From a9e43625dcf7b67c6d73c97be53fda7f349eecac Mon Sep 17 00:00:00 2001 From: lipengyu Date: Tue, 1 Sep 2026 20:34:45 +0800 Subject: [PATCH 1/5] gh-156764: Fix safety configure option defaults Preserve the default enabled safety configuration while correctly handling enable, disable, and invalid values for both safety options. --- ...-09-01-17-44-34.gh-issue-156764.SF2573.rst | 2 ++ configure | 24 +++++++++---------- configure.ac | 10 ++++++-- 3 files changed, 21 insertions(+), 15 deletions(-) create mode 100644 Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst diff --git a/Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst b/Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst new file mode 100644 index 000000000000000..6b3df56f18ce1e7 --- /dev/null +++ b/Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst @@ -0,0 +1,2 @@ +Fix the default handling of the ``safety`` configure option and the +``--disable-*`` handling of the ``safety`` and ``slower-safety`` options. diff --git a/configure b/configure index 6b560fe6841b722..28575b7da8a7c13 100755 --- a/configure +++ b/configure @@ -10161,15 +10161,14 @@ printf %s "checking for --enable-safety... " >&6; } # Check whether --enable-safety was given. if test ${enable_safety+y} then : - enableval=$enable_safety; if test "x$disable_safety" = xyes -then : - enable_safety=no -else case e in #( - e) enable_safety=yes ;; + enableval=$enable_safety; case $enableval in #( + yes|no) : + enable_safety=$enableval ;; #( + *) : + as_fn_error $? "invalid --enable-safety option: expected \"yes\" or \"no\"" "$LINENO" 5 ;; esac -fi else case e in #( - e) enable_safety=no ;; + e) enable_safety=yes ;; esac fi @@ -10437,13 +10436,12 @@ printf %s "checking for --enable-slower-safety... " >&6; } # Check whether --enable-slower-safety was given. if test ${enable_slower_safety+y} then : - enableval=$enable_slower_safety; if test "x$disable_slower_safety" = xyes -then : - enable_slower_safety=no -else case e in #( - e) enable_slower_safety=yes ;; + enableval=$enable_slower_safety; case $enableval in #( + yes|no) : + enable_slower_safety=$enableval ;; #( + *) : + as_fn_error $? "invalid --enable-slower-safety option: expected \"yes\" or \"no\"" "$LINENO" 5 ;; esac -fi else case e in #( e) enable_slower_safety=no ;; esac diff --git a/configure.ac b/configure.ac index 476f13c82bbb2b9..fef4cab7d835551 100644 --- a/configure.ac +++ b/configure.ac @@ -2595,7 +2595,10 @@ AS_VAR_IF([with_strict_overflow], [yes], AC_MSG_CHECKING([for --enable-safety]) AC_ARG_ENABLE([safety], [AS_HELP_STRING([--enable-safety], [enable usage of the security compiler options with no performance overhead])], - [AS_VAR_IF([disable_safety], [yes], [enable_safety=no], [enable_safety=yes])], [enable_safety=no]) + [AS_CASE([$enableval], + [yes|no], [enable_safety=$enableval], + [AC_MSG_ERROR([invalid --enable-safety option: expected "yes" or "no"])])], + [enable_safety=yes]) AC_MSG_RESULT([$enable_safety]) if test "$enable_safety" = "yes" @@ -2611,7 +2614,10 @@ fi AC_MSG_CHECKING([for --enable-slower-safety]) AC_ARG_ENABLE([slower-safety], [AS_HELP_STRING([--enable-slower-safety], [enable usage of the security compiler options with performance overhead])], - [AS_VAR_IF([disable_slower_safety], [yes], [enable_slower_safety=no], [enable_slower_safety=yes])], [enable_slower_safety=no]) + [AS_CASE([$enableval], + [yes|no], [enable_slower_safety=$enableval], + [AC_MSG_ERROR([invalid --enable-slower-safety option: expected "yes" or "no"])])], + [enable_slower_safety=no]) AC_MSG_RESULT([$enable_slower_safety]) if test "$enable_slower_safety" = "yes" From 26fbd52e3d6389e0ce6b3c120ca965efcf7afb6c Mon Sep 17 00:00:00 2001 From: lipengyu Date: Thu, 15 Oct 2026 11:18:29 +0800 Subject: [PATCH 2/5] update --- Doc/using/configure.rst | 12 +++++------- Doc/whatsnew/3.14.rst | 9 ++++----- .../2026-09-01-17-44-34.gh-issue-156764.SF2573.rst | 4 ++-- configure | 4 ++-- configure.ac | 4 ++-- 5 files changed, 15 insertions(+), 18 deletions(-) diff --git a/Doc/using/configure.rst b/Doc/using/configure.rst index 8b4940ceb9521a7..a0bd6cc6850b6b1 100644 --- a/Doc/using/configure.rst +++ b/Doc/using/configure.rst @@ -1241,13 +1241,12 @@ Security Options The settings ``python`` and *STRING* also set TLS 1.2 as minimum protocol version. -.. option:: --disable-safety +.. option:: --enable-safety - Disable compiler options that are `recommended by OpenSSF`_ for security reasons with no performance overhead. - If this option is not enabled, CPython will be built based on safety compiler options with no slow down. - When this option is enabled, CPython will not be built with the compiler options listed below. + Enable compiler options that are `recommended by OpenSSF`_ for security reasons + with no performance overhead. This option is disabled by default. - The following compiler options are disabled with :option:`!--disable-safety`: + Compiler options enabled with :option:`!--enable-safety` include: * `-fstack-protector-strong`_: Enable run-time checks for stack-based buffer overflows. * `-Wtrampolines`_: Enable warnings about trampolines that require executable stacks. @@ -1261,8 +1260,7 @@ Security Options .. option:: --enable-slower-safety Enable compiler options that are `recommended by OpenSSF`_ for security reasons which require overhead. - If this option is not enabled, CPython will not be built based on safety compiler options which performance impact. - When this option is enabled, CPython will be built with the compiler options listed below. + This option is disabled by default. The following compiler options are enabled with :option:`!--enable-slower-safety`: diff --git a/Doc/whatsnew/3.14.rst b/Doc/whatsnew/3.14.rst index 6e3e6331a1b7e88..a1c25958c39ec26 100644 --- a/Doc/whatsnew/3.14.rst +++ b/Doc/whatsnew/3.14.rst @@ -3148,11 +3148,10 @@ Build changes with :c:expr:`Py_NO_LINK_LIB`. (Contributed by Jean-Christophe Fillion-Robin in :gh:`82909`.) -* CPython now enables a set of recommended compiler options by default - for improved security. - Use the :option:`--disable-safety` :file:`configure` option to disable them, - or the :option:`--enable-slower-safety` option for a larger set - of compiler options, albeit with a performance cost. +* The :option:`--enable-safety` :file:`configure` option enables a set of + recommended compiler options for improved security. The + :option:`--enable-slower-safety` option enables additional compiler options + with a performance cost. Both options are disabled by default. * The ``WITH_FREELISTS`` macro and ``--without-freelists`` :file:`configure` option have been removed. diff --git a/Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst b/Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst index 6b3df56f18ce1e7..3051189fdd88761 100644 --- a/Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst +++ b/Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst @@ -1,2 +1,2 @@ -Fix the default handling of the ``safety`` configure option and the -``--disable-*`` handling of the ``safety`` and ``slower-safety`` options. +Honor ``--disable-safety`` and ``--disable-slower-safety`` without enabling +their compiler options. Both options remain disabled by default. diff --git a/configure b/configure index 28575b7da8a7c13..23240a5453a89a6 100755 --- a/configure +++ b/configure @@ -10154,7 +10154,7 @@ esac fi # Enable flags that warn and protect for potential security vulnerabilities. -# These flags should be enabled by default for all builds. +# These flags are opt-in to avoid additional compiler warnings. { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for --enable-safety" >&5 printf %s "checking for --enable-safety... " >&6; } @@ -10168,7 +10168,7 @@ then : as_fn_error $? "invalid --enable-safety option: