2026-04-09T21:49:04+0200 Theo Buehler <tb@theobuehler.org>:
> As jtt found when testing my zizmor port, aws-lc-sys is not xonly clean
> on amd64 and the s2n asm needs a lot of patching nowadays:
> 
> https://github.com/awslabs/s2n-bignum/pull/242
> 
> The funny thing is that I was aware of this at some point since I wrote
> patches for deno, but I completely forgot. I guess I'm getting old...
> 
> Anyway: take the easy way out and use noexeconly on amd64. arm64 is fine
> and there's currently no riscv64 asm.
> 
> Repro on modern enough amd64 (needs PKU in the cpu0 line):
> $ mkdir test && cd test && uv init && uv add kyber # segfault

I tested this and can confirm it fixes the segfaults on my machine.
Ok jtt@.

> PS: Not a good moment to change this, but why do we have -arch
> suffixes for USE_NOBTCFI but not USE_NOEXECONLY?