xerial-sqlite-jdbc is not currently using the default build flags set by dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.

Please make sure that xerial-sqlite-jdbc builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.

In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
xerial-sqlite-jdbc, the flags are either ignored or overridden.

The most common reasons for this are:

Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles

Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.

In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":

 set(CMAKE_CXX_FLAGS "-O2")

If the intention is to append to CXXFLAGS, one should use the following
instead:

 set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")

See #655870 for a similar autotools example.

Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags

Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).

Others attempt to append to the variables, but end up accidentally
overriding the defaults:

 #!/usr/bin/make -f
 export CFLAGS += -pipe -fPIC -Wall

 %:
 	dh $@

Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).

For a detailed analysis of this issue, see https://hal.science/hal-05334704/

We believe that the bug you reported is fixed in the latest version of
xerial-sqlite-jdbc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1124919@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Pierre Gruet <pgt@debian.org> (supplier of updated xerial-sqlite-jdbc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 05 Aug 2026 17:41:13 +0200
Source: xerial-sqlite-jdbc
Architecture: source
Version: 3.53.2.1+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Pierre Gruet <pgt@debian.org>
Closes: 1124919
Changes:
 xerial-sqlite-jdbc (3.53.2.1+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 3.53.2.1+dfsg
   * Refreshing patches
   * Passing default CFLAGS to the build (Closes: #1124919)
   * Raising Standards version to 4.7.4:
     - Removing Priority: optional, which is now defaults
     - Removing R-R-R: no, which is now defaults
   * Switching to debhelper-compat 14, removing misc and shlibs substvars from
     debian/control
   * Fixing wrong word in a comment in d/rules
   * Removing useless usage of dh-exec
   * Raising d/watch version to 5, pointing to new upstream repository
Checksums-Sha1:
 1ee3cb8d389bcf5b4a60e334be2ec48a3c7d3cc2 2471 xerial-sqlite-jdbc_3.53.2.1+dfsg-1.dsc
 44419d22f468ec3ac54e419c1026c334b6f278ed 184016 xerial-sqlite-jdbc_3.53.2.1+dfsg.orig.tar.xz
 8035b01f02b7b73db86b8d4baae113d58ad7fd2e 12288 xerial-sqlite-jdbc_3.53.2.1+dfsg-1.debian.tar.xz
 7b5cc3db818586ead6cf4ff7d84ba33a62d088b0 18272 xerial-sqlite-jdbc_3.53.2.1+dfsg-1_source.buildinfo
Checksums-Sha256:
 ec65b6a02c2504ebadd6f2cceacd8ca578065c2aa30474a051dd1d1964ac65e2 2471 xerial-sqlite-jdbc_3.53.2.1+dfsg-1.dsc
 ac1100ca9ed61b47045ce631e500c3fbeb5f5e944599f029a6c80fe17d1e7149 184016 xerial-sqlite-jdbc_3.53.2.1+dfsg.orig.tar.xz
 64c9a51e4eef64e0b4ae2fc0cb969bc855c582df353e75be29a68133d9d4373b 12288 xerial-sqlite-jdbc_3.53.2.1+dfsg-1.debian.tar.xz
 b85fcb7e45674faa3b3e2858745b6f23d06c633fbe7b90b0264f9f2d5a359a8e 18272 xerial-sqlite-jdbc_3.53.2.1+dfsg-1_source.buildinfo
Files:
 fffe9f64de9990a5cbf4730879a059cd 2471 java optional xerial-sqlite-jdbc_3.53.2.1+dfsg-1.dsc
 343cfee1aa6d22f272ff7f31c59589a3 184016 java optional xerial-sqlite-jdbc_3.53.2.1+dfsg.orig.tar.xz
 774c4b244a03c34a0b4e885b47266a4c 12288 java optional xerial-sqlite-jdbc_3.53.2.1+dfsg-1.debian.tar.xz
 d4ccb69aa429c0df5b4b76896a23aa44 18272 java optional xerial-sqlite-jdbc_3.53.2.1+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmpzWbMACgkQYAMWptwn
dHYbdg//V+ZfknxS8sU5YTYsh29KxgsutwK3zAEhbU4eWmadOKrYLFZi+xUeTBMk
EqwztnHosvOZq+qLzrgkrVh4BNfiuLyw5orjKXqxpnfxQP87D7i++8cL4u/udLjB
bIW2uCrsowbMvSs5gCWG/sKb0bFGH8fu01h83scsCBWXGXnmMFQad7ecINTDAZIw
RZd+gSnUXL61xKL5ykoW6zuY7tZGiQVJCugkH3U2MXBNVLOHIS5ZGQGSplXY1GIi
4CemCs4pC8/WoMCCvl+PKUcGUm8EuscDpUnWZ3tXzthS34cQyraj1n8ai0LND2/C
WdfYJ8vgWLN0dl/akpMESPlOvO18W7v4EE1vwrlqllYw0+grCtqmGkpvtd8Cla3w
HR65O8qqPerE6+XodNsnxnFNbiHk6/zPFnQMMXVMUtbaVrNMv9oTQvgo9GTtqHQw
fRpfo4zADpwr3VA3lQlq//r+nvmdVcXIcyrQOs1lKsPcx4CR5/irnRs5pZmfW1A3
1RACUj4XPL86ghybIbhmgYGiqx9I/paEJRAabo+L4vXWJSUF1LlQTjxGrgtenvMo
1GzSK95zHGWA0tdypTvE6L3MjLLEJCjXCR4MjkyXx1JHYNOZ0kgAyzfnpdMFhCxJ
FFzxQm5u/TbpqWA5FLMYP2S2pygU1FRJdzQh+y1d3AiwE8pOG90=
=9qCB
-----END PGP SIGNATURE-----