From: Paul Menzel <pmenzel@molgen.mpg.de>
Date: Mon, 14 Sep 2026 16:30:00 +0200
Subject: Do not let CFLAGS re-enable -Wformat

strongSwan registers custom printf specifiers (%B, %H, %Y, ...) at runtime
via register_printf_specifier(3), which GCC knows nothing about, so
configure adds -Wno-format and -Wno-format-security.  Those are prepended
to CFLAGS, though, so Debian's hardening build flags (-Wformat
-Werror=format-security) re-enable format checking.

With GCC 16, which knows %B as C23's conversion specifier for binary
output, this makes the build fail:

  credentials/certificates/certificate_printer.c: In function 'print_x509':
  credentials/certificates/certificate_printer.c:90:36: error: format '%B' expects argument of type 'unsigned int', but argument 3 has type 'chunk_t *' [-Werror=format=]
     90 |         fprintf(f, "  serial:    %#B\n", &chunk);
        |                                  ~~^     ~~~~~~
        |                                    |     |
        |                                    |     chunk_t *
        |                                    unsigned int

Keep the two flags in a separate variable and append it to CFLAGS, so they
always take effect.  The remaining warning flags stay overridable as before.

The custom specifiers keep working at runtime: register_printf_specifier()
still overrides glibc's built-in %B (verified with glibc 2.43).
---
diff --git a/configure.ac b/configure.ac
index 50b06c439..eedaf4604 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1406,9 +1406,10 @@ else
 	AC_MSG_RESULT([no])
 fi
 # disable some warnings, whether explicitly enabled above or by default
-# these are not compatible with our custom printf specifiers
-WARN_CFLAGS="$WARN_CFLAGS -Wno-format"
-WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security"
+# these are not compatible with our custom printf specifiers, so they are
+# kept separate below and must not be overridable via CFLAGS
+PRINTF_CFLAGS="-Wno-format"
+PRINTF_CFLAGS="$PRINTF_CFLAGS -Wno-format-security"
 # we generally use comments, but GCC doesn't seem to recognize many of them
 WARN_CFLAGS="$WARN_CFLAGS -Wno-implicit-fallthrough"
 # we often omit fields when initializing structs (e.g. when using INIT)
@@ -1421,8 +1422,11 @@ WARN_CFLAGS="$WARN_CFLAGS -Wno-sign-compare"
 WARN_CFLAGS="$WARN_CFLAGS -Wno-type-limits"
 # we often don't use function parameters when implementing interfaces
 WARN_CFLAGS="$WARN_CFLAGS -Wno-unused-parameter"
-# add the flags before existing CFLAGS so warning flags can be overridden
-CFLAGS="$WARN_CFLAGS $CFLAGS"
+# add the flags before existing CFLAGS so warning flags can be overridden,
+# but append those required by our custom printf specifiers so they can't be
+# re-enabled by flags in CFLAGS (e.g. the -Wformat added by Debian's hardening
+# build flags, which makes GCC 16 reject %B as C23's binary conversion)
+CFLAGS="$WARN_CFLAGS $CFLAGS $PRINTF_CFLAGS"
 
 # ===============================================
 #  collect plugin list for strongSwan components