glibc: 2.37-39 -> 2.38-0

Announcement: https://sourceware.org/pipermail/libc-alpha/2023-July/150524.html

So far this looks surprisingly good, I managed to build the stdenv
on `aarch64-linux` and got up to building `zfs` and `nix` on `x86_64-linux`.

The patchset is still empty because the latest commit on the release branch is
the one the 2.38 tag points to. I added an empty file though to keep
things consistent.

Also applied the new version of the DT_HASH fix from ArchLinux[1]. This
one's a way easier version than before because it doesn't contain the
autoconf changes, but only hardcodes the desired ld flags. It was
already confirmed that this patch is sufficient to fix the underlying
problem[2].

[1] e54d98e2d1 (7b1bfda0391ff4c2662e04a5e193c37e233a0738)
[2] https://github.com/ValveSoftware/Proton/issues/6051#issuecomment-1666055553

pkgs/development/libraries/glibc/common.nix

@@ -43,9 +43,9 @@
 } @ args:
 
 let
-  version = "2.37";
+  version = "2.38";
-  patchSuffix = "-39";
+  patchSuffix = "-0";
-  sha256 = "sha256-Ilfv8RGhgV109GhW2q9AsBnB5VMVbGnUi6DL/Bu5GkM=";
+  sha256 = "sha256-+4KZiZiyspllRnvBtp0VLpwwfSzzAcnq+0VVt3DvP9I=";
 in
 
 assert withLinuxHeaders -> linuxHeaders != null;
@@ -59,14 +59,14 @@ stdenv.mkDerivation ({
   patches =
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
-          $ git fetch --all -p && git checkout origin/release/2.37/master && git describe
+          $ git fetch --all -p && git checkout origin/release/2.38/master && git describe
-          glibc-2.37-39-g6529a7466c
+          glibc-2.38
-          $ git show --minimal --reverse glibc-2.37.. | gzip -9n --rsyncable - > 2.37-master.patch.gz
+          $ git show --minimal --reverse glibc-2.38.. | gzip -9n --rsyncable - > 2.38-master.patch.gz
 
          To compare the archive contents zdiff can be used.
-          $ zdiff -u 2.37-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.37-master.patch.gz
+          $ zdiff -u 2.38-master.patch.gz ../nixpkgs/pkgs/development/libraries/glibc/2.38-master.patch.gz
        */
-      ./2.37-master.patch.gz
+      ./2.38-master.patch.gz
 
       /* Allow NixOS and Nix to handle the locale-archive. */
       ./nix-locale-archive.patch
@@ -89,10 +89,11 @@ stdenv.mkDerivation ({
 
       ./0001-Revert-Remove-all-usage-of-BASH-or-BASH-in-installed.patch
 
-      /* Patch derived from archlinux (at the time of adding they're at 2.37),
+      /* Patch derived from archlinux,
-         https://github.com/archlinux/svntogit-packages/blob/packages/glibc/trunk/reenable_DT_HASH.patch
+         https://gitlab.archlinux.org/archlinux/packaging/packages/glibc/-/blob/e54d98e2d1aae4930ecad9404ef12234922d9dfd/reenable_DT_HASH.patch
 
-        See https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991 for context.
+         See also https://github.com/ValveSoftware/Proton/issues/6051
+         & https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991
       */
       ./reenable_DT_HASH.patch
     ]
@@ -135,6 +136,7 @@ stdenv.mkDerivation ({
       "--enable-bind-now"
       (lib.withFeatureAs withLinuxHeaders "headers" "${linuxHeaders}/include")
       (lib.enableFeature profilingLibraries "profile")
+      "--enable-fortify-source"
     ] ++ lib.optionals (stdenv.hostPlatform.isx86 || stdenv.hostPlatform.isAarch64) [
       # This feature is currently supported on
       # i386, x86_64 and x32 with binutils 2.29 or later,
@@ -159,7 +161,7 @@ stdenv.mkDerivation ({
       "libc_cv_as_needed=no"
     ]
     ++ lib.optional withGd "--with-gd"
-    ++ lib.optional (!withLibcrypt) "--disable-crypt";
+    ++ lib.optional withLibcrypt "--enable-crypt";
 
