[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1119351: marked as done (asmixer: please build using the default build flags)

Your message dated Sat, 29 Nov 2025 17:35:38 +0000
with message-id <E1vPOrC-003mMl-0h@fasolo.debian.org>
and subject line Bug#1119351: fixed in asmixer 0.5-18
has caused the Debian Bug report #1119351,
regarding asmixer: please build using the default build flags
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1119351: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119351
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: asmixer
Version: 0.5-17
User: debian-security@lists.debian.org
Usertags: hardening-buildflags

asmixer is not currently using the default build flags set by dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.

Please make sure that asmixer builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.

In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
asmixer, the flags are either ignored or overridden.

The most common reasons for this are:

Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles

Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.

In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":

 set(CMAKE_CXX_FLAGS "-O2")

If the intention is to append to CXXFLAGS, one should use the following
instead:

 set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")

See #655870 for a similar autotools example. 

Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags

Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).

Others attempt to append to the variables, but end up accidentally
overriding the defaults:

 #!/usr/bin/make -f
 export CFLAGS += -pipe -fPIC -Wall

 %:
 	dh $@

Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).

For a detailed analysis of this issue, see:
https://people.debian.org/~ema/nocflags_paper.pdf (eprint: hal-05334704)

--- End Message ---
--- Begin Message --- 
Source: asmixer
Source-Version: 0.5-18
Done: Andreas Tille <tille@debian.org>

We believe that the bug you reported is fixed in the latest version of
asmixer, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1119351@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Tille <tille@debian.org> (supplier of updated asmixer package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 29 Nov 2025 17:45:49 +0100
Source: asmixer
Architecture: source
Version: 0.5-18
Distribution: unstable
Urgency: medium
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Andreas Tille <tille@debian.org>
Closes: 1119351
Changes:
 asmixer (0.5-18) unstable; urgency=medium
 .
   * QA upload.
   * Maintain package in Debian team on Salsa
   * Point Homepage to webarchive
   * d/copyright: DEP5
   * d/rules: Short dh
   * Make sure build flags will be used
     Closes: #1119351
   * Standards-Version: 4.7.2 (routine-update)
   * Remove trailing whitespace in debian/changelog (routine-update)
   * Remove trailing whitespace in debian/control (routine-update)
   Set debhelper-compat version in Build-Depends.
Checksums-Sha1:
 5251260f977bde94353047a2b7d06035855bc40e 1931 asmixer_0.5-18.dsc
 0c75992ea35946e6c919f7fc41f1168798bcc251 4100 asmixer_0.5-18.debian.tar.xz
 4e4b74ac551920d25918312393b93a0fae87cb65 6099 asmixer_0.5-18_amd64.buildinfo
Checksums-Sha256:
 ca4bd0f1c534a53d35e0761e57cb95bef5eaf05f326e37d0178e05bd60ef2d52 1931 asmixer_0.5-18.dsc
 1442c3264a2468b270cd6ad724b92ad6bb5ef6d346149dc3b967a686e4dbba81 4100 asmixer_0.5-18.debian.tar.xz
 90c846bec9813b12534ce0d983d2cd000d34285cbd49481fe38cf141e08bda9f 6099 asmixer_0.5-18_amd64.buildinfo
Files:
 56b3076dd54e13195c90298ffb16fefc 1931 sound optional asmixer_0.5-18.dsc
 af70f4fec044e059b0334d3d4536dd53 4100 sound optional asmixer_0.5-18.debian.tar.xz
 ef91b8e68d4befbe86678c5b64cf9f6a 6099 sound optional asmixer_0.5-18_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmkrJR8RHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtGzSQ/9EUl88CtvRdhLwaznzspSVvADKky+LJq+
pgqfzxGKiwH9oudc/6mU0Os6xeYeYF0f158QmUGFQ8cV/qslIslQ6AEaGYTy7/uQ
yfmRNJpFnrScNruDZMlGW3YdgcHxxIYwb7CJQGqqDOPwtto72ZMqmjRvUgaBftaD
2xuAosmRRJGfxseOOSyW+z/ArJaP7frOthVnqAzcRQzjsPgqlF8lnYYfABwihH5A
4fw75twS+yd1hEg8tZ2Y8EtuheoL0gjLgGxZKpbQAHFwl01HbtExpjSjPxiuSOXZ
56dBTAKHNBdz2gU6ptYTkIS4ZHGJU/xYFk0LvJJFM+7x7VEcAFx0U+gm5D+BgBhu
Di1wP1XXc9FVhL/IK6NVD39CSVlLK/H8q0m+2q7RlINbx5is3zcV23szuiQiEzkW
2zsUUxSd86SxaAf2uDx57F1fRD5+kiKTt2iyb82fVSgxU0cB56v6b0P/6ik0P6iM
sWTQpIBoVYwWaVEbMCkXHrAYgRF0w58JbOAEVXow66Vvix+empecCQQih6ge3bE4
IKDuCCe1pLxA4pge6vWkCcvXL7rtWrVZFUplh6sQ7M0t70WMeYQuk7X/SSr+WPH8
PZ82h0GBEi5y43C+xX4YcwBDoGEhxJoaAaCNt3YoByQf+NZh+ShC3BxNe66DTk9W
sGrzW0Rqkp0=
=amRy
-----END PGP SIGNATURE-----

Attachment: pgp27NlreF44O.pgp
Description: PGP signature


--- End Message ---
Reply to: