Hi!

While rebuilding the python related packages against the Python 3.15rc2
version we found that freehsm-c fails to build on non-amd64
architectures. This is our log for arm64:
https://debusine.debian.net/debian/r-python-python3.15/artifact/4856175/

 From the log, the error seems to be:

   [gen_p11_thunks] wrote
/build/reproducible-path/freehsm-c-2.0.0/src/gen/fhsm_dispatch.c
   [gen_p11_thunks] wrote
/build/reproducible-path/freehsm-c-2.0.0/docs/MECHANISMS.md
   cc -Wall -Wextra -Wpedantic -Werror […] dispatch -c -o
.obj/src/fhsm_state.o src/fhsm_state.c
   cc1: error: ‘-fcf-protection=full’ is not supported for this target

While we ran into this error during the rebuild against Python 3.15, the
reproducible builds infrastructure is also running into this issue:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/arm64/freehsm-c.html

As well as all the buildds:
on non-amd64 architectures

Thus, this is not a new problem and it should be solved right away.
Setting the severity to Serious.

Please consider fixing the package to work on other architectures, or
setting the arch field to the correct value if that's not possible.

Thanks for the report.  I'm hesitant if/how this can be fixed easily,
it is really an upstream problem.  There has been fixes in later
releases, but I haven't found time to package them (help appreciated).
If they don't fix it, I agree using an Architecture:amd64 is probably
the simplest fix.

/Simon

ons 2026-09-30 klockan 15:33 +0200 skrev Margarita Manterola:

Hi,

The attached debdiff against 2.0.0-1 makes freehsm-c build on the 64-bit
non-x86 architectures and stops trying on 32-bit ones:

 * fcf-protection-only-where-supported.patch: -fcf-protection=full is
   x86-only; the Makefile now probes the compiler and only adds it when
   it is accepted. This is #1144631.

 * elf-headers-unaligned-read.patch: find_section_offset() cast the file
   buffer to Elf64_Ehdr/Elf64_Shdr pointers, which -Werror=cast-align
   rejects on riscv64. It now copies the headers with memcpy.

 * debian/control: restrict Architecture to 64-bit architectures. Upstream
   does not support 32-bit at all, the integrity check only parses ELF64
   (https://github.com/afchine1337/freehsm/issues/2).

Both patches are also proposed upstream:
https://github.com/afchine1337/freehsm/pull/18

Testing: 2.0.0-2 with the debdiff builds on amd64 in a forky container,
with -fcf-protection=full still used there, and upstream's
test-integrity passes with the ELF change. The same changes applied to
1.6.0 in Ubuntu (1.6.0-1ubuntu1) built in the Ubuntu archive on amd64,
arm64, ppc64el, riscv64 and s390x.

Regards,
Sebastien