flexpart is not currently using the default build flags set by dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.

Please make sure that flexpart builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.

In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
flexpart, the flags are either ignored or overridden.

The most common reasons for this are:

Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles

Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.

In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":

 set(CMAKE_CXX_FLAGS "-O2")

If the intention is to append to CXXFLAGS, one should use the following
instead:

 set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")

See #655870 for a similar autotools example.

Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags

Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).

Others attempt to append to the variables, but end up accidentally
overriding the defaults:

 #!/usr/bin/make -f
 export CFLAGS += -pipe -fPIC -Wall

 %:
 	dh $@

Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).

For a detailed analysis of this issue, see:
https://people.debian.org/~ema/nocflags_paper.pdf (eprint: hal-05334704)

We believe that the bug you reported is fixed in the latest version of
flexpart, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1119418@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alastair McKinstry <mckinstry@debian.org> (supplier of updated flexpart package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 03 Aug 2026 13:27:08 +0100
Source: flexpart
Architecture: source
Version: 11.1-3
Distribution: unstable
Urgency: medium
Maintainer: Alastair McKinstry <mckinstry@debian.org>
Changed-By: Alastair McKinstry <mckinstry@debian.org>
Closes: 1105361 1119418
Changes:
 flexpart (11.1-3) unstable; urgency=medium
 .
   * Drop unused misc:Depends in d/control
   * Close old bugs fixed in 11.1-1 Closes: #1119418, #1105361
   * Delete mcmodel=large in fortran.patch that breaks s390x,riscv64 builds
Checksums-Sha1:
 ad939918c667d16a928ad0db40d9d4473d78107c 1907 flexpart_11.1-3.dsc
 3664894457298e2b4a4c4e47f631b2d55cba3b6b 5152 flexpart_11.1-3.debian.tar.xz
 59325d4fa3add22b7850b5efefef620d690bab06 10904 flexpart_11.1-3_arm64.buildinfo
Checksums-Sha256:
 357a5466ff046e9b67c430ccd6016cd5183ace94d173c869bf03e6d046852b23 1907 flexpart_11.1-3.dsc
 2f2a11430740523ad85ab9b8243fd9dd00dbf9a645e336fc011c2d6b8a7ae25c 5152 flexpart_11.1-3.debian.tar.xz
 04be43bbb21fb7d12b569d650f826ca02205202009faef4a286652103cfd6cc3 10904 flexpart_11.1-3_arm64.buildinfo
Files:
 46fe0c824df65c6c4426dabca4f5d781 1907 science optional flexpart_11.1-3.dsc
 8c8bc89f87a5bc419f6c5f7fc3958188 5152 science optional flexpart_11.1-3.debian.tar.xz
 1230d5881be84ddec05bf76a9ffe3e07 10904 science optional flexpart_11.1-3_arm64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgjg86RZbNHx4cIGiy+a7Tl2a06UFAmpwiscACgkQy+a7Tl2a
06XPRQ//YVg4IsfqcKvU3RYpEtWV9WUv0LMJI6rpnEfVvArDg9MYEN++ZyGDbQB6
9dOWdD3wY7NctKewJ5S6T+pS6+BHZSbzGQfV1VYwXDO12E/7kZ5E8hW/Rr0vJ7eT
FBdWCZ4v8GcQ9XAJ8buRYX5+O5vbYdovVi/WFB8IP6JDQvPhvp3fQ9s1uYhszAwf
+qF0giz4q4RWOSXpH2mJjKffDt3nyxsSEcymjK6wiulnTb8l4tUqzYFUeRvly6Mz
592FWo58oscOizSlGsv8g8aJ9WrL4qxzJBJtU+AV6Uob9Dy7wzrQ1oSZDpa43b2n
zefRc8qjnv+dDOmRvKoZ8NY+Ezx2A7qCxJEbBELQ2GITHE2cr8F5Um6KEOnZ+KtL
W0xS/NrnVNqGeJmJbC63m8pcKD3iRxrRwdaWRM+hKQkBt/t/JHhIqCdzSY+JmLRW
gUxuaa6OFKnN3RUBgAD4PVw61ArpT82gM4Pq/pvJSDhbHACJIzMMG1TpH2GRj54i
8TmHGOdC0eoD8U8QCGfsKg69EgdsrsPh//HgImSW8LLV0vUOt85qOyi68LrAkViF
q2np+Ecp3mbMc+piOs7o77qucYzZ0bA8RP2FWm0+3/Icn2HiGzg68w2OUkJVsfEy
bJSwLH+Rg+AlKV4sitUdLD3YLXp3Tx/UHZQLw7wc5WT6mhUIxH8=
=D8r3
-----END PGP SIGNATURE-----