{"id":17912832,"url":"https://github.com/luke-jr/full-retpoline","last_synced_at":"2025-10-11T11:10:22.224Z","repository":{"id":143630594,"uuid":"125421000","full_name":"luke-jr/full-retpoline","owner":"luke-jr","description":"Patches and such to build your entire system with retpolines","archived":false,"fork":false,"pushed_at":"2022-12-15T12:04:01.000Z","size":43,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-03T07:14:13.213Z","etag":null,"topics":["compiler","gcc-complier","meltdown","patches","security","spectre"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/luke-jr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-03-15T20:12:15.000Z","updated_at":"2024-01-02T22:21:27.000Z","dependencies_parsed_at":null,"dependency_job_id":"40e909c5-6da2-497c-bc14-774e0e68ec0e","html_url":"https://github.com/luke-jr/full-retpoline","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/luke-jr/full-retpoline","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luke-jr%2Ffull-retpoline","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luke-jr%2Ffull-retpoline/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luke-jr%2Ffull-retpoline/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luke-jr%2Ffull-retpoline/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/luke-jr","download_url":"https://codeload.github.com/luke-jr/full-retpoline/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/luke-jr%2Ffull-retpoline/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279007031,"owners_count":26084226,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-11T02:00:06.511Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["compiler","gcc-complier","meltdown","patches","security","spectre"],"created_at":"2024-10-28T19:47:19.801Z","updated_at":"2025-10-11T11:10:22.204Z","avatar_url":"https://github.com/luke-jr.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"These patches enable and help enforce building your entire system with retpolines.\nIt is designed for Gentoo, but may be useful on other built-from-source systems as well.\n\nNote that this is *intentionally* excessive: certain compile flags are enabled that may very well be unnecessary.\nIn particular, -O0 and -Og will throw an error by default.\n\nThere are many things still missing to get a 100% retpoline'd system.\nIf you'd like to help out, please read [the TODO file](TODO.md) and open issues and pull requests as appropriate.\n\n# GCC: Usage, caution\n\nThe GCC patches enable all retpolines by default, and modifies the defaults for other CFLAGS that are suspected at taking away from its protections.\nIt also tries to prevent changing these defaults without also explicitly disabling the retpolines:\n-O1, -fearly-inlining (upstream default), -fgcse (enabled in -O2 upstream), -fgcse-lm (upstream default), -finline (upstream default), and -finline-small-functions (enabled in -O2 upstream).\n-Og is also prevented.\n\nSince common CFLAGS are prohibited, this can cause problems with some build systems, especially ones that test availability of certain features with an unnecessary -O0 flag (they may assume the feature in question is not present, rather than aborting the build).\n\nFor this reason, forbidden CFLAGS do not cause GCC to abort.\nInstead, it sends itself SIGSTOP to freeze the process, and puts a message in the syslog.\n(I recommend configuring your syslog to alert you to such messages so you know it is waiting on your interaction.)\nAt that point, you may either permit it to continue by sending SIGCONT, or you can send SIGKILL to forcefully terminate it (as a failure).\n\nYou can disable CFLAGS limitations entirely by setting LJR_BYPASS_RETPOLINE=1 in the environment.\n\n# libgcrypt\n\nlibgcrypt by default builds the Jitter 100% software RNG.\nThe upstream author cautions that the RNG must be compiled without optimisations, or will be insecure (low entropy).\nFor this reason, libgcrypt is patched to entirely disable the Jitter RNG by default.\n\n# libgpg-error\n\nFor unknown reasons, a build-time tool `mkheader` was compiled with -O0.\nIt seems fairly safe to let it get optimised, so the patch simply removes -O0.\n\n# Linux kernel\n\nTo build a kernel, add a GNUmakefile with (adjust the path to this git repo):\n\n```\nCROSS_COMPILE=/path/to/gcc-no-retpoline/x86_64-pc-linux-gnu-no-retpoline-\ninclude Makefile\n```\n\nNOTE: If you were using the older steps for the kernel, be sure to *remove* the patch!\n\nThis will effectively undo the main changes of this patch for the kernel's build system.\nSince the kernel has its own retpoline support, this should be safe.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fluke-jr%2Ffull-retpoline","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fluke-jr%2Ffull-retpoline","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fluke-jr%2Ffull-retpoline/lists"}