From 5568f9d1816619d80b551be72e8df9f37f54ce5e Mon Sep 17 00:00:00 2001 From: uazo Date: Wed, 3 Apr 2024 15:42:59 +0000 Subject: [PATCH] AUTOMATED - update patch docs --- docs/PATCHES.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/PATCHES.md b/docs/PATCHES.md index 02ec7e987..d71c12ebc 100644 --- a/docs/PATCHES.md +++ b/docs/PATCHES.md @@ -132,6 +132,8 @@ |**Do not link with libatomic**
Tue, 11 Jan 2022 13:59:32 +0000
File: [Do-not-link-with-libatomic.patch](/build/patches/Do-not-link-with-libatomic.patch)
Author: uazo
Context:
License: GPL-3.0-only |Compiler has built-in support thus libatomic linking is no more needed
This patch allows building with use_sysroot=false| |**Do not store passwords by default**
Wed, 11 Oct 2017 23:17:17 +0200
File: [Do-not-store-passwords-by-default.patch](/build/patches/Do-not-store-passwords-by-default.patch)
Author: csagan5
Context:
License: GPL-3.0-only || |**DoH improvements**
Sat, 26 Sep 2020 14:23:19 +0100
File: [DoH-improvements.patch](/build/patches/DoH-improvements.patch)
Author: csagan5
Context:
License: GPL-3.0-only |Enable secure mode by default
Always enforce DoH even with inconsistent system DNS configuration| +|**Emoji Fonts fingerprinting mitigation 01-02**
Wed, 3 Apr 2024 13:32:27 +0000
File: [Emoji-Fonts-fingerprinting-mitigation-01-02.patch](/build/patches/Emoji-Fonts-fingerprinting-mitigation-01-02.patch)
Author: uazo
Context:
License: GPL-2.0-or-later |Replaces the platform emoji font with the one embedded in the apk.
Require: Fonts-fingerprinting-mitigation.patch| +|**Emoji Fonts fingerprinting mitigation 02-02**
Wed, 3 Apr 2024 13:32:42 +0000
File: [Emoji-Fonts-fingerprinting-mitigation-02-02.patch](/build/patches/Emoji-Fonts-fingerprinting-mitigation-02-02.patch)
Author: uazo
Context:
License: GPL-2.0-or-later |Replaces the platform emoji font with the one embedded in the apk.
Part two: resources data only.| |**Enable -fwrapv in Clang for non-UBSan builds**
Thu, 22 Dec 2016 07:15:34 -0500
File: [Enable-fwrapv-in-Clang-for-non-UBSan-builds.patch](/build/patches/Enable-fwrapv-in-Clang-for-non-UBSan-builds.patch)
Author: Daniel
Context:
License: GPL-3.0-only |Using -fwrapv (notably only when not using signed integer overflow checking -
since it will override it and result in not performing checks) is just common
sense since it eliminates the chance of security vulnerabilities being
introduced by optimizations based on signed overflow being undefined.
That has happened before, and those optimizations don't even add up to a 0.1%
performance increase for this kind of software. It's not worth having.
The Linux kernel passes -fwrapv and also -fno-strict-aliasing to disable those
dangerous optimizations (since there is so much incorrect code they can break).
In fact, it is easy to point to dozens of known examples of invalid code that
could potentially be broken by those optimizations.
It is not acceptable for projects to be using optimizations that are known to
be broken with a bunch of code in their tree.
They put barely any effort into even fixing the known cases.
Chromium has blacklists for UBSan for 'false positives' (none of which are
actually false positives, but rather "undefined, but not a bug beyond
potentially being broken by optimizations or even code generation without
them") and also for components too full of these bugs for them to currently
want to bother with it. That includes a bunch of signed overflow issues
(there is sadly no detection for aliasing violations, which are fairly common,
but not that common).
Ideally, -fwrapv could be always passed, but unfortunately the way it is
implemented has silly interactions with other switches.
The reason it would still make sense to pass it is because due to their UBSan
blacklists, they get far from full coverage with it, so -fwrapv would still
be better than nothing where it's not being used.
Since -fwrapv makes signed integer overflow well-defined, Clang will disable
the UBSan checks for signed integer overflow, including in the
production-oriented trapping mode used for hardening.
Excerpt from https://github.com/bromite/bromite/issues/226| |**Enable Android Dynamic Performance Framework**
Wed, 23 Aug 2023 13:49:19 +0000
File: [Enable-Android-Dynamic-Performance-Framework.patch](/build/patches/Enable-Android-Dynamic-Performance-Framework.patch)
Author: uazo
Context:
License: GPL-2.0-or-later || |**Enable Certificate Transparency**
Fri, 10 Jun 2022 14:20:02 +0200
File: [Enable-Certificate-Transparency.patch](/build/patches/Enable-Certificate-Transparency.patch)
Author: csagan5
Context:
License: GPL-3.0-only |Reporting/auditing functionalities are disabled; a flag is exposed.
Add guard to make sure that certificate transparency stays enabled
by default.|