[From nobody Tue Sep 15 08:07:08 2026 Received: (at submit) by bugs.debian.org; 14 Sep 2026 14:48:54 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-15.0 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FOURLA,HAS_PACKAGE,RCVD_IN_DNSWL_MED,SPF_HELO_PASS, SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 49; hammy, 150; neutral, 274; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian, 0.000-+--HTo:N*System Return-path: <pmenzel@molgen.mpg.de> Received: from mx3.molgen.mpg.de ([141.14.17.11]:40961) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <pmenzel@molgen.mpg.de>) id 1x67zJ-0028mB-1k for submit@bugs.debian.org; Mon, 14 Sep 2026 14:48:54 +0000 Received: from [141.14.220.42] (g42.guest.molgen.mpg.de [141.14.220.42]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pmenzel) by mx.molgen.mpg.de (Postfix) with ESMTPSA id 6B14E4C442F7D1 for <submit@bugs.debian.org>; Mon, 14 Sep 2026 16:48:40 +0200 (CEST) Content-Type: multipart/mixed; boundary="------------LYifeMh0GVN4iOt8h8cSZ79J" Message-ID: <34657bb3-8261-46c0-b160-45b12c7041de@molgen.mpg.de> Date: Mon, 14 Sep 2026 16:48:40 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Debian Bug Tracking System <submit@bugs.debian.org> From: Paul Menzel <pmenzel@molgen.mpg.de> Subject: strongswan: FTBFS with GCC 16: custom printf specifier %B rejected because -Wno-format is overridden DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=molgen.mpg.de; s=20260906; t=1789397320; h=from:from:subject:date:message-id:mime-version:content-type:content-transfer-encoding; bh=l1Z8JVF/3DGud9rRyHijBPGlcNcvWXj4LpH0z42knZk=; b=FSWKlMrPAwzByT4GdVYMRpDmcBKcgwKLCgIoB7p6JO7Vj+vj0p8/NQAkATKnQvtBtApvqvxVhR+t 3rnB2fz3LyFEYjK+C1BYfhRf6L469mG+e4TmNhyfN+xYm8UQ1Jtc82GravOwBBmeKfFb2V4evJEXQ9 v1Urr4EZy9/IRU+UAYUjQyH3y/hEyjgo7s+f2BjPflpssIP74Thi+j9cDYgPXI5VfrdLs+WRZWczaQ neOVDXSkDuT5yE6kbTmkcHSKtVpxaF274NfUH+ZNVKURNIRMJeT8nZnSn4whgwnxycraNjMavQ9BpX E4UUuSGWlTHQJpL05RYUzN3/87TZoATw== Delivered-To: submit@bugs.debian.org This is a multi-part message in MIME format. --------------LYifeMh0GVN4iOt8h8cSZ79J Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Package: strongswan Version: 6.1.0-2 Severity: serious Justification: fails to build from source Tags: patch ftbfs X-Debbugs-Cc: pmenzel@molgen.mpg.de Dear Debian folks, AI disclaimer: Analyzed and drafted by claude-opus-5, and reviewed and edited by me. Building strongswan with `debuild -us -uc -b` on Debian sid/unstable