Powder hardening: was re: Request Package Review

[Steven Hamilton <oz@scorch.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi folks,
I've been working on the Powder package with intention to adopt. I'm
doing the hardening bit, where the previous package was never hardened.

I've updated the rules file to be more dh(1) like so;

#!/usr/bin/make -f
# Uncomment this to turn on verbose mode.
#export DH_VERBOSE=1

%:
	dh $@

override_dh_auto_build:
	dh_testdir
	bash -ex ./buildall.sh

clean:
	dh_testdir
	dh_testroot
	rm -f *.o */*.o */*/*.o rooms/*.cpp rooms/allrooms.h gfx/*.c gfx/*/*.c
	rm -f license.cpp glbdef.cpp glbdef.h encyclopedia.cpp encyclopedia.h
	rm -f credits.cpp gfx/akoi3x/sprite16_3x.bmp
	rm -f powder port/linux/powder support/bmp2c/bmp2c
support/encyclopedia2c/encyclopedia2c support/enummaker/enummaker
support/map2c/map2c support/tile2c/tile2c support/txt2c/txt2c
port/linux/libstdc++.a
	dh_clean


As you can see the build is performed by a script that comes with the
source. The script supports multiple platforms (GBA, Windows etc). How
do I pass hardening CXXFLAGS into it though? If I export in the rules
file they don't transfer to the script. Should I patch the script to
include the flags or is there a way to do pass them from rule? Here's
a snippet from the start of the script where is catchs CXXFLAGS. The
makefile under the ports/linux folder catches LDFLAGS ok.

#!/bin/bash

if [ -z "$CXXFLAGS" ]; then
    export CXXFLAGS=-O3
fi

....the off to build.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iF4EAREIAAYFAlFXtwcACgkQunxZKpjzbPfrvAD/ZvV98CNKqasQJVNd6Usm/lAf
cKpAM0HAjKceuK7gGAgA/1ZS9rE2oV3whmzs4aAeo36iFLdwAjCQbLY/tU0oabVN
=qkLc
-----END PGP SIGNATURE-----