dumb-init is not currently using the default build flags set by dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.

Please make sure that dumb-init builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.

In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
dumb-init, the flags are either ignored or overridden.

The most common reasons for this are:

Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles

Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.

In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":

 set(CMAKE_CXX_FLAGS "-O2")

If the intention is to append to CXXFLAGS, one should use the following
instead:

 set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")

See #655870 for a similar autotools example.

Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags

Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).

Others attempt to append to the variables, but end up accidentally
overriding the defaults:

 #!/usr/bin/make -f
 export CFLAGS += -pipe -fPIC -Wall

 %:
 	dh $@

Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).

For a detailed analysis of this issue, see:
https://people.debian.org/~ema/nocflags_paper.pdf (eprint: hal-05334704)

Hello,

Bug #1119399 in dumb-init reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/dumb-init/-/commit/50aa8ffd4609263a25c83e09a0a525733173f582
------------------------------------------------------------------------
build using the default build flags (Closes: #1119399)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1119399

We believe that the bug you reported is fixed in the latest version of
dumb-init, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1119399@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexandre Detiste <tchet@debian.org> (supplier of updated dumb-init package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 17 Aug 2026 13:36:07 +0200
Source: dumb-init
Architecture: source
Version: 1.2.5-3.1
Distribution: unstable
Urgency: medium
Maintainer: ChangZhuo Chen (陳昌倬) <czchen@debian.org>
Changed-By: Alexandre Detiste <tchet@debian.org>
Closes: 1044759 1118707 1119399
Changes:
 dumb-init (1.2.5-3.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Patch-out usage of python3-py (Closes: #1118707)
   * Build using the default build flags (Closes: #1119399)
   * Clean better (Closes: #1044759)
   * Add debian/salsa-ci.yml
   * Drop "Rules-Requires-Root: no": it is the default now
   * Bump Standards-Version to 4.7.4, drop Priority: tag
Checksums-Sha1:
 fa6c8f6521fd8bb894c7f525756e53a6419b9683 2058 dumb-init_1.2.5-3.1.dsc
 201822df500b56762967ccb06cb0dacc84001ebd 4696 dumb-init_1.2.5-3.1.debian.tar.xz
 77537b4ef7bc95203f4ccd8b2953518764b572f6 6602 dumb-init_1.2.5-3.1_source.buildinfo
Checksums-Sha256:
 d5b6026a579cbcd450d5be94e588d5b8b46070a61e774091b115a60f6c11009f 2058 dumb-init_1.2.5-3.1.dsc
 a6b3a28903dbce648c5329f07ed6071b02cd408e635b0704125c5d96733cd9c3 4696 dumb-init_1.2.5-3.1.debian.tar.xz
 a3e0b8562bec8ba0c543e583648187cfd16b31443a6dd2068fa64b7240537c6d 6602 dumb-init_1.2.5-3.1_source.buildinfo
Files:
 795c0fc652870a0bbe9358941aa20d23 2058 utils optional dumb-init_1.2.5-3.1.dsc
 dfcad6d83744e1a96de3776cc39d7069 4696 utils optional dumb-init_1.2.5-3.1.debian.tar.xz
 40d669c36ae6618abce6fb7c68ee8d92 6602 utils optional dumb-init_1.2.5-3.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmqC8owRHHRjaGV0QGRl
Ymlhbi5vcmcACgkQMfMURUShdBrdBQ/+OGTxSfjNpMPbd8y+Pv0c/1SG1G5ZTShw
0VDFqPZ1SUF4ul2u/QxwH6EUFIyiqVTA4aLCu1eYbskUE/FjaKahISBKf3WW1LrF
eC2yvUZxZMWcTUoS2hp+T228bUHqz77Sw7GJ4LZk3FP8L7GnCJ/iwXVaAamoZ1Jq
BP5mHTOgvH7+hqZvm22QMW3f77gl5WevdI35+u46UsBkEHAojUr5q0jN1Vvlp9QW
b0ggKoVVTmABdzWSOK5yS1aTA0M4bcFqy1vvHIF5zxLaKPFg5TRfaMt9FFRo3DrE
72vXXaPPtBqipwpMOFk3bKrrVdwUcJA74EpzpISuv5jV6Iz6mDBrh3DLxXMvxWyt
QRj5YEoUI4dq6caMdLOBRA5IWQqy5HAzL/Rv7eDmvANRoD66ujkeZXbtHLFt6WKb
06h8F13zVsnjforbXj3cQkVF/ai0z1z4/5fp68afdJCxiQtUx4m67xQakqbXXFv1
4pIx2b79n5ZTjk3ahm87aSx97jmEIrjTAjZFkrAC0NtL+0VjgPdRuYmKxNyeZPvh
qkad4oPCu76E2Ia1jbLlJo6N9i5b11HZ5sKzA9fHvtH+/ZaeVJsFi3Xy4+vH0GX8
+a1afZRfOWxs+t9jgZCkc9uBmzNsIxQNrtppzGv9JGP2CIbLWCvszxqWKLA5HzKb
XOVCEPjf2FM=
=ieQ3
-----END PGP SIGNATURE-----