[5.8][build] Remove runpath from build host from shared ICU libraries on linux #65692
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherrypick of #64365
Explanation: I found this
--enable-rpath
flag in a hurry more than a year ago and suggested it before the branch in #40340, but was unaware it also adds an absolute runpath to the CI install directory:This is a deployment security risk, as these libraries are linked by Foundation, and thus is worth fixing in the current 5.8 release branch.
Scope: Only affects these libicu runpaths on ELF platforms like linux
Issue: None
Risk: low, as it only affects libicu runpaths for ELF platforms
Testing: Passed all CI, and we've had no problems since it was merged into trunk/5.9 a couple months ago.
Reviewer: @bnbarham
@tomerd, would be good to get this in before the next patch release.