   makeFlags = (args.makeFlags or []) ++ [
     "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"

pkgs/development/libraries/glibc/reenable_DT_HASH.patch

@@ -1,145 +1,28 @@
-From e47de5cb2d4dbecb58f569ed241e8e95c568f03c Mon Sep 17 00:00:00 2001
+From 31915e55f9c34f6137ab1c5ac002375a2d5d4589 Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
+From: Frederik Schwan <frederik.schwan@linux.com>
-Date: Fri, 29 Apr 2022 16:37:51 +0200
+Date: Fri, 4 Aug 2023 15:19:57 +0200
-Subject: [PATCH] Do not use --hash-style=both for building glibc shared
+Subject: [PATCH] force --hash-style=both to keep compatibility with old niche
- objects
+ software
 
-The comment indicates that --hash-style=both was used to maintain
-compatibility with static dlopen, but we had many internal ABI
-changes since then, so this compatiblity does not add value anymore.
-
-Reviewed-by: Carlos O'Donell <carlos@redhat.com>
 ---
- Makeconfig     |  9 +++++++++
+ Makeconfig | 4 ++++
- Makerules      |  7 +++++++
+ 1 file changed, 4 insertions(+)
- config.make.in |  1 +
- configure      | 28 ++++++++++++++++++++++++++++
- configure.ac   | 16 ++++++++++++++++
- 5 files changed, 61 insertions(+)
 
-diff --git b/Makeconfig a/Makeconfig
+diff --git a/Makeconfig b/Makeconfig
-index 760f14e92f..0aa5fb0099 100644
+index 77d7fd14df..2ae67c4beb 100644
---- b/Makeconfig
+--- a/Makeconfig
-+++ a/Makeconfig
++++ b/Makeconfig
-@@ -362,6 +362,15 @@ relro-LDFLAGS = -Wl,-z,relro
+@@ -378,6 +378,10 @@ relro-LDFLAGS = -Wl,-z,relro
  LDFLAGS.so += $(relro-LDFLAGS)
  LDFLAGS-rtld += $(relro-LDFLAGS)
  
