Your message dated Sun, 23 Nov 2025 13:21:36 +0000
with message-id <[email protected]>
and subject line Bug#1119544: fixed in railcontrol 24+dfsg1-2
has caused the Debian Bug report #1119544,
regarding railcontrol: please build using the default build flags
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1119544: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119544
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: railcontrol
Version: 24+dfsg1-1
User: [email protected]
Usertags: hardening-buildflags
railcontrol is not currently using the default build flags set by
dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.
Please make sure that railcontrol builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.
In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
railcontrol, the flags are either ignored or overridden.
The most common reasons for this are:
Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles
Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.
In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":
set(CMAKE_CXX_FLAGS "-O2")
If the intention is to append to CXXFLAGS, one should use the following
instead:
set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")
See #655870 for a similar autotools example.
Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags
Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).
Others attempt to append to the variables, but end up accidentally
overriding the defaults:
#!/usr/bin/make -f
export CFLAGS += -pipe -fPIC -Wall
%:
dh $@
Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).
For a detailed analysis of this issue, see:
https://people.debian.org/~ema/nocflags_paper.pdf (eprint: hal-05334704)
--- End Message ---
--- Begin Message ---
Source: railcontrol
Source-Version: 24+dfsg1-2
Done: Bruno Kleinert <[email protected]>
We believe that the bug you reported is fixed in the latest version of
railcontrol, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bruno Kleinert <[email protected]> (supplier of updated railcontrol package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 23 Nov 2025 13:47:16 +0100
Source: railcontrol
Architecture: source
Version: 24+dfsg1-2
Distribution: unstable
Urgency: medium
Maintainer: Bruno Kleinert <[email protected]>
Changed-By: Bruno Kleinert <[email protected]>
Closes: 1119544
Changes:
railcontrol (24+dfsg1-2) unstable; urgency=medium
.
* Harden build (Closes: #1119544)
+ Added read-compiler-flags-from-environment.patch
* Fixed drop-in-versioncpp.patch to report version 24
Checksums-Sha1:
0bda7616deed7eccbbdb39ea8d6574d8930b12fa 1906 railcontrol_24+dfsg1-2.dsc
edbc6fd68cb1bafb8656d352225c42ca8d75999c 15596
railcontrol_24+dfsg1-2.debian.tar.xz
4e80eaaea823884b0e983678df9e7e854f0efc7e 5625
railcontrol_24+dfsg1-2_source.buildinfo
Checksums-Sha256:
dec1b49f47e1bcbf11eee684781793db3c54d6ef5cfd2309739fe9c2e8b5ead5 1906
railcontrol_24+dfsg1-2.dsc
291839e45bfe0fa49c95a7450f439e1a2cc46de761cd5ef4efebcde1fe25cafc 15596
railcontrol_24+dfsg1-2.debian.tar.xz
6b3c086e4c7c23643badefb9e490953d3c8f0c9d5964c72850a0bb6cfd80d636 5625
railcontrol_24+dfsg1-2_source.buildinfo
Files:
cc1afc0b8f3d6ae3f26ae764f9e01a03 1906 misc optional railcontrol_24+dfsg1-2.dsc
f24799993806301b4f2aba5c32a39002 15596 misc optional
railcontrol_24+dfsg1-2.debian.tar.xz
f206b65e8ba8f3b24f13c382eacbe5a6 5625 misc optional
railcontrol_24+dfsg1-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEbNBoYg3hPRuThXIzSwBpzPZSeEcFAmkjBHgACgkQSwBpzPZS
eEfnBBAAzt7dbLzNUZzb/tUai2aRbqbuAyXH1VaDVVPmhTsG+qYAlLKy5TlUx98t
xXVkOEKW0S7K5GaaQKWvsfvhG9KGC2M6w6WxLua8CbF5Guz3VM81+9kODLjVHO93
o8FGZ1MPQltukzCMm6ncMDsbSCOuBvlAk0/HLtrUrFORu1YntJvcngWZO7Pzw5YY
0lpxIpNidRntH5kCZ3aL+VneZcfEQl2hizJqRzxkeRXqFSczJr3rlMiQFrC87Knr
Ng/6zFKYzBzLninL/khp9MZicZGRbNeZGRV+7U3Ni7GxI3bkEKtEf1gCdx28MKa+
VFfGjWtMv3ES7IqbIs6mz+5LVoO/kTQFViGJhQQNcCXiokyFCuSZqxe5bXUH0E/V
M4mZLKfqFP6nnb+Hx9+CEIryhUpgY2k/e3IyPas+A2l3j7ouyehEFyYIaRSlTJHd
ZGvEDfPkxV69Jp0wiSUOWZ5g7ekC+IKcyIr22yINkmpdEQ/roUvCFHWhOm+4hDuX
XtYh9IqkLrUIDzxx85JFhUwKcFoxIpqIDYk0yHHmaLJTgP4pZJbryouRXxeY+0XI
cACtFj+xMg2iXv1xopXaD6XvaMXDkfM//cbPA/0fVC+fallzl1cy+bO7y0qiPvhv
bIv7OsZBbiwUPfe3sy2j6K6Ayww8T0kZufjFWXIp9kt27aZ2P7A=
=pQdi
-----END PGP SIGNATURE-----
pgpbeP9_Y5fPx.pgp
Description: PGP signature
--- End Message ---
