GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-112301: Update disable safety and enable slow safety configure options documentation by nohlson · Pull Request #122758 · python/cpython

Conversation

nohlson commented Aug 6, 2024 •

edited by github-actions Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

These changes add more information to docs related to the new configure options --disable-safety and --enable-slow-safety. Links in docs point directly to the OpenSSF guidance for particular compiler options suggested in this comment.

Issue: Consider applying flags for warnings about potential security issues #112301

📚 Documentation preview 📚: https://cpython-previews--122758.org.readthedocs.build/

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nohlson added 2 commits

August 6, 2024 16:36


          Update disable safety and enable slow safety options in docs

f33e964


          Make option names the link

67f3faf

nohlson requested review from corona10 and erlend-aasland as code owners

August 6, 2024 21:48

bedevere-app Bot mentioned this pull request

Aug 6, 2024

Consider applying flags for warnings about potential security issues #112301

Closed

bedevere-app Bot added docs

Documentation in the Doc dir

skip news awaiting review labels

Aug 6, 2024

AA-Turner reviewed

Aug 7, 2024

View reviewed changes

Comment thread

Doc/using/configure.rst Outdated

		@@ -911,17 +911,31 @@ Security Options

		Disable compiler options that are recommended by `OpenSSF`_ for security reasons with no performance overhead.

AA-Turner Aug 7, 2024

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

	Disable compiler options that are recommended by `OpenSSF`_ for security reasons with no performance overhead.
	Disable compiler options that are `recommended by OpenSSF`_ for security reasons with no performance overhead.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nohlson Aug 7, 2024

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expanded link text

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Doc/using/configure.rst Outdated

		* `-fstack-protector-strong`_: Enable run-time checks for stack-based buffer overflows.
		* `-Wtrampolines`_: Enable warnings about trampolines that require executable stacks.

		.. _OpenSSF: https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md

AA-Turner Aug 7, 2024

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

	.. _OpenSSF: https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md
	.. _recommended by OpenSSF: https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nohlson Aug 7, 2024

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed link text

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Doc/using/configure.rst Outdated

		When this option is enabled, CPython will not be built with the compiler options listed below.

		.. _OpenSSF: https://openssf.org/
		Compiler options that are disabled with this option:

AA-Turner Aug 7, 2024

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

	Compiler options that are disabled with this option:
	The following compiler options are disabled with :option:`!--disable-safety`:

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nohlson Aug 7, 2024

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-worded sentence

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Doc/using/configure.rst Outdated

		If this option is not enabled, CPython will not be built based on safety compiler options which performance impact.
		When this option is enabled, CPython will be built with the compiler options listed below.

		Compiler options that are enabled with this option:

AA-Turner Aug 7, 2024

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

	Compiler options that are enabled with this option:
	The following compiler options are enabled with :option:`!--enable-slower-safety`:

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nohlson Aug 7, 2024

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-worded sentence

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Doc/using/configure.rst Outdated

		* `-D_FORTIFY_SOURCE=3`_: Fortify sources with compile- and run-time checks for unsafe libc usage and buffer overflows.

		.. _OpenSSF: https://openssf.org/
		.. _OpenSSF: https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md

AA-Turner Aug 7, 2024

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You don't need to (and shouldn't) redefine link targets in the same document

Suggested change

.. _OpenSSF: https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nohlson Aug 7, 2024

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed superfluous link

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Doc/using/configure.rst Outdated


		.. option:: --enable-slower-safety

		Enable compiler options that are recommended by `OpenSSF`_ for security reasons which require overhead.

AA-Turner Aug 7, 2024

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

	Enable compiler options that are recommended by `OpenSSF`_ for security reasons which require overhead.
	Enable compiler options that are `recommended by OpenSSF`_ for security reasons which require overhead.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nohlson Aug 7, 2024

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expanded link text

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Re-word some sentences for clarity

6875a68

corona10 reviewed

Aug 7, 2024

View reviewed changes

corona10 left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we introduce the options here, too? or separate PR?
https://github.com/python/cpython/blob/main/Doc/whatsnew/3.14.rst

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

corona10 approved these changes

Aug 8, 2024

View reviewed changes

corona10 left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm from the view of non-native speaker :)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

bedevere-app Bot added awaiting merge and removed awaiting review labels

Aug 8, 2024

nohlson commented Aug 8, 2024

Copy link

Copy Markdown

Contributor Author

Can we introduce the options here, too? or separate PR? https://github.com/python/cpython/blob/main/Doc/whatsnew/3.14.rst

We could probably do a separate PR. We will be enabling strictly warning options once the devguide is updated that can be included there as well.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

AA-Turner merged commit aab18f4 into python:main

Aug 8, 2024

bedevere-app Bot removed the awaiting merge label

Aug 8, 2024

AA-Turner commented Aug 8, 2024

Copy link

Copy Markdown

Member

@nohlson does this need backports?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

nohlson commented Aug 8, 2024

Copy link

Copy Markdown

Contributor Author

@nohlson does this need backports?

A

No we do not need to backport these changes

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

blhsing pushed a commit to blhsing/cpython that referenced this pull request

Aug 22, 2024


          pythongh-112301: Update documentation for configure options (``--disa…

441e113

…ble-safety`` and ``--enable-slower-safety``) (python#122758)

Co-authored-by: Adam Turner <[email protected]>

Reviewers

AA-Turner

AA-Turner left review comments

corona10

corona10 approved these changes

erlend-aasland

Awaiting requested review from erlend-aasland

erlend-aasland is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

docs

Documentation in the Doc dir

skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

Conversation

nohlson commented Aug 6, 2024 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

corona10 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

corona10 left a comment

Choose a reason for hiding this comment

Uh oh!

nohlson commented Aug 8, 2024

Uh oh!

AA-Turner commented Aug 8, 2024

Uh oh!

nohlson commented Aug 8, 2024

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nohlson commented Aug 6, 2024 •

edited by github-actions Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

corona10 left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.