-+ifeq (yes,$(have-hash-style))
-+# For the time being we unconditionally use 'both'.  At some time we
-+# should declare statically linked code as 'out of luck' and compile
-+# with --hash-style=gnu only.
 +hashstyle-LDFLAGS = -Wl,--hash-style=both
 +LDFLAGS.so += $(hashstyle-LDFLAGS)
 +LDFLAGS-rtld += $(hashstyle-LDFLAGS)
-+endif
 +
- ifeq (no,$(build-pie-default))
+ # Linker options to enable and disable DT_RELR.
- pie-default = $(no-pie-ccflag)
+ ifeq ($(have-dt-relr),yes)
- else # build-pie-default
+ dt-relr-ldflag = -Wl,-z,pack-relative-relocs
-diff --git b/Makerules a/Makerules
-index 354528b8c7..428464f092 100644
---- b/Makerules
-+++ a/Makerules
-@@ -557,6 +557,13 @@ $(common-objpfx)shlib.lds: $(common-objpfx)config.make $(..)Makerules
- 		  -Wl,--verbose 2>/dev/null | \
- 	  sed > $@T \
- 	      -e '/^=========/,/^=========/!d;/^=========/d' \
-+	      $(if $(filter yes,$(have-hash-style)), \
-+		   -e 's/^.*\.gnu\.hash[ 	]*:.*$$/  .note.ABI-tag : { *(.note.ABI-tag) } &/' \
-+		   -e '/^[ 	]*\.hash[ 	]*:.*$$/{h;d;}' \
-+		   -e '/DATA_SEGMENT_ALIGN/{H;g}' \
-+		, \
-+		   -e 's/^.*\.hash[ 	]*:.*$$/  .note.ABI-tag : { *(.note.ABI-tag) } &/' \
-+	       ) \
- 	      -e 's/^.*\*(\.dynbss).*$$/& \
- 		 PROVIDE(__start___libc_freeres_ptrs = .); \
- 		 *(__libc_freeres_ptrs) \
-diff --git b/config.make.in a/config.make.in
-index fff4c78dd0..bf728c71c0 100644
---- b/config.make.in
-+++ a/config.make.in
-@@ -70,6 +70,7 @@ have-libcap = @have_libcap@
- have-cc-with-libunwind = @libc_cv_cc_with_libunwind@
- fno-unit-at-a-time = @fno_unit_at_a_time@
- bind-now = @bindnow@
-+have-hash-style = @libc_cv_hashstyle@
- use-default-link = @use_default_link@
- have-cxx-thread_local = @libc_cv_cxx_thread_local@
- have-loop-to-function = @libc_cv_cc_loop_to_function@
-diff --git b/configure a/configure
-index 716dc041b6..5a730dc5fc 100755
---- b/configure
-+++ a/configure
-@@ -622,6 +622,7 @@ libc_cv_cc_nofma
- libc_cv_mtls_dialect_gnu2
- fno_unit_at_a_time
- libc_cv_has_glob_dat
-+libc_cv_hashstyle
- libc_cv_fpie
- libc_cv_z_execstack
- ASFLAGS_config
-@@ -6193,6 +6194,33 @@ $as_echo "$libc_cv_fpie" >&6; }
- 
- 
- 
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for --hash-style option" >&5
-+$as_echo_n "checking for --hash-style option... " >&6; }
-+if ${libc_cv_hashstyle+:} false; then :
-+  $as_echo_n "(cached) " >&6
-+else
-+  cat > conftest.c <<EOF
-+int _start (void) { return 42; }
-+EOF
-+if { ac_try='${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
-+			    -fPIC -shared -o conftest.so conftest.c
-+			    -Wl,--hash-style=both -nostdlib 1>&5'
-+  { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
-+  (eval $ac_try) 2>&5
-+  ac_status=$?
-+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
-+  test $ac_status = 0; }; }
-+then
-+  libc_cv_hashstyle=yes
-+else
-+  libc_cv_hashstyle=no
-+fi
-+rm -f conftest*
-+fi
-+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $libc_cv_hashstyle" >&5
-+$as_echo "$libc_cv_hashstyle" >&6; }
-+
-+
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GLOB_DAT reloc" >&5
- $as_echo_n "checking for GLOB_DAT reloc... " >&6; }
- if ${libc_cv_has_glob_dat+:} false; then :
-diff --git b/configure.ac a/configure.ac
-index d08ad4d64e..a045f6608e 100644
---- b/configure.ac
-+++ a/configure.ac
-@@ -1360,6 +1360,22 @@ LIBC_TRY_CC_OPTION([-fpie], [libc_cv_fpie=yes], [libc_cv_fpie=no])
- 
- AC_SUBST(libc_cv_fpie)
- 
-+AC_CACHE_CHECK(for --hash-style option,
-+	       libc_cv_hashstyle, [dnl
-+cat > conftest.c <<EOF
-+int _start (void) { return 42; }
-+EOF
-+if AC_TRY_COMMAND([${CC-cc} $CFLAGS $CPPFLAGS $LDFLAGS $no_ssp
-+			    -fPIC -shared -o conftest.so conftest.c
-+			    -Wl,--hash-style=both -nostdlib 1>&AS_MESSAGE_LOG_FD])
-+then
-+  libc_cv_hashstyle=yes
-+else
-+  libc_cv_hashstyle=no
-+fi
-+rm -f conftest*])
-+AC_SUBST(libc_cv_hashstyle)
-+
- AC_CACHE_CHECK(for GLOB_DAT reloc,
- 	       libc_cv_has_glob_dat, [dnl
- cat > conftest.c <<EOF
 -- 
-2.37.1
+2.41.0