Re: Enabling branch protection on amd64 and arm64

[Guillem Jover <guillem@debian.org>]

Hi!

On Sun, 2023-08-27 at 12:51:53 +0200, Guillem Jover wrote:
> On Tue, 2023-06-27 at 16:09:40 +0100, Wookey wrote:
> > OK. We're all agreed on that then. Guillem can stick it in the next
> > dpkg upload.

So this happened, and Johannes reported that this seems to be breaking
cross-building. :(

The problem, which is in fact not new, but is made way more evident
now, is that the flags used are accepted only per arch, so when
passing for example CFLAGS (the host ones) into CC_FOR_BUILD, then
that one will not know about them and fail. (We have had this problem
up to now as we set flags per arch as some are broken in some arches,
but it being a problem depends on the host and build arches involved.)

I'm thinking about uploading later today a workaround to disable these
flags for now when cross-building. And then for the next release after
that support for <flags>_FOR_BUILD which can then take into account
these arch differences. I think some upstream code can already make
use of these, but this might need going over packaging or upstream
build systems to adapt/fix stuff. :/

And until that's done I don't think the workaround can be lifted,
and cross-compiling will generate different binaries than
non-cross-compiling. Another option would be to revert this change
until we can add it safely, but that would also be unfortunate.
OTOH, upstream code that uses stuff like CFLAGS with things like
CC_FOR_BUILD are already broken in regards cross-building, so perhaps
this can be an opportunity to flush them out?

Thanks,
Guillem