Hi,

I've been trying to fix a dpkg-buildflags-missing CPPFLAGS lintian issue
in the w1retap package, the blhc output on the build log is:

CPPFLAGS missing (-D_FORTIFY_SOURCE=2): libtool: link: (cd .libs && gcc -g -O2 -fdebug-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -c -fno-builtin "w1retapS.c")

However looking at the build log snippet[0] the full command is actually
a call to libtool in link mode. This libtool invocation generates a new
S.c file to generate dlsyms information. Looking at the internals of a
generated libtool[1], it's basing the gcc args on LTCFLAGS.

When libtool is generated it bases its LTCFLAGS from CFLAGS[2]. Looking
at the dpkg-buildflags hardening the -D_FORTIFY_SOURCE=2 flag is for
CPPFLAGS rather than CFLAGS[3].

If I rebuild[4] adding qa=+canary to DEB_BUILD_MAINT_OPTIONS I can see
that the canary CFLAGS get added to the libtool call and to the same gcc
call for w1retapS.c for dlsyms generation.

I suspect that blhc is erroneously reporting this.

Kind Regards
Tom

Hello,

Thomas Stewart, le jeu. 06 févr. 2020 15:21:16 +0000, a ecrit:

https://salsa.debian.org/tts-team/speech-dispatcher/-/jobs/1295146

CPPFLAGS missing (-D_FORTIFY_SOURCE=2): libtool: link: (cd .libs && gcc -g -O2 -fdebug-prefix-map=/builds/tts-team/speech-dispatcher/debian/output/source_dir=. -fstack-protector-strong -Wformat -Werror=format-security -c -fno-builtin "sd_dummyS.c")

In the debian packaging we don't really have control over the LTCFLAGS
definition, so we can't really fix it there. We'd thus need either blhc
to ignore these libtool-related builds, or libtool to be patched to
include CPPFLAGS in LTCFLAGS.

Samuel