake --build build --target bitcoind
4# link line
5/usr/bin/g++ <snip> -static-pie <snip> -fPIE -pie <snip> CMakeFiles/bitcoind.dir/init/bitcoind.cpp.o -o bitcoind  ....
6# file build/src/bitcoind
7build/src/bitcoind: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-musl-aarch64.so.1, BuildID[sha1]=fc952a9ebce3b0627f2b93f0a6011323071ce27a, with debug_info, not stripped

I assumed using something like -DCMAKE_EXE_LINKER_FLAGS would work, but it also does not:

0# aarch64 alpine, master (86528937e5c4da2e12c46085fc41e87ed759258e)
1make -C depends/ NO_QT=1 NO_WALLET=1 NO_ZMQ=1 NO_USDT=1
2cmake -B build --toolchain /bitcoin/depends/aarch64-unknown-linux-musl/toolchain.cmake -DCMAKE_EXE_LINKER_FLAGS="-static-pie"
3cmake --build build --target bitcoind
4# link line
5/usr/bin/g++ <snip> -static-pie <snip> -fPIE -pie <snip> CMakeFiles/bitcoind.dir/init/bitcoind.cpp.o -o bitcoind …
6# file build/src/bitcoind
7build/src/bitcoind: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-musl-aarch64.so.1, BuildID[sha1]=fc952a9ebce3b0627f2b93f0a6011323071ce27a, with debug_info, not stripped

Seems this is due to the linker flag ordering, where -pie is now appearing later on the link line, and nullifying the -static-pie. You can make things work using -DAPPEND_LDFLAGS, but using this (non-standard workaround) shouldn’t be necessary.

fanquake added the label Build system on Feb 11, 2025

fanquake added this to the milestone 29.0 on Feb 12, 2025

hebasto commented at 8:45 am on March 7, 2025: member

You can make things work using -DAPPEND_LDFLAGS, but using this (non-standard workaround) shouldn’t be necessary.

This can be achieved by introducing a dedicated build option, such as ENABLE_STATIC_PIE, if that’s acceptable.

bitcoin deleted a comment on Mar 7, 2025

fanquake commented at 9:11 am on March 7, 2025: member

introducing a dedicated build option, such as ENABLE_STATIC_PIE, if that’s acceptable.

I don’t think so. We shouldn’t have to introduce our own options, to map to compiler options, to workaround CMake issues. This seems like something that needs to be solved in CMake itself.

Sjors commented at 9:45 am on March 7, 2025: member

Same suggestion as #31491 (comment) to document this as a known cmake-migration regression in release notes.

hebasto commented at 5:16 pm on March 7, 2025: member

This seems like something that needs to be solved in CMake itself.

Asked here: https://discourse.cmake.org/t/static-pie-is-incompatible-with-checkpiesupported/13696

hebasto commented at 11:20 am on March 11, 2025: member

This seems like something that needs to be solved in CMake itself.

Asked here: https://discourse.cmake.org/t/static-pie-is-incompatible-with-checkpiesupported/13696

Upstream issue: https://gitlab.kitware.com/cmake/cmake/-/issues/26757.

hebasto added the label Upstream on Mar 11, 2025

hebasto commented at 11:24 am on March 11, 2025: member

You can make things work using -DAPPEND_LDFLAGS, but using this (non-standard workaround) shouldn’t be necessary.

It has been clarified that this is a CMake issue, and we have a workaround for it.

Should this issue still be a blocker for 29.0?

fanquake removed this from the milestone 29.0 on Mar 12, 2025

fanquake commented at 3:08 am on March 12, 2025: member

We’ll just have to use workarounds for 29.x; hopefully CMake will fix it at some point. Somewhat suprising that we are the first to raise the issue, given the -static-pie option has existed in GCC for ~8 years.

build: -static-pie builds no-longer working with CMake #31843

build: `-static-pie` builds no-longer working with CMake #31843