build: libcapnp*.so “warning: GCS is required by -z gcs, but this shared library lacks the necessary property note.” #33556

1. 
   fanquake commented at 9:44 am on October 7, 2025: member

   Building master (919e6d01e93a57d991ed456bc67c43605583ada8) in a Ubuntu 25.10 container (on aarch64), I see:

    0[  1%] Linking CXX executable mpgen
    1/usr/lib/aarch64-linux-gnu/libcapnp-rpc-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
    2/usr/lib/aarch64-linux-gnu/libcapnpc-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
    3/usr/lib/aarch64-linux-gnu/libcapnp-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
    4/usr/lib/aarch64-linux-gnu/libkj-async-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
    5/usr/lib/aarch64-linux-gnu/libkj-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
    6[  1%] Built target mpgen
    7...
    8[  2%] Linking CXX executable mptest
    9/usr/lib/aarch64-linux-gnu/libkj-test-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
   10/usr/lib/aarch64-linux-gnu/libcapnp-rpc-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
   11/usr/lib/aarch64-linux-gnu/libcapnp-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
   12/usr/lib/aarch64-linux-gnu/libkj-async-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
   13/usr/lib/aarch64-linux-gnu/libkj-1.1.0.so: warning: GCS is required by -z gcs, but this shared library lacks the necessary property note. The dynamic loader might not enable GCS or refuse to load the program unless all the shared library dependencies have the GCS marking.
   14[  2%] Built target mptest
   15[  2%] Built target mptests
   

   GCS is Guarded Control Stack: https://www.kernel.org/doc/html/next/arch/arm64/gcs.html.

2. fanquake added the label Build system on Oct 7, 2025
3. 
   fanquake commented at 9:46 am on October 7, 2025: member

   cc @Sjors @ryanofsky.
4. 
   ryanofsky commented at 1:06 pm on October 7, 2025: contributor

   It seems like ideal solution would be to get debian to build capnproto package with GCS, maybe submitting a patch or issue requesting this. There should be no downside to enabling GCS, since it modifies return instructions but is otherwise ABI compatible, and the GCS feature can be turned on and off per thread at runtime. Only difficultly may be that capnproto dependencies (openssl and zlib) will also need to be built with GCS. There’s a debian page at https://wiki.debian.org/ToolChain/GCS with some information but it’s unclear which debian libraries are already using it. It should be possible to check .so files manually with instructions there:

   0$ readelf -n ./hello | grep AArch64
   1Properties: AArch64 feature: BTI, PAC, GCS
   

   There may be changes we want to make to our build system too. The warnings in the description above happen when building mptest and mpgen binaires, and maybe GCS could be disabled for these binaries. Assuming the same warning happen when when building other binaries like bitcoind bitcoin-node and test_bitcoin it’s probably not worth it.

5. 
   fanquake commented at 1:09 pm on October 7, 2025: member

   Assuming the same warning happen when when building other binaries like bitcoind and test_bitcoin it’s probably not worth it.

   There are no other linker warnings for any other binaries.

6. 
   ryanofsky commented at 1:30 pm on October 7, 2025: contributor

   Assuming the same warning happen when when building other binaries like bitcoind and test_bitcoin it’s probably not worth it.

   There are no other linker warnings for any other binaries.

   Sorry was mistaken: there should not be a warning for bitcoind because that is not linked against capnproto. But I would expect warnings to appear when linking bitcoin-node and test_bitcoin. It would be unexpected if make VERBOSE=1 output showed bitcoin-node being linked libcapnp.so but not producing these warning. I think the only possible explanation then would be that binaries like bitcoin-node were being built without GCS, but binaries like mpgen were being built with it? This would seem like something to debug and fix.

Contributors
fanquake ryanofsky

Labels
Build system