René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"3.15.0a1 rewrites sysconfig-saved flags on `make install`","articleBody":"# Bug report\n\n### Bug description:\n\nIn Fedora, we have built the Python 3.15.0a1 release as we normally do. It results in broken sysconfig flags that prevent building 3rd-party extension modules.\n\nThere are some RPM-specific CFLAGS and LDFLAGS that we use to build Python, but we don't want them exposed to our users via sysconfig because it would break their build. One of such flags is `-specs=/usr/lib/rpm/redhat/redhat-package-notes`, but there are others. When such flags are used outside of RPM build, it fails:\n\n```\n$ git clone https://github.com/fedora-python/crypt_r.git \u0026\u0026 cd crypt_r\n$ tox -e py315\n...\n      building '_crypt_r' extension\n      creating build/temp.linux-x86_64-cpython-315/src\n      gcc -Werror=incompatible-pointer-types -fPIC -I/home/churchyard/.cache/uv/builds-v0/.tmpPUr6Gz/include -I/usr/include/python3.15 -c src/_crypt_r.c -o build/temp.linux-x86_64-cpython-315/src/_crypt_r.o\n      gcc -shared -Wl,-z,relro -Wl,--as-needed -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1\n      -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes -Werror=incompatible-pointer-types build/temp.linux-x86_64-cpython-315/src/_crypt_r.o -L/usr/lib64 -lcrypt -o\n      build/lib.linux-x86_64-cpython-315/_crypt_r.cpython-315-x86_64-linux-gnu.so\n...\n      gcc: fatal error: environment variable ‘RPM_ARCH’ not defined\n      compilation terminated.\n      error: command '/usr/bin/gcc' failed with exit code 1\n```\n\nThat's why we set those flags in the CFLAGS_NODIST, LDFLAGS_NODIST only. However:\n\n```\n$ python3.15\n...\n\u003e\u003e\u003e for k, v in sysconfig.get_config_vars().items():\n...     if '-specs=/usr/lib/rpm/redhat/redhat-package-notes' in str(v):\n...         print(k, v)\n...         \nBLDSHARED gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes\nCONFIGURE_LDFLAGS_NODIST -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g  -fno-semantic-interposition -flto -fuse-linker-plugin -ffat-lto-objects -g\nLDCXXSHARED g++ -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes\nLDFLAGS -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes\nLDSHARED gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes\nPY_CORE_LDFLAGS -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g  -fno-semantic-interposition -flto -fuse-linker-plugin -ffat-lto-objects -g\nPY_LDFLAGS -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes\nPY_LDFLAGS_NODIST -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g  -fno-semantic-interposition -flto -fuse-linker-plugin -ffat-lto-objects -g\nPY_LDFLAGS_NOLTO -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes -fno-lto\n```\n\nCompare with:\n\n```\n$ python3.14\n...\n\u003e\u003e\u003e for k, v in sysconfig.get_config_vars().items():\n...     if '-specs=/usr/lib/rpm/redhat/redhat-package-notes' in str(v):\n...         print(k, v)\n...         \nCONFIGURE_LDFLAGS_NODIST -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g  -fno-semantic-interposition -flto -fuse-linker-plugin -ffat-lto-objects -g\nPY_CORE_LDFLAGS -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g  -fno-semantic-interposition -flto -fuse-linker-plugin -ffat-lto-objects -g -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g\nPY_LDFLAGS_NODIST -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g  -fno-semantic-interposition -flto -fuse-linker-plugin -ffat-lto-objects -g -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g\nPY_LDFLAGS_NOLTO -fno-lto -Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g\n```\n\nI was not yet able to reproduce this behavior outside of our RPM build of Python, which makes bisecting this harder. We set the flags like this:\n\n```\n+ CFLAGS='-fcf-protection -fexceptions '\n+ export 'CFLAGS_NODIST= -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer  -D_GNU_SOURCE -fPIC -fwrapv'\n+ CFLAGS_NODIST=' -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer  -D_GNU_SOURCE -fPIC -fwrapv'\n+ export 'CXXFLAGS=-fcf-protection -fexceptions '\n+ CXXFLAGS='-fcf-protection -fexceptions '\n++ pkg-config --cflags-only-I libffi\n+ export CPPFLAGS=\n+ CPPFLAGS=\n+ export 'OPT=-fcf-protection -fexceptions '\n+ OPT='-fcf-protection -fexceptions '\n++ pkg-config --cflags openssl\n+ export 'CFLAGS=-fcf-protection -fexceptions  '\n+ CFLAGS='-fcf-protection -fexceptions  '\n++ pkg-config --libs-only-L openssl\n+ export 'LDFLAGS= '\n+ LDFLAGS=' '\n++ pkg-config --libs-only-L openssl\n+ export 'LDFLAGS_NODIST=-Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g '\n+ LDFLAGS_NODIST='-Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  -g '\n...\n+ /builddir/build/BUILD/python3.15-3.15.0_a1-build/Python-3.15.0a1/configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --runstatedir=/run --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --with-platlibdir=lib64 --enable-ipv6 --enable-shared --with-computed-gotos=yes --with-dbmliborder=gdbm:ndbm:bdb --with-system-expat --with-system-libmpdec --enable-loadable-sqlite-extensions --with-dtrace --with-lto --with-ssl-default-suites=openssl --without-static-libpython --with-wheel-pkg-dir=/usr/share/python-wheels --with-valgrind --without-ensurepip --enable-experimental-jit=yes-off --enable-optimizations\n...\n+ /usr/bin/make -O -j32 V=1 VERBOSE=1 EXTRA_CFLAGS=-O3 'CFLAGS_NODIST= -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer  -D_GNU_SOURCE -fPIC -fwrapv -O3' regen-all PYTHON_FOR_REGEN=python3.15\n...\n+ /usr/bin/make -O -j32 V=1 VERBOSE=1 EXTRA_CFLAGS=-O3 'CFLAGS_NODIST= -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer  -D_GNU_SOURCE -fPIC -fwrapv -O3'\n```\n\nNow I'm trying to see if reverting https://github.com/python/cpython/commit/9e3542a6c26a849012216f5f754f16043d775c42 makes a difference.\n\n### CPython versions tested on:\n\n3.15\n\n### Operating systems tested on:\n\nLinux\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-140491\n* gh-140823\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/hroncok","@type":"Person","name":"hroncok"},"datePublished":"2025-10-22T13:30:52.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":21},"url":"https://github.com/140454/cpython/issues/140454"}