rtmidi package review

[James Cowgill]

On Wed, 2016-06-22 at 18:50 +0200, Jaromír Mikeš wrote:
> 2016-06-22 17:54 GMT+02:00 James Cowgill <jcowgill at debian.org>:
> > On Wed, 2016-06-22 at 17:32 +0200, Jaromír Mikeš wrote:
> > > 2016-06-22 16:49 GMT+02:00 James Cowgill <jcowgill at debian.org>:
> > > > On Wed, 2016-06-22 at 16:29 +0200, Jaromír Mikeš wrote:
> > > > > 2016-06-22 14:49 GMT+02:00 James Cowgill <jcowgill at debian.org
> > > > > >:
> > > > > > On Tue, 2016-06-21 at 22:42 +0200, Jaromír Mikeš wrote:
> > > > > > > Hi,
> > > > > > > 
> > > > > > > can someone review rtmidi package please?
> > > > [...]
> > > > > > The build system clobbers CXXFLAGS. Line 81 of configure.ac
> > > > > > seems
> > > > > > to be the culprit.
> > > > > 
> > > > > I've tried fix passing flags on this line in configure.ac
> > > > > file,
> > > > > but
> > > > > it still doesn't work :(
> > > > 
> > > > I think it works if you reenable the line which is commented
> > > > out so
> > > > that $cxxflag is appended to CXXFLAGS instead of replacing it.
> > > > Something like this:
> > > > 
> > > > --- a/configure.ac
> > > > +++ b/configure.ac
> > > > @@ -77,8 +77,7 @@ fi
> > > >  CPPFLAGS="$CPPFLAGS $cppflag"
> > > > 
> > > >  # For debugging and optimization ... overwrite default because
> > > > it
> > > > has both -g and -O2
> > > > -#CXXFLAGS="$CXXFLAGS $cxxflag"
> > > > -CXXFLAGS="$cxxflag"
> > > > +CXXFLAGS="$CXXFLAGS $cxxflag"
> > > > 
> > > >  # Check compiler and use -Wall if gnu.
> > > >  if [test $GXX = "yes" ;] then
> > > 
> > > Yes, that's exactly what I have done. But CPPFLAGS are still not
> > > pass
> > > correctly :(
> > 
> > Hmmm, I'm not sure what the problem is exactly. It works fine for
> > me
> > (both CPPFLAGS and CXXFLAGS):
> > 
> > $ DEB_BUILD_OPTIONS="qa=+canary" debuild -b -us -uc
> >  dpkg-buildpackage -rfakeroot -D -us -uc -b
> > [...]
> > /bin/bash ./libtool  --tag=CXX   --mode=compile g++
> > -DPACKAGE_NAME=\"RtMidi\" -DPACKAGE_TARNAME=\"rtmidi\"
> > -DPACKAGE_VERSION=\"2.1.1\" -DPACKAGE_STRING=\"RtMidi\ 2.1.1\"
> > -DPACKAGE_BUGREPORT=\"gary at music.mcgill.ca\" -DPACKAGE_URL=\"\"
> > -DPACKAGE=\"rtmidi\" -DVERSION=\"2.1.1\" -DSTDC_HEADERS=1
> > -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1
> > -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1
> > -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1
> > -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DSTDC_HEADERS=1
> > -DHAVE_LIBJACK=1 -DHAVE_LIBASOUND=1 -DHAVE_LIBPTHREAD=1 -I.   -
> > D__DEB_CANARY_CPPFLAGS_a36e841c5230a79c2102036d2e259848__ -Wdate-
> > time
> > -D_FORTIFY_SOURCE=2 -I/usr/include/rtmidi   -D__UNIX_JACK__
> > -D__LINUX_ALSA__  -g -O2
> > -D__DEB_CANARY_CXXFLAGS_a36e841c5230a79c2102036d2e259848__ -fstack-
> > protector-strong -Wformat -Werror=format-security -O3 -Wall -Wextra
> > -c
> > -o RtMidi.lo RtMidi.cpp
> 
> ok ... but I still have this lintian warning :(
> I: librtmidi3: hardening-no-fortify-functions
> usr/lib/x86_64-linux-gnu/librtmidi.so.3.0.0

That warning generates a lot of false-positives because sometimes
_FORTIFY_SOURCE can't find anything to fortify. As long as you can see
the define in the build logs (blhc can check this) then you can ignore
it.

Also I just spotted this:
dpkg-gencontrol: warning: Depends field of package librtmidi-dev:
unknown substitution variable ${shlibs:Depends}

James
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/attachments/20160622/6502e71f/attachment.sig>