This package currently fails to build (at least on the amd64
architecture) with link time optimizations enabled.  For a background
for LTO please see

https://wiki.debian.org/ToolChain/LTO

The goal is to enable this optimization by default in an upcoming
Debian release in dpkg-buildflags for 64bit architectures.  The goal
is to get this package to build with link time optimizations, or to
explicitly disable link time optimizations for this package build.

To reproduce the build failure, enable the lto optimization in
testing/unstable by adding "optimize=+lto" to DEB_BUILD_MAINT_OPTIONS
in the debian/rules file, or if this macro is unset, just set it:

export DEB_BUILD_MAINT_OPTIONS = optimize=+lto

Please try to fix the build with lto enabled, fixing the packaging or
forwarding the issue upstream. If the issue cannot be fixed,
explicitly disallow building the package with lto by adding to your
rules file:

export DEB_BUILD_MAINT_OPTIONS = optimize=-lto

or adding that string to your existing setting of DEB_BUILD_MAINT_OPTIONS.

The full build log can be found at:
http://qa-logs.debian.net/2022/06/09/dpkglto/mbedtls_2.28.0-2_unstable_dpkglto.log
The last lines of the build log are at the end of this report.

[...]
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedx509_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedx509.dir/certs.c.o -MF CMakeFiles/mbedx509.dir/certs.c.o.d -o CMakeFiles/mbedx509.dir/certs.c.o -c /<<PKGBUILDDIR>>/library/certs.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedx509_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedx509.dir/x509.c.o -MF CMakeFiles/mbedx509.dir/x509.c.o.d -o CMakeFiles/mbedx509.dir/x509.c.o -c /<<PKGBUILDDIR>>/library/x509.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedx509_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedx509.dir/x509_crl.c.o -MF CMakeFiles/mbedx509.dir/x509_crl.c.o.d -o CMakeFiles/mbedx509.dir/x509_crl.c.o -c /<<PKGBUILDDIR>>/library/x509_crl.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedx509_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedx509.dir/x509_crt.c.o -MF CMakeFiles/mbedx509.dir/x509_crt.c.o.d -o CMakeFiles/mbedx509.dir/x509_crt.c.o -c /<<PKGBUILDDIR>>/library/x509_crt.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedx509_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedx509.dir/x509_csr.c.o -MF CMakeFiles/mbedx509.dir/x509_csr.c.o.d -o CMakeFiles/mbedx509.dir/x509_csr.c.o -c /<<PKGBUILDDIR>>/library/x509_csr.c
make[3]: Leaving directory '/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu'
[ 39%] Building C object library/CMakeFiles/mbedx509.dir/x509write_crt.c.o
[ 39%] Built target mbedtls_static
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedx509_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedx509.dir/x509write_crt.c.o -MF CMakeFiles/mbedx509.dir/x509write_crt.c.o.d -o CMakeFiles/mbedx509.dir/x509write_crt.c.o -c /<<PKGBUILDDIR>>/library/x509write_crt.c
[ 39%] Building C object library/CMakeFiles/mbedx509.dir/x509write_csr.c.o
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedx509_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedx509.dir/x509write_csr.c.o -MF CMakeFiles/mbedx509.dir/x509write_csr.c.o.d -o CMakeFiles/mbedx509.dir/x509write_csr.c.o -c /<<PKGBUILDDIR>>/library/x509write_csr.c
[ 39%] Linking C shared library libmbedx509.so
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cmake -E cmake_link_script CMakeFiles/mbedx509.dir/link.txt --verbose=1
/usr/bin/cc -fPIC -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -Wl,-z,deb-canary-92a0e7a415d64ebafcb16a8ca817cde4 -flto=auto -ffat-lto-objects -Wl,-z,relro -Wl,-z,now -shared -Wl,-soname,libmbedx509.so.1 -o libmbedx509.so.2.28.0 CMakeFiles/mbedx509.dir/certs.c.o CMakeFiles/mbedx509.dir/pkcs11.c.o CMakeFiles/mbedx509.dir/x509.c.o CMakeFiles/mbedx509.dir/x509_create.c.o CMakeFiles/mbedx509.dir/x509_crl.c.o CMakeFiles/mbedx509.dir/x509_crt.c.o CMakeFiles/mbedx509.dir/x509_csr.c.o CMakeFiles/mbedx509.dir/x509write_crt.c.o CMakeFiles/mbedx509.dir/x509write_csr.c.o  -Wl,-rpath,"\$ORIGIN:" libmbedcrypto.so.2.28.0
/usr/bin/ld: warning: -z deb-canary-92a0e7a415d64ebafcb16a8ca817cde4 ignored
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cmake -E cmake_symlink_library libmbedx509.so.2.28.0 libmbedx509.so.1 libmbedx509.so
make[3]: Leaving directory '/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu'
[ 39%] Built target mbedx509
make  -f library/CMakeFiles/mbedtls.dir/build.make library/CMakeFiles/mbedtls.dir/depend
make[3]: Entering directory '/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu'
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu && /usr/bin/cmake -E cmake_depends "Unix Makefiles" /<<PKGBUILDDIR>> /<<PKGBUILDDIR>>/library /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library/CMakeFiles/mbedtls.dir/DependInfo.cmake --color=
make[3]: Leaving directory '/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu'
make  -f library/CMakeFiles/mbedtls.dir/build.make library/CMakeFiles/mbedtls.dir/build
make[3]: Entering directory '/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu'
[ 40%] Building C object library/CMakeFiles/mbedtls.dir/net_sockets.c.o
[ 40%] Building C object library/CMakeFiles/mbedtls.dir/ssl_cache.c.o
[ 40%] Building C object library/CMakeFiles/mbedtls.dir/debug.c.o
[ 41%] Building C object library/CMakeFiles/mbedtls.dir/ssl_cookie.c.o
[ 41%] Building C object library/CMakeFiles/mbedtls.dir/ssl_cli.c.o
[ 41%] Building C object library/CMakeFiles/mbedtls.dir/ssl_ciphersuites.c.o
[ 41%] Building C object library/CMakeFiles/mbedtls.dir/ssl_srv.c.o
[ 41%] Building C object library/CMakeFiles/mbedtls.dir/ssl_msg.c.o
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_cache.c.o -MF CMakeFiles/mbedtls.dir/ssl_cache.c.o.d -o CMakeFiles/mbedtls.dir/ssl_cache.c.o -c /<<PKGBUILDDIR>>/library/ssl_cache.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/debug.c.o -MF CMakeFiles/mbedtls.dir/debug.c.o.d -o CMakeFiles/mbedtls.dir/debug.c.o -c /<<PKGBUILDDIR>>/library/debug.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/net_sockets.c.o -MF CMakeFiles/mbedtls.dir/net_sockets.c.o.d -o CMakeFiles/mbedtls.dir/net_sockets.c.o -c /<<PKGBUILDDIR>>/library/net_sockets.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_ciphersuites.c.o -MF CMakeFiles/mbedtls.dir/ssl_ciphersuites.c.o.d -o CMakeFiles/mbedtls.dir/ssl_ciphersuites.c.o -c /<<PKGBUILDDIR>>/library/ssl_ciphersuites.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_cli.c.o -MF CMakeFiles/mbedtls.dir/ssl_cli.c.o.d -o CMakeFiles/mbedtls.dir/ssl_cli.c.o -c /<<PKGBUILDDIR>>/library/ssl_cli.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_cookie.c.o -MF CMakeFiles/mbedtls.dir/ssl_cookie.c.o.d -o CMakeFiles/mbedtls.dir/ssl_cookie.c.o -c /<<PKGBUILDDIR>>/library/ssl_cookie.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_msg.c.o -MF CMakeFiles/mbedtls.dir/ssl_msg.c.o.d -o CMakeFiles/mbedtls.dir/ssl_msg.c.o -c /<<PKGBUILDDIR>>/library/ssl_msg.c
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_srv.c.o -MF CMakeFiles/mbedtls.dir/ssl_srv.c.o.d -o CMakeFiles/mbedtls.dir/ssl_srv.c.o -c /<<PKGBUILDDIR>>/library/ssl_srv.c
[ 41%] Building C object library/CMakeFiles/mbedtls.dir/ssl_ticket.c.o
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_ticket.c.o -MF CMakeFiles/mbedtls.dir/ssl_ticket.c.o.d -o CMakeFiles/mbedtls.dir/ssl_ticket.c.o -c /<<PKGBUILDDIR>>/library/ssl_ticket.c
[ 41%] Building C object library/CMakeFiles/mbedtls.dir/ssl_tls.c.o
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_tls.c.o -MF CMakeFiles/mbedtls.dir/ssl_tls.c.o.d -o CMakeFiles/mbedtls.dir/ssl_tls.c.o -c /<<PKGBUILDDIR>>/library/ssl_tls.c
[ 42%] Building C object library/CMakeFiles/mbedtls.dir/ssl_tls13_keys.c.o
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cc -Dmbedtls_EXPORTS -I/<<PKGBUILDDIR>>/include -I/<<PKGBUILDDIR>>/library -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -fPIC -MD -MT library/CMakeFiles/mbedtls.dir/ssl_tls13_keys.c.o -MF CMakeFiles/mbedtls.dir/ssl_tls13_keys.c.o.d -o CMakeFiles/mbedtls.dir/ssl_tls13_keys.c.o -c /<<PKGBUILDDIR>>/library/ssl_tls13_keys.c
[ 42%] Linking C shared library libmbedtls.so
cd /<<PKGBUILDDIR>>/obj-x86_64-linux-gnu/library && /usr/bin/cmake -E cmake_link_script CMakeFiles/mbedtls.dir/link.txt --verbose=1
/usr/bin/cc -fPIC -g -O2 -Werror=implicit-function-declaration -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -D__DEB_CANARY_CFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -ffile-prefix-map=/<<PKGBUILDDIR>>=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -D__DEB_CANARY_CPPFLAGS_92a0e7a415d64ebafcb16a8ca817cde4__ -Wdate-time -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -Wmissing-declarations -Wmissing-prototypes -Wl,-z,deb-canary-92a0e7a415d64ebafcb16a8ca817cde4 -flto=auto -ffat-lto-objects -Wl,-z,relro -Wl,-z,now -shared -Wl,-soname,libmbedtls.so.14 -o libmbedtls.so.2.28.0 CMakeFiles/mbedtls.dir/debug.c.o CMakeFiles/mbedtls.dir/net_sockets.c.o CMakeFiles/mbedtls.dir/ssl_cache.c.o CMakeFiles/mbedtls.dir/ssl_ciphersuites.c.o CMakeFiles/mbedtls.dir/ssl_cli.c.o CMakeFiles/mbedtls.dir/ssl_cookie.c.o CMakeFiles/mbedtls.dir/ssl_msg.c.o CMakeFiles/mbedtls.dir/ssl_srv.c.o CMakeFiles/mbedtls.dir/ssl_ticket.c.o CMakeFiles/mbedtls.dir/ssl_tls.c.o CMakeFiles/mbedtls.dir/ssl_tls13_keys.c.o  -Wl,-rpath,"\$ORIGIN:" libmbedx509.so.2.28.0 libmbedcrypto.so.2.28.0
/usr/bin/ld: warning: -z deb-canary-92a0e7a415d64ebafcb16a8ca817cde4 ignored
./library/ssl_tls.c: In function ‘ssl_calc_finished_tls_sha384’:
./library/ssl_tls.c:3399:5: error: ‘mbedtls_sha512_finish_ret’ accessing 64 bytes in a region of size 48 [-Werror=stringop-overflow=]
./library/ssl_tls.c:3399:5: note: referencing argument 2 of type ‘unsigned char *’
./include/mbedtls/sha512.h:146:5: note: in a call to function ‘mbedtls_sha512_finish_ret’
lto1: all warnings being treated as errors
make[4]: *** [/tmp/ccri1qhp.mk:5: /tmp/ccH2Afo3.ltrans1.ltrans.o] Error 1
make[4]: *** Waiting for unfinished jobs....
lto-wrapper: fatal error: make returned 2 exit status
compilation terminated.
/usr/bin/ld: error: lto-wrapper failed
collect2: error: ld returned 1 exit status
make[3]: *** [library/CMakeFiles/mbedtls.dir/build.make:262: library/libmbedtls.so.2.28.0] Error 1
make[3]: Leaving directory '/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu'
make[2]: *** [CMakeFiles/Makefile2:622: library/CMakeFiles/mbedtls.dir/all] Error 2
make[2]: Leaving directory '/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu'
make[1]: *** [Makefile:149: all] Error 2
make[1]: Leaving directory '/<<PKGBUILDDIR>>/obj-x86_64-linux-gnu'
dh_auto_build: error: cd obj-x86_64-linux-gnu && make -j8 "INSTALL=install --strip-program=true" VERBOSE=1 returned exit code 2
make: *** [debian/rules:8: binary] Error 25
dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2

On Tue, 19 Jul 2022 16:56:38 +0000 Matthias Klose <doko@debian.org>  wrote:
 > This package currently fails to build (at least on the amd64
 > architecture) with link time optimizations enabled.

Hi Matthias, thanks for the report. I'm aware of that, and I've already
submitted a report upstream.

I've already disabled LTO with optimize=-lto, and I have no plans to
re-enable it; I'd prefer using the build system's LTO support instead,
in this case by passing -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON to
dh_auto_configure.

By the way, is enabling LTO with dpkg-buildflags appropriate? I believe
that different "high level" build systems (like Meson and CMake) handle
LTO differently, and they recommend passing specific options at the
configure step. Maybe it would be better to handle LTO at the Debhelper
level?