Your message dated Mon, 17 Nov 2025 19:19:11 +0000
with message-id <[email protected]>
and subject line Bug#1119452: fixed in ips 4.2-1
has caused the Debian Bug report #1119452,
regarding ips: please build using the default build flags
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1119452: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119452
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: ips
Version: 4.0-1.2
User: [email protected]
Usertags: hardening-buildflags
ips is not currently using the default build flags set by dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.
Please make sure that ips builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.
In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
ips, the flags are either ignored or overridden.
The most common reasons for this are:
Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles
Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.
In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":
set(CMAKE_CXX_FLAGS "-O2")
If the intention is to append to CXXFLAGS, one should use the following
instead:
set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")
See #655870 for a similar autotools example.
Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags
Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).
Others attempt to append to the variables, but end up accidentally
overriding the defaults:
#!/usr/bin/make -f
export CFLAGS += -pipe -fPIC -Wall
%:
dh $@
Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).
For a detailed analysis of this issue, see:
https://people.debian.org/~ema/nocflags_paper.pdf (eprint: hal-05334704)
--- End Message ---
--- Begin Message ---
Source: ips
Source-Version: 4.2-1
Done: Andreas Tille <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ips, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Tille <[email protected]> (supplier of updated ips package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 17 Nov 2025 18:44:50 +0100
Source: ips
Architecture: source
Version: 4.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian QA Group <[email protected]>
Changed-By: Andreas Tille <[email protected]>
Closes: 1119452 1120783
Changes:
ips (4.2-1) unstable; urgency=medium
.
* QA upload.
* New upstream version
* Orphan package
Closes: #1120783
* Maintain in Debian team
* Add Homepage
* d/watch: Version: 5
* d/copyright: DEP5
* Build-Depends: libncurses5-dev => libncurses-dev
* Do not explain quilt usage in d/README.source
* d/rules: Short dh
* d/dirs: Removed
* Standards-Version: 4.7.2 (routine-update)
* debhelper-compat 13 (routine-update)
* debputy lint --auto-fix (routine-update)
* Use default build flags
Closes: #1119452
Checksums-Sha1:
45ffd14b986282dad69508b6f25f63bddd7e9b49 1807 ips_4.2-1.dsc
e159f962d7762dc8ee2e39966f7c19c46004dc47 100123 ips_4.2.orig.tar.gz
a15cc30df2d77e0edae87086b6bc74f5eb401f02 3728 ips_4.2-1.debian.tar.xz
c9721d4e232c351715622bc6d88b50d2124d00c5 6302 ips_4.2-1_amd64.buildinfo
Checksums-Sha256:
6c2df85b5ef8831955090638ae7022d00c8659c5508da2800cd7848ea6151f71 1807
ips_4.2-1.dsc
e63e23443babb0d23d6927c5f2f9107f067010befa363041801f1473ba4eafca 100123
ips_4.2.orig.tar.gz
3a2616a32b354c728531193f35f79e85f6300b2bbe1ce84ed085c5c01a68f008 3728
ips_4.2-1.debian.tar.xz
6c9cf9311e4b1dc56c00fadfa69b1eff529cf654b6d5e24eefbc101600d1ded9 6302
ips_4.2-1_amd64.buildinfo
Files:
95b01efc94749fd4d8dcea942479f5a9 1807 admin optional ips_4.2-1.dsc
5d90efbdb864df2356d0df4beb7a4950 100123 admin optional ips_4.2.orig.tar.gz
3f2d3cb79886dc55de1d30ef0bd67ba4 3728 admin optional ips_4.2-1.debian.tar.xz
7cb9b474545a5629de4920842e733d9c 6302 admin optional ips_4.2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmkbbpcRHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtHvihAAjzJ0tDKHtYNiAO36WmZTkGOUm10h9qkg
vWXo4A2DAHXmBkVWfGxSLP0tz+woGqetwHlr+vKLvCyWNfkj7vNBPV1LuLeaAOB7
pJWqsyV2Xnrno/nOJvP/MTJGm1wKe6JgwzqbXyqdlEjpi7TA+9WFoNUTSEGHr3uP
AEw/Iw9xwOq3gvgWVPbJQgE6jpauV/6VIuYiefiEonlut7Mf4GINvehrKrvXhxTF
zIfzQgN+mZiL1B5qs8RSVP8gDFr1WhWnxMZNl5GBrNgW/JMfrPUvw0VLnEEmfvHf
rxUaN7uIjXQk5fmWTgoiD84Vbw8hCZ6Pwy9vqfTqeW5IhJiuMZl8oe1kb528NqR+
CLtKf7XqBjom9sfrhYVkHbT06bNqromkJnqZOPJEjPgjS9sxkVDWzAFUcvtncs70
Tig1FwuBnkllSt7U63DNARlyjKxAZOcuHHDNX80JrzFYpgDs97GTStZkT8iA0QSB
DakmAHe0CrGUlrDXTIx0AmpAOJobfD3G/NxcbB82J3lv/SJZQFWcjooKXkY+Pkkg
k0OaFmdsgyHQeqyJm7zHItEuo5pPKZV9TOsfg8tFbeV4i1OlOoA4h6eX8hVVxIps
VhNrWCuyOSF84IET9MFANSGad6Q4iUDCgvxGBck+CpUrHEUk8ow5QMqevQlYaYmo
zuHeqSjg0as=
=bFeP
-----END PGP SIGNATURE-----
pgpstHJDZxcFT.pgp
Description: PGP signature
--- End Message ---
