[Pkg-swan-devel] Bug#1147712: strongswan: FTBFS with GCC 16: custom printf specifier %B rejected because -Wno-format is overridden

[Paul Menzel]

Package: strongswan
Version: 6.1.0-2
Severity: serious
Justification: fails to build from source
Tags: patch ftbfs
X-Debbugs-Cc: pmenzel at molgen.mpg.de


Dear Debian folks,


AI disclaimer: Analyzed and drafted by claude-opus-5, and reviewed and 
edited by me.

Building strongswan with `debuild -us -uc -b` on Debian sid/unstable
with *gcc* 4:16.1.0-3 fails:

     credentials/certificates/certificate_printer.c: In function 
'print_x509':
     credentials/certificates/certificate_printer.c:90:36: error: format 
'%B' expects argument of type 'unsigned int', but argument 3 has type 
'chunk_t *' [-Werror=format=]
        90 |         fprintf(f, "  serial:    %#B\n", &chunk);
           |                                  ~~^     ~~~~~~
           |                                    |     |
           |                                    |     chunk_t *
           |                                    unsigned int
     credentials/certificates/certificate_printer.c:105:30: error: 
unknown conversion type character 'Y' in format [-Werror=format=] 

       105 |                 fprintf(f, "%Y", id); 
  

           |                              ^ 
  

  
  

Analysis 
  

-------- 
  

  
  

strongSwan registers custom printf conversion specifiers at runtime via 
  

register_printf_specifier(3) – %B prints a chunk_t, %Y an 
  

identification_t, %H a host_t and so on (see 
  

src/libstrongswan/utils/printf_hook/printf_hook_glibc.c). GCC knows 
  

nothing about these, so upstream’s configure.ac disables the format 
  

warnings: 
  

  
  

     # disable some warnings, whether explicitly enabled above or by 
default 

     # these are not compatible with our custom printf specifiers 
  

     WARN_CFLAGS="$WARN_CFLAGS -Wno-format" 
  

     WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security" 
  

     [...] 
  

     # add the flags before existing CFLAGS so warning flags can be 
overridden 

     CFLAGS="$WARN_CFLAGS $CFLAGS"

Note that these flags are *prepended*. Since d/rules sets 
  

`DEB_BUILD_MAINT_OPTIONS=hardening=+all`, dpkg-buildflags puts 
  

`-Wformat -Werror=format-security` into CFLAGS, i.e. after -Wno-format, 
  

which re-enables format checking for the whole package: 
  

  
  

     x86_64-linux-gnu-gcc [...] -Wno-format -Wno-format-security [...] \ 
  

       -g -O2 [...] -Wformat -Werror=format-security -fcf-protection \ 
  

       -c credentials/certificates/certificate_printer.c 
  

  
  

That has been harmless so far because GCC did not know %B either. GCC 16
does: %b/%B is C23’s conversion specifier for binary output, so GCC now
type-checks the argument and rejects the chunk_t pointer.

The runtime behavior is not affected – register_printf_specifier()
still overrides glibc’s built-in %B, verified with glibc 2.43 using a
small test program. So this is purely about the warning flags.

Proposed fix
------------

The root cause is upstream’s flag ordering: -Wno-format and
-Wno-format-security are not a style preference, they are required for
the code to compile at all, so they must not be overridable via CFLAGS.
The attached patch keeps them in a separate variable and appends it,
leaving the remaining warning flags overridable as before:

     -# add the flags before existing CFLAGS so warning flags can be 
overridden
     -CFLAGS="$WARN_CFLAGS $CFLAGS"
     +# add the flags before existing CFLAGS so warning flags can be 
overridden,
     +# but append those required by our custom printf specifiers so 
they can't be
     +# re-enabled by flags in CFLAGS
     +CFLAGS="$WARN_CFLAGS $CFLAGS $PRINTF_CFLAGS"

Alternatively, or in addition, d/rules can append the flags itself,
which does not depend on the patch surviving the next upstream merge:

     export DEB_CFLAGS_MAINT_APPEND=-Wno-format -Wno-format-security

With either change the package builds cleanly, including with an
additional -Werror=format in CFLAGS.


Kind regards,

Paul
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 05_dont-re-enable-wformat.patch
Type: text/x-patch
Size: 3008 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-swan-devel/attachments/20260914/8dfdd9f7/attachment.bin>