expected \"yes\" or \"no\"" "$LINENO" 5 ;; esac else case e in #( - e) enable_safety=yes ;; + e) enable_safety=no ;; esac fi diff --git a/configure.ac b/configure.ac index fef4cab7d835551..06464e93ea49095 100644 --- a/configure.ac +++ b/configure.ac @@ -2590,7 +2590,7 @@ AS_VAR_IF([with_strict_overflow], [yes], [BASECFLAGS="$BASECFLAGS $NO_STRICT_OVERFLOW_CFLAGS"]) # Enable flags that warn and protect for potential security vulnerabilities. -# These flags should be enabled by default for all builds. +# These flags are opt-in to avoid additional compiler warnings. AC_MSG_CHECKING([for --enable-safety]) AC_ARG_ENABLE([safety], @@ -2598,7 +2598,7 @@ AC_ARG_ENABLE([safety], [AS_CASE([$enableval], [yes|no], [enable_safety=$enableval], [AC_MSG_ERROR([invalid --enable-safety option: expected "yes" or "no"])])], - [enable_safety=yes]) + [enable_safety=no]) AC_MSG_RESULT([$enable_safety]) if test "$enable_safety" = "yes" From 0364939a54905dd9a0aa484a778df807a35a5653 Mon Sep 17 00:00:00 2001 From: lipengyu Date: Thu, 15 Oct 2026 11:49:19 +0800 Subject: [PATCH 3/5] update --- Doc/using/configure.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Doc/using/configure.rst b/Doc/using/configure.rst index c1a96cdcfc91598..366cb711eb58c1b 100644 --- a/Doc/using/configure.rst +++ b/Doc/using/configure.rst @@ -1241,7 +1241,7 @@ Security Options The settings ``python`` and *STRING* also set TLS 1.2 as minimum protocol version. -.. option:: --enable-safety +.. option:: --enable-safety, --disable-safety Enable compiler options that are `recommended by OpenSSF`_ for security reasons with no performance overhead. This option is disabled by default. From b14d1d15c258bd4e1f28ff8253fd046e63b0280e Mon Sep 17 00:00:00 2001 From: lipengyu Date: Thu, 15 Oct 2026 12:21:59 +0800 Subject: [PATCH 4/5] update --- Doc/using/configure.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Doc/using/configure.rst b/Doc/using/configure.rst index 2340171b1694a2e..9dc79cea5777d00 100644 --- a/Doc/using/configure.rst +++ b/Doc/using/configure.rst @@ -1290,7 +1290,8 @@ Security Options .. option:: --enable-slower-safety Enable compiler options that are `recommended by OpenSSF`_ for security reasons which require overhead. - This option is disabled by default. + If this option is not enabled, CPython will not be built with safety compiler options that have a performance impact. + When this option is enabled, CPython will be built with the compiler options listed below. The following compiler options are enabled with :option:`!--enable-slower-safety`: From f40d7d4cfc355faf03e9a07fdf8f2ac66da5cf9b Mon Sep 17 00:00:00 2001 From: lipengyu Date: Thu, 15 Oct 2026 22:27:15 +0800 Subject: [PATCH 5/5] update doc --- Doc/tools/removed-ids.txt | 3 +++ Doc/using/configure.rst | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/Doc/tools/removed-ids.txt b/Doc/tools/removed-ids.txt index be3ed35de448554..4e6eb719ed3462a 100644 --- a/Doc/tools/removed-ids.txt +++ b/Doc/tools/removed-ids.txt @@ -45,6 +45,9 @@ tutorial/modules.html: packages-in-multiple-directories # Removed libmpdec using/configure.html: cmdoption-with-system-libmpdec +--disable-safety is the default, documented under --enable-safety +using/configure.html: cmdoption-disable-safety + # Removed APIs library/symtable.html: symtable.Class.get_methods library/sys.html: sys._enablelegacywindowsfsencoding diff --git a/Doc/using/configure.rst b/Doc/using/configure.rst index 9dc79cea5777d00..d821123f4b96ffc 100644 --- a/Doc/using/configure.rst +++ b/Doc/using/configure.rst @@ -1271,7 +1271,7 @@ Security Options The settings ``python`` and *STRING* also set TLS 1.2 as minimum protocol version. -.. option:: --enable-safety, --disable-safety +.. option:: --enable-safety Enable compiler options that are `recommended by OpenSSF`_ for security reasons with no performance overhead. This option is disabled by default.