aspectc++ is not currently using the default build flags set by dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.

Please make sure that aspectc++ builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.

In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
aspectc++, the flags are either ignored or overridden.

The most common reasons for this are:

Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles

Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.

In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":

 set(CMAKE_CXX_FLAGS "-O2")

If the intention is to append to CXXFLAGS, one should use the following
instead:

 set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")

See #655870 for a similar autotools example.

Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags

Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).

Others attempt to append to the variables, but end up accidentally
overriding the defaults:

 #!/usr/bin/make -f
 export CFLAGS += -pipe -fPIC -Wall

 %:
 	dh $@

Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).

For a detailed analysis of this issue, see https://hal.science/hal-05334704/

We believe that the bug you reported is fixed in the latest version of
aspectc++, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1124843@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated aspectc++ package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 06 Oct 2026 20:20:58 -0400
Source: aspectc++
Architecture: source
Version: 1:2.5+svn20261003-2
Distribution: unstable
Urgency: medium
Maintainer: Reinhard Tartler <siretart@tauware.de>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Closes: 1124843
Changes:
 aspectc++ (1:2.5+svn20261003-2) unstable; urgency=medium
 .
   * debian/patches: probe compiler for __float128 before running Float128Basic
   * debian/patches/test-probe-float128.patch: add Forwarded header
   * debian/patches: renumber patch series with gbp pq
   * debian/control: bump Standards-Version to 4.7.4 (no changes needed)
   * debian: upgrade debhelper compat to 14 and switch to dh sequencer
   * debian/rules: ignore test suite exit status in override_dh_auto_test
   * debian/copyright: convert to DEP-5 machine-readable format
   * debian: honor default hardening build flags (Closes: #1124843)
   * debian/patches/0004: mark as forwarded to aspectc-developers@aspectc.org
Checksums-Sha1:
 7aed5db7d579694273b1168e444db71be460a554 2358 aspectc++_2.5+svn20261003-2.dsc
 bd7d68870c6be97c71f9bcfa2d96665b97e3b5fa 14288 aspectc++_2.5+svn20261003-2.debian.tar.xz
 a9b806aa8c136c3f6bc71ecb8fb18c3e05989a6e 6419120 aspectc++_2.5+svn20261003-2.git.tar.xz
 9a92bccd9b3d79950c464325f406ce1a89c264fa 17774 aspectc++_2.5+svn20261003-2_source.buildinfo
Checksums-Sha256:
 d8495423af2c0365fc4e1ed5d41f598f68b2a2f76d655f053faa44d71df10b10 2358 aspectc++_2.5+svn20261003-2.dsc
 f967ddb230e8bb5bce0ad074a27e2db570318b43ad3f7e333553f92c2d70d62e 14288 aspectc++_2.5+svn20261003-2.debian.tar.xz
 854b06dc08e369ea1387763e5823ee6e44abdca7e50b345e11bf1d2d78c8f11c 6419120 aspectc++_2.5+svn20261003-2.git.tar.xz
 01972130d91e59ce921fa0f63c4e973c0105fe37625c53e04d76cdd1e5147f4d 17774 aspectc++_2.5+svn20261003-2_source.buildinfo
Files:
 e7ba1851a7f9bff51e314e9ea98c2394 2358 devel optional aspectc++_2.5+svn20261003-2.dsc
 67cef4bf953cbdfa21b540a83fd0080c 14288 devel optional aspectc++_2.5+svn20261003-2.debian.tar.xz
 25e3805cc33966c50616244cae34a702 6419120 devel optional aspectc++_2.5+svn20261003-2.git.tar.xz
 80eb3e7fdb9f19ac607191bbfe3714fd 17774 devel optional aspectc++_2.5+svn20261003-2_source.buildinfo
Git-Tag-Info: tag=714efef0ed8218bb7bb66317070bd786c1be4a63 fp=30de7d1763ab9452c7e0825049a76977942826cb
Git-Tag-Tagger: Reinhard Tartler <siretart@tauware.de>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrFkPAACgkQYG0ITkaD
wHmwphAAlrqPtrIG1sBvMSBoX3NW90OdbOhbUOVZwA4+YqhQYPNxl0pvXp8lGJps
XTt99JZGQH44zLCDvFPd32znPRk/dI1Ot85jqCXd6IteZX+ngNv75yQwwYHR69R2
FtOQcyseeH0U2TKr7VYr0Esc5JvGh9CMAOeU+dn/XszdsEHwg03kCseX1HjBV22t
VtI4wTsy4TPLDUowg/hvmy+9n1E2HzDnXeSZq3lDDROuLhH2C0Hb0wLhn+asCHLh
gpkxX17+C4C9E/U9eZatfjuWwfv8ofvPwlYqcqWDVdiWJtzNFHfeDff3l9Gs5umN
jgnhrczH2WZe51PGKuV4xiqR0zXmPE+c0dNzPHQz8I1oU5kV9LKKHocd7COsQtzf
fBqF788yT/ZS+7RMrVXL7kuPP2pT6gHf2sUVxozmHNsSn3GE5gApvlgRHFKrDZom
bxOioJpDVIVnxlTBQqzJSBQvz3tpYyVExTZ8YsKeCTXP08DJA9mfSS88399tWLuc
9962RM1f/So6DzUcRNBWVlKCDE6ywEtS8jdLAh9JTKnLHqjzkrsPrPPb+e4aR/dN
r5zeWlAcHwtu9zKqJIxpJYOHY6iiQJhadN/Rjo7FdAVKJODrNu8Wj3nwlKQTFPkx
SHbrx+L+in9FZ9c1owLTJ7/X/2/z21aayaQYeqgZbFJCnZBt3S4=
=p7nH
-----END PGP SIGNATURE-----