build: -static-pie builds no-longer working with CMake #31843

1. 
   fanquake commented at 3:08 pm on February 11, 2025: member

   Using 28.x, it’s easy to produce a -static-pie binary doing:

   0# aarch64 alpine, 28.x (32efe850438ef22e2de39e562af557872a402c31)
   1make -C depends/ NO_QT=1 NO_WALLET=1 NO_ZMQ=1 NO_USDT=1 NO_UPNP=1 NO_NATPMP=1 LDFLAGS="-static-pie"
   2./autogen.sh
   3CONFIG_SITE=/bitcoin/depends/aarch64-unknown-linux-musl/share/config.site ./configure
   4make src/bitcoind
   5# link line
   6libtool: link: /usr/bin/ccache g++ -std=c++20 <snip> -fPIE <snip> -pie -static-pie -o bitcoind bitcoind-bitcoind.o ....
   7# file src/bitcoind
   8src/bitcoind: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), static-pie linked, BuildID[sha1]=b2b5020870722780c89654169ae9e8d21fde955b, with debug_info, not stripped
   

   This no-longer works with master (86528937e5c4da2e12c46085fc41e87ed759258e):

   0# aarch64 alpine, master (86528937e5c4da2e12c46085fc41e87ed759258e)
   1make -C depends/ NO_QT=1 NO_WALLET=1 NO_ZMQ=1 NO_USDT=1 LDFLAGS="-static-pie"
   2cmake -B build --toolchain /bitcoin/depends/aarch64-unknown-linux-musl/toolchain.cmake
   3cmake --build build --target bitcoind
   4# link line
   5/usr/bin/g++ <snip> -static-pie <snip> -fPIE -pie <snip> CMakeFiles/bitcoind.dir/init/bitcoind.cpp.o -o bitcoind  ....
   6# file build/src/bitcoind
   7build/src/bitcoind: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-musl-aarch64.so.1, BuildID[sha1]=fc952a9ebce3b0627f2b93f0a6011323071ce27a, with debug_info, not stripped
   

   I assumed using something like -DCMAKE_EXE_LINKER_FLAGS would work, but it also does not:

   0# aarch64 alpine, master (86528937e5c4da2e12c46085fc41e87ed759258e)
   1make -C depends/ NO_QT=1 NO_WALLET=1 NO_ZMQ=1 NO_USDT=1
   2cmake -B build --toolchain /bitcoin/depends/aarch64-unknown-linux-musl/toolchain.cmake -DCMAKE_EXE_LINKER_FLAGS="-static-pie"
   3cmake --build build --target bitcoind
   4# link line
   5/usr/bin/g++ <snip> -static-pie <snip> -fPIE -pie <snip> CMakeFiles/bitcoind.dir/init/bitcoind.cpp.o -o bitcoind …
   6# file build/src/bitcoind
   7build/src/bitcoind: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-musl-aarch64.so.1, BuildID[sha1]=fc952a9ebce3b0627f2b93f0a6011323071ce27a, with debug_info, not stripped
   

   Seems this is due to the linker flag ordering, where -pie is now appearing later on the link line, and nullifying the -static-pie. You can make things work using -DAPPEND_LDFLAGS, but using this (non-standard workaround) shouldn’t be necessary.

2. fanquake added the label Build system on Feb 11, 2025
3. fanquake added this to the milestone 29.0 on Feb 12, 2025

Contributors
fanquake

Labels
Build system

Milestone
29.0