with *gcc* 4:16.1.0-3 fails: credentials/certificates/certificate_printer.c: In function 'print_x509': credentials/certificates/certificate_printer.c:90:36: error: format '%B' expects argument of type 'unsigned int', but argument 3 has type 'chunk_t *' [-Werror=format=] 90 | fprintf(f, " serial: %#B\n", &chunk); | ~~^ ~~~~~~ | | | | | chunk_t * | unsigned int credentials/certificates/certificate_printer.c:105:30: error: unknown conversion type character 'Y' in format [-Werror=format=] 105 | fprintf(f, "%Y", id); | ^ Analysis -------- strongSwan registers custom printf conversion specifiers at runtime via register_printf_specifier(3) – %B prints a chunk_t, %Y an identification_t, %H a host_t and so on (see src/libstrongswan/utils/printf_hook/printf_hook_glibc.c). GCC knows nothing about these, so upstream’s configure.ac disables the format warnings: # disable some warnings, whether explicitly enabled above or by default # these are not compatible with our custom printf specifiers WARN_CFLAGS="$WARN_CFLAGS -Wno-format" WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security" [...] # add the flags before existing CFLAGS so warning flags can be overridden CFLAGS="$WARN_CFLAGS $CFLAGS" Note that these flags are *prepended*. Since d/rules sets `DEB_BUILD_MAINT_OPTIONS=hardening=+all`, dpkg-buildflags puts `-Wformat -Werror=format-security` into CFLAGS, i.e. after -Wno-format, which re-enables format checking for the whole package: x86_64-linux-gnu-gcc [...] -Wno-format -Wno-format-security [...] \ -g -O2 [...] -Wformat -Werror=format-security -fcf-protection \ -c credentials/certificates/certificate_printer.c That has been harmless so far because GCC did not know %B either. GCC 16 does: %b/%B is C23’s conversion specifier for binary output, so GCC now type-checks the argument and rejects the chunk_t pointer. The runtime behavior is not affected – register_printf_specifier() still overrides glibc’s built-in %B, verified with glibc 2.43 using a small test program. So this is purely about the warning flags. Proposed fix ------------ The root cause is upstream’s flag ordering: -Wno-format and -Wno-format-security are not a style preference, they are required for the code to compile at all, so they must not be overridable via CFLAGS. The attached patch keeps them in a separate variable and appends it, leaving the remaining warning flags overridable as before: -# add the flags before existing CFLAGS so warning flags