Bug#613046: debian-policy: please update example in 4.9.1 (debian/rules and DEB_BUILD_OPTIONS)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 2011-02-12 22:32, Julien Cristau wrote:
> On Sat, Feb 12, 2011 at 14:25:40 +0100, Niels Thykier wrote:
>
>> Package: debian-policy
>> Version: 3.9.1.0
>> Severity: minor
>>
>> Hey
>>
>> The example in 4.9.1 suggests to set CFLAGS in a way that completely
>> overrides values from dpkg-buildpackage/dpkg-buildflags[1]:
>>
>> CFLAGS = -Wall -g
>>
>> This will set CFLAGS to "-Wall -g" regardless of what dpkg-buildflags
>> provides. Possible alternatives that appears to work are:
>>
>> CFLAGS := $(CFLAGS) -Wall -g
>>
> That would be wrong. A package build shouldn't depend on random env
> variables.
>
I believe a lot of packages in the archive actually suffers from this
issue then, if dpkg-build{package,flags} did not sanitize these variables.
How many packages explicitly sets e.g. LDFLAGS in debian/rules? Almost
none of mine does it (granted most of my packages are Java packages, but
still).
>> CFLAGS = $(shell dpkg-buildflags --get CFLAGS) -Wall -g
>>
>> While related to #578597, I believe it to be a distinct issue. This was triggered
>> by this email[2] on debian-mentors.
>>
> Seems to be the exact same request to me?
>
> Cheers,
> Julien
>
Well, yes, if you insist the "CFLAGS := $(CFLAGS) somearg" is wrong, it
would appear that my original request can be trivially be reduced to
#578597.
Though in that case, I think we should change this one to a request to
make the policy be explicit in how a package should handle variables
from the environment (and which variables it should neutralize).
~Niels
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBCAAGBQJNVwv1AAoJEAVLu599gGRC3twQAIfvAyQRXBN51/aMMDxb3Zyk
dSKdi9OnebvufSULxvgWZJ0pm8+QUp/pjg1FAELGo4tbmFv6jqbW8KIhws3UACtP
TZ9ohwnt/9Hdp3Whvu2gPze0CvKSkplYLtrAMpevvi4S6RN5qX/Un0QtyeD1oNfn
47nJcPINryWZPKKWI6boq1EGed3m2+CIzzjvKtPeQHX/40rgwN39kAZpiuBNGah/
3TiM1/ETZl7oXXxCpJ8EzN62CA3vj6ugSBVCfLFVjlv82sMTV8mZTYaBK2Re8BSu
MHWzb7PHButf3J2xwL1RoaoeuwnJEs+mgP8oFeprf5T4ugjwMbN/FmcxTm2DQlt8
ZbnRFiuBIO/D30TtiW3DAsUcOhZasIcvtRuNZ1U1LFkXj79n4fHsBYIrTdEnbbtR
27lGITVVAHfscZsReIn8Eb3V1uJgklVnQeyMZSpb8wSaKoEVv9uLZPc/NCV9KC41
PahhxuEkTMQfFwCY6cxaeHq/nZwY1XWUYGmHioa0/cPDARyIbwNU2nC6qZNxGCuQ
C5NONW+cTDIqu1S7Hh07B+oRA6MIW8iLZUUdt0kxv0L0ZTawJRk3Kgu7AYPl66CN
cI/n4fNPsAEcPHnMYfk+L+xduO89krrlu38eGAX2a5Z15ZKlaV2NDHlermErcfgg
jsSQKFlYiDiAkjS8hfix
=zUym
-----END PGP SIGNATURE-----
Reply to: