[R-pkg-team] Bug#1071358: r-cran-rgeos: FTBFS: geos.c:102:13: error: format not a string literal and no format arguments

[Santiago Vila]

Package: src:r-cran-rgeos
Version: 0.6-4-2
Severity: serious
Tags: ftbfs

Dear maintainer:

During a rebuild of all packages in unstable, your package failed to build:

--------------------------------------------------------------------------------
[...]
  debian/rules binary
dh binary --buildsystem R
    dh_update_autotools_config -O--buildsystem=R
    dh_autoreconf -O--buildsystem=R
    dh_auto_configure -O--buildsystem=R
    dh_auto_build -O--buildsystem=R
    dh_auto_test -O--buildsystem=R
    create-stamp debian/debhelper-build-stamp
    dh_testroot -O--buildsystem=R
    dh_prep -O--buildsystem=R
    dh_auto_install --destdir=debian/r-cran-rgeos/ -O--buildsystem=R
I: R packages needed for DEP8: maptools (>= 0.8-5), testthat, xml, maps
I: R Package: rgeos Version: 0.6-4
I: Building using R version 4.4.0-2
I: R API version: r-api-4.0
I: Using built-time from d/changelog: Mon, 28 Aug 2023 13:41:22 +0200
	mkdir -p /<<PKGBUILDDIR>>/debian/r-cran-rgeos/usr/lib/R/site-library
	R CMD INSTALL -l /<<PKGBUILDDIR>>/debian/r-cran-rgeos/usr/lib/R/site-library --clean . "--built-timestamp='Mon, 28 Aug 2023 13:41:22 +0200'"
* installing *source* package ‘rgeos’ ...
file ‘DESCRIPTION’ has the wrong MD5 checksum
** using staged installation
configure: CC: gcc
configure: CXX: g++ -std=gnu++17
configure: rgeos: 0.6-4
checking for /usr/bin/svnversion... no
configure: svn revision: 699
checking for geos-config... /usr/bin/geos-config
checking geos-config usability... yes
configure: GEOS version: 3.12.1
checking geos version at least 3.2.0... yes
checking geos-config clibs... yes
checking geos_c.h  presence and usability... yes
checking geos: linking with libgeos_c... yes
configure: PKG_CPPFLAGS:  -I/usr/include
configure: PKG_LIBS:  -L/usr/lib/x86_64-linux-gnu -lgeos_c
configure: creating ./config.status
config.status: creating src/Makevars
** libs
using C compiler: ‘gcc (Debian 13.2.0-25) 13.2.0’
using C++ compiler: ‘g++ (Debian 13.2.0-25) 13.2.0’
make[1]: Entering directory '/<<PKGBUILDDIR>>/src'
g++ -std=gnu++17 -I"/usr/share/R/include" -DNDEBUG -I/usr/include -I'/usr/lib/R/site-library/sp/include'     -fpic  -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/r-base-4.4.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2   -c dummy.cc -o dummy.o
cc1plus: warning: ‘-Werror=’ argument ‘-Werror=implicit-function-declaration’ is not valid for C++
gcc -I"/usr/share/R/include" -DNDEBUG -I/usr/include -I'/usr/lib/R/site-library/sp/include'     -fpic  -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/r-base-4.4.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2  -c init.c -o init.o
gcc -I"/usr/share/R/include" -DNDEBUG -I/usr/include -I'/usr/lib/R/site-library/sp/include'     -fpic  -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/r-base-4.4.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2  -c local_stubs.c -o local_stubs.o
gcc -I"/usr/share/R/include" -DNDEBUG -I/usr/include -I'/usr/lib/R/site-library/sp/include'     -fpic  -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/r-base-4.4.0=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wdate-time -D_FORTIFY_SOURCE=2  -c rgeos.c -o rgeos.o
rgeos.c: In function ‘__warningHandler’:
rgeos.c:102:13: error: format not a string literal and no format arguments [-Werror=format-security]
   102 |     warning(buf);
       |             ^~~
cc1: some warnings being treated as errors
make[1]: *** [/usr/lib/R/etc/Makeconf:195: rgeos.o] Error 1
make[1]: Leaving directory '/<<PKGBUILDDIR>>/src'
make[1]: Entering directory '/<<PKGBUILDDIR>>/src'
make[1]: Leaving directory '/<<PKGBUILDDIR>>/src'
ERROR: compilation failed for package ‘rgeos’
* removing ‘/<<PKGBUILDDIR>>/debian/r-cran-rgeos/usr/lib/R/site-library/rgeos’
dh_auto_install: error: R CMD INSTALL -l /<<PKGBUILDDIR>>/debian/r-cran-rgeos/usr/lib/R/site-library --clean . "--built-timestamp='Mon, 28 Aug 2023 13:41:22 +0200'" returned exit code 1
make: *** [debian/rules:4: binary] Error 25
dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
--------------------------------------------------------------------------------

The above is just how the build ends and not necessarily the most relevant part.
If required, the full build log is available here:

https://people.debian.org/~sanvila/build-logs/202405/

About the archive rebuild: The build was made on virtual machines
of type m6a.large and r6a.large from AWS, using sbuild and a
reduced chroot with only build-essential packages.

If you could not reproduce the bug please contact me privately, as I
am willing to provide ssh access to a virtual machine where the bug is
fully reproducible.

If this is really a bug in one of the build-depends, please use
reassign and affects, so that this is still visible in the BTS web
page for this package.

Thanks.