can be overridden -CFLAGS="$WARN_CFLAGS $CFLAGS" +# add the flags before existing CFLAGS so warning flags can be overridden, +# but append those required by our custom printf specifiers so they can't be +# re-enabled by flags in CFLAGS +CFLAGS="$WARN_CFLAGS $CFLAGS $PRINTF_CFLAGS" Alternatively, or in addition, d/rules can append the flags itself, which does not depend on the patch surviving the next upstream merge: export DEB_CFLAGS_MAINT_APPEND=-Wno-format -Wno-format-security With either change the package builds cleanly, including with an additional -Werror=format in CFLAGS. Kind regards, Paul --------------LYifeMh0GVN4iOt8h8cSZ79J Content-Type: text/x-patch; charset=UTF-8; name="05_dont-re-enable-wformat.patch" Content-Disposition: attachment; filename="05_dont-re-enable-wformat.patch" Content-Transfer-Encoding: base64 RnJvbTogUGF1bCBNZW56ZWwgPHBtZW56ZWxAbW9sZ2VuLm1wZy5kZT4KRGF0ZTogTW9uLCAx NCBTZXAgMjAyNiAxNjozMDowMCArMDIwMApTdWJqZWN0OiBEbyBub3QgbGV0IENGTEFHUyBy ZS1lbmFibGUgLVdmb3JtYXQKCnN0cm9uZ1N3YW4gcmVnaXN0ZXJzIGN1c3RvbSBwcmludGYg c3BlY2lmaWVycyAoJUIsICVILCAlWSwgLi4uKSBhdCBydW50aW1lCnZpYSByZWdpc3Rlcl9w cmludGZfc3BlY2lmaWVyKDMpLCB3aGljaCBHQ0Mga25vd3Mgbm90aGluZyBhYm91dCwgc28K Y29uZmlndXJlIGFkZHMgLVduby1mb3JtYXQgYW5kIC1Xbm8tZm9ybWF0LXNlY3VyaXR5LiAg VGhvc2UgYXJlIHByZXBlbmRlZAp0byBDRkxBR1MsIHRob3VnaCwgc28gRGViaWFuJ3MgaGFy ZGVuaW5nIGJ1aWxkIGZsYWdzICgtV2Zvcm1hdAotV2Vycm9yPWZvcm1hdC1zZWN1cml0eSkg cmUtZW5hYmxlIGZvcm1hdCBjaGVja2luZy4KCldpdGggR0NDIDE2LCB3aGljaCBrbm93cyAl QiBhcyBDMjMncyBjb252ZXJzaW9uIHNwZWNpZmllciBmb3IgYmluYXJ5Cm91dHB1dCwgdGhp cyBtYWtlcyB0aGUgYnVpbGQgZmFpbDoKCiAgY3JlZGVudGlhbHMvY2VydGlmaWNhdGVzL2Nl cnRpZmljYXRlX3ByaW50ZXIuYzogSW4gZnVuY3Rpb24gJ3ByaW50X3g1MDknOgogIGNyZWRl bnRpYWxzL2NlcnRpZmljYXRlcy9jZXJ0aWZpY2F0ZV9wcmludGVyLmM6OTA6MzY6IGVycm9y OiBmb3JtYXQgJyVCJyBleHBlY3RzIGFyZ3VtZW50IG9mIHR5cGUgJ3Vuc2lnbmVkIGludCcs IGJ1dCBhcmd1bWVudCAzIGhhcyB0eXBlICdjaHVua190IConIFstV2Vycm9yPWZvcm1hdD1d CiAgICAgOTAgfCAgICAgICAgIGZwcmludGYoZiwgIiAgc2VyaWFsOiAgICAlI0JcbiIsICZj aHVuayk7CiAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB+fl4g ICAgIH5+fn5+fgogICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgICB8CiAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgIGNodW5rX3QgKgogICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB1bnNpZ25lZCBpbnQKCktlZXAgdGhlIHR3byBmbGFncyBpbiBhIHNlcGFyYXRl IHZhcmlhYmxlIGFuZCBhcHBlbmQgaXQgdG8gQ0ZMQUdTLCBzbyB0aGV5CmFsd2F5cyB0YWtl IGVmZmVjdC4gIFRoZSByZW1haW5pbmcgd2FybmluZyBmbGFncyBzdGF5IG92ZXJyaWRhYmxl