glibc: Enable OpenSSF hardening, but w/o strict binding

[dannf]

Just for testing at the moment.

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

• Detected Error:

terminate called after throwing an instance of 'PAL_SEHException'
/home/build/installer/eng/common/tools.sh: line 474: 290 Aborted (core dumped)

• Error Category: Build Configuration

• Failure Point:
During .NET SDK bootstrapping process when running ./build.sh

• Root Cause Analysis:
The PAL_SEHException typically occurs in .NET Core's Platform Abstraction Layer (PAL) when there are issues with system compatibility or memory handling. This is often related to core dumps on Linux systems when building .NET from source.

• Suggested Fix:

1. Add memory ulimits to the build environment:

environment:
  contents:
    packages:
      # existing packages...
    options:
      ulimit:
        memlock: -1
        stack: 65532000

2. Add additional system libraries:

environment:
  contents:
    packages:
      # Add these to existing packages
      - libstdc++-dev
      - gcc-libs
      - procps

3. Add environment variables:

pipeline:
  - uses: git-checkout
    # existing checkout config...
  
  - working-directory: /home/build/installer
    environment:
      COMPlus_EnableDiagnostics: 0
      DOTNET_CLI_TELEMETRY_OPTOUT: 1
      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
    runs: |
      ./build.sh /p:ArcadeBuildTarball=true /p:TarballDir=/home/build/src

• Explanation:
The PAL_SEHException often occurs due to memory constraints or system compatibility issues. The fix addresses this by:

• Setting appropriate ulimits for memory operations
• Adding necessary system libraries for .NET core building
• Disabling diagnostics and telemetry that might interfere with the build
• Ensuring proper runtime environment variables are set

• Additional Notes:

• This is a known issue when building .NET Core from source on Linux systems
• The error typically appears during the bootstrap phase of the build
• Memory requirements for .NET builds can be substantial

• References:

• Implement MIPS64 RID dotnet/runtime#42194
• [release/6.0.1xx] Update dependencies from dotnet/source-build-reference-packages dotnet/installer#12845
• https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-environment-variables