tralics is not currently using the default build flags set by dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.

Please make sure that tralics builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.

In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
tralics, the flags are either ignored or overridden.

The most common reasons for this are:

Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles

Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.

In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":

 set(CMAKE_CXX_FLAGS "-O2")

If the intention is to append to CXXFLAGS, one should use the following
instead:

 set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")

See #655870 for a similar autotools example.

Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags

Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).

Others attempt to append to the variables, but end up accidentally
overriding the defaults:

 #!/usr/bin/make -f
 export CFLAGS += -pipe -fPIC -Wall

 %:
 	dh $@

Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).

For a detailed analysis of this issue, see:
https://people.debian.org/~ema/nocflags_paper.pdf (eprint: hal-05334704)

We believe that the bug you reported is fixed in the latest version of
tralics, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1119593@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Boyuan Yang <byang@debian.org> (supplier of updated tralics package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 31 Oct 2026 23:53:58 -0400
Source: tralics
Architecture: source
Version: 3.0.1+dfsg1-1
Distribution: unstable
Urgency: medium
Maintainer: Boyuan Yang <byang@debian.org>
Changed-By: Boyuan Yang <byang@debian.org>
Closes: 1119593 1128983
Changes:
 tralics (3.0.1+dfsg1-1) unstable; urgency=medium
 .
   * Adopt the package (Closes: #1128983).
   * New upstream release.
   * debian/gbp.conf: Added.
   * debian/watch: Track GitHub releases using format 5 and repack the source.
   * debian/copyright: Exclude bundled libraries and the Maple and overword
     support files with restrictive redistribution terms.
   * debian/control: Take over maintenance, update the project and Vcs URLs,
     build with CMake and system libraries, and follow Standards-Version 4.7.4.
     Move the shared description to the source stanza and use debhelper 14
     with the explicit single-binary sequence.
   * debian/rules: Enable all supported hardening options.
   * debian/rules: Replace the legacy rules with dh and honour distribution
     compiler and linker flags (Closes: #1119593). Run upstream regression
     tests separately and respect DEB_BUILD_OPTIONS=nocheck.
   * debian/patches/:
     - 0001-Include-unistd.h-for-sleep.patch: Dropped, obsolete with the new
       upstream source.
     + 0001-Use-system-libraries-and-distribution-build-flags.patch:
       Add patch to use system libraries and distribution build flags, and
       separate the upstream regression tests from compilation.
     + 0002-Rename-the-modified-AMS-documentation-fixture.patch:
       Add patch to rename the modified AMS test source and expected XML
       according to the licence requirements.
     + 0003-Install-and-locate-the-Tralics-expl3-support-file.patch:
       Add patch to install the expl3 companion file and search configuration
       directories for input files after user-specified input paths.
     + 0004-Include-algorithm-where-standard-algorithms-are-used.patch:
       Add patch for missing direct <algorithm> includes exposed when using
       system libraries.
   * debian/copyright: Rewrite in machine-readable format.
   * debian/tralics.docs, debian/tralics.manpages: Replace legacy helper files.
   * debian/tralics.1: Expand the manually maintained reference using the current
     help and implementation.
   * debian/NEWS: Explain the UTF-8 output, configuration and support changes.
   * debian/README.source: Describe the recovered history and source workflow.
   * debian/tralics.lintian-overrides: Document intentionally retained Latin-1
     input examples and entity tables.
   * debian/tests/*: Add installed translation, MathML, expl3 and configuration
     smoke tests.
Checksums-Sha1:
 604463d4297b978607820bba22681baedd7ee057 2276 tralics_3.0.1+dfsg1-1.dsc
 a2c3a26f9d781f37ebdf1d7e671b80414f15171d 2196284 tralics_3.0.1+dfsg1.orig.tar.xz
 739a849675a4f6fc0b3860b52da4d8cdc6667b1c 75852 tralics_3.0.1+dfsg1-1.debian.tar.xz
 5c4c5a27a542e51398b587c3d1e32897fcc73f0e 8689 tralics_3.0.1+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
 55bc4b676d4477a436ab7724dc398dc321b2fc0523311993c6e0f3af621ff979 2276 tralics_3.0.1+dfsg1-1.dsc
 312eb8c52d178c80a6cb8ef08e816c52c2a9ac23f9401573dcd035efe6827bce 2196284 tralics_3.0.1+dfsg1.orig.tar.xz
 d5fdd77be9d63089a5e76ffabcf38a60f07fa799c910862b899b294a9d14e4a7 75852 tralics_3.0.1+dfsg1-1.debian.tar.xz
 b71e75a9a2ba3f4e5ca28817e5cf0b1b98cb5cb31cdf590fb2356ca0d1f02501 8689 tralics_3.0.1+dfsg1-1_amd64.buildinfo
Files:
 1015a5a28b1aaadb96a270d182d001a2 2276 tex optional tralics_3.0.1+dfsg1-1.dsc
 56d97fb5c0f68f2648d62d59c9e0d326 2196284 tex optional tralics_3.0.1+dfsg1.orig.tar.xz
 f165018cd66526bd73ca62de0acd06cc 75852 tex optional tralics_3.0.1+dfsg1-1.debian.tar.xz
 7024a6064edee7a8323e43aab324d80a 8689 tex optional tralics_3.0.1+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfncpR22H1vEdkazLwpPntGGCWs4FAmrmuXYACgkQwpPntGGC
Ws5M9xAAotd7jJw1OiLPTjcK8pG34XkVgrnU0eScRt0I3WMnp/Jt5VoVxmVck8Si
q/QKx5vSaJ/DBC+K8Ft58ea/vtZ1HEbYorS70j0KYLykrC+ow0/WRzKxGXlCxtK8
Xnp1re1ZXcnkjH4ecsjJIc0GNjAQSL6YL3v4HNBhh/2x7kBu0OpNugWliedoWhGh
SXDlYFyCLh9JDEsIRNxEtyv5f/pzwzdU3Vl6qTcT5uVbJxo4VhqAD+TJeleAC4pd
bjPcdVODzjTvwVyRmW3TEiKmAWxlzNn2X5SFDINv5pUn0y50IehEHoJhIZcD8fSr
YzTG/Rf0jslJadnuIqj1SBWJoOS/swLAM1+ibsueRPbQAqiu+lzV3QuXi1ZInMrV
yAUrfKQH644Uu6n+SAnHYC3G9g54HvVxU0dAv3mWWMhwEJiR2i/XVz9rp2kxU5Ay
62Dol3J/aOsVk9+5bqEifTfY76C2LZJDF3FWHhng7iM5Xn1ZlyAdgMoLoGNlbUEA
V0pkeHlFkefcwMXHdVKBaQLrnlNyaS1vLsg9DaW/Lkh0kwuuGTILyBbDA9v+NUr9
o6HHofQWLqvJ6AhBR6HtkYHoRZV6bfuXY/csLlrrRld+M0Msz57gODVdQnknYkWL
P648MsO+HeJsVITKletf/8ZXz73ckPrHEc3bPuoiCWyGkstEVbI=
=I2Pc
-----END PGP SIGNATURE-----