IGFzIGJlZm9yZS4KClRoZSBjdXN0b20gc3BlY2lmaWVycyBrZWVwIHdvcmtpbmcgYXQgcnVu dGltZTogcmVnaXN0ZXJfcHJpbnRmX3NwZWNpZmllcigpCnN0aWxsIG92ZXJyaWRlcyBnbGli YydzIGJ1aWx0LWluICVCICh2ZXJpZmllZCB3aXRoIGdsaWJjIDIuNDMpLgotLS0KZGlmZiAt LWdpdCBhL2NvbmZpZ3VyZS5hYyBiL2NvbmZpZ3VyZS5hYwppbmRleCA1MGIwNmM0MzkuLmVl ZGFmNDYwNCAxMDA2NDQKLS0tIGEvY29uZmlndXJlLmFjCisrKyBiL2NvbmZpZ3VyZS5hYwpA QCAtMTQwNiw5ICsxNDA2LDEwIEBAIGVsc2UKIAlBQ19NU0dfUkVTVUxUKFtub10pCiBmaQog IyBkaXNhYmxlIHNvbWUgd2FybmluZ3MsIHdoZXRoZXIgZXhwbGljaXRseSBlbmFibGVkIGFi b3ZlIG9yIGJ5IGRlZmF1bHQKLSMgdGhlc2UgYXJlIG5vdCBjb21wYXRpYmxlIHdpdGggb3Vy IGN1c3RvbSBwcmludGYgc3BlY2lmaWVycwotV0FSTl9DRkxBR1M9IiRXQVJOX0NGTEFHUyAt V25vLWZvcm1hdCIKLVdBUk5fQ0ZMQUdTPSIkV0FSTl9DRkxBR1MgLVduby1mb3JtYXQtc2Vj dXJpdHkiCisjIHRoZXNlIGFyZSBub3QgY29tcGF0aWJsZSB3aXRoIG91ciBjdXN0b20gcHJp bnRmIHNwZWNpZmllcnMsIHNvIHRoZXkgYXJlCisjIGtlcHQgc2VwYXJhdGUgYmVsb3cgYW5k IG11c3Qgbm90IGJlIG92ZXJyaWRhYmxlIHZpYSBDRkxBR1MKK1BSSU5URl9DRkxBR1M9Ii1X bm8tZm9ybWF0IgorUFJJTlRGX0NGTEFHUz0iJFBSSU5URl9DRkxBR1MgLVduby1mb3JtYXQt c2VjdXJpdHkiCiAjIHdlIGdlbmVyYWxseSB1c2UgY29tbWVudHMsIGJ1dCBHQ0MgZG9lc24n dCBzZWVtIHRvIHJlY29nbml6ZSBtYW55IG9mIHRoZW0KIFdBUk5fQ0ZMQUdTPSIkV0FSTl9D RkxBR1MgLVduby1pbXBsaWNpdC1mYWxsdGhyb3VnaCIKICMgd2Ugb2Z0ZW4gb21pdCBmaWVs ZHMgd2hlbiBpbml0aWFsaXppbmcgc3RydWN0cyAoZS5nLiB3aGVuIHVzaW5nIElOSVQpCkBA IC0xNDIxLDggKzE0MjIsMTEgQEAgV0FSTl9DRkxBR1M9IiRXQVJOX0NGTEFHUyAtV25vLXNp Z24tY29tcGFyZSIKIFdBUk5fQ0ZMQUdTPSIkV0FSTl9DRkxBR1MgLVduby10eXBlLWxpbWl0 cyIKICMgd2Ugb2Z0ZW4gZG9uJ3QgdXNlIGZ1bmN0aW9uIHBhcmFtZXRlcnMgd2hlbiBpbXBs ZW1lbnRpbmcgaW50ZXJmYWNlcwogV0FSTl9DRkxBR1M9IiRXQVJOX0NGTEFHUyAtV25vLXVu dXNlZC1wYXJhbWV0ZXIiCi0jIGFkZCB0aGUgZmxhZ3MgYmVmb3JlIGV4aXN0aW5nIENGTEFH UyBzbyB3YXJuaW5nIGZsYWdzIGNhbiBiZSBvdmVycmlkZGVuCi1DRkxBR1M9IiRXQVJOX0NG TEFHUyAkQ0ZMQUdTIgorIyBhZGQgdGhlIGZsYWdzIGJlZm9yZSBleGlzdGluZyBDRkxBR1Mg c28gd2FybmluZyBmbGFncyBjYW4gYmUgb3ZlcnJpZGRlbiwKKyMgYnV0IGFwcGVuZCB0aG9z ZSByZXF1aXJlZCBieSBvdXIgY3VzdG9tIHByaW50ZiBzcGVjaWZpZXJzIHNvIHRoZXkgY2Fu J3QgYmUKKyMgcmUtZW5hYmxlZCBieSBmbGFncyBpbiBDRkxBR1MgKGUuZy4gdGhlIC1XZm9y bWF0IGFkZGVkIGJ5IERlYmlhbidzIGhhcmRlbmluZworIyBidWlsZCBmbGFncywgd2hpY2gg bWFrZXMgR0NDIDE2IHJlamVjdCAlQiBhcyBDMjMncyBiaW5hcnkgY29udmVyc2lvbikKK0NG TEFHUz0iJFdBUk5fQ0ZMQUdTICRDRkxBR1MgJFBSSU5URl9DRkxBR1MiCiAKICMgPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KICMgIGNvbGxlY3Qg cGx1Z2luIGxpc3QgZm9yIHN0cm9uZ1N3YW4gY29tcG9uZW50cwo= --------------LYifeMh0GVN4iOt8h8cSZ79J-- ]