Package: strongswan
Version: 6.1.0-2
Severity: serious
Justification: fails to build from source
Tags: patch ftbfs
X-Debbugs-Cc: [email protected]
Dear Debian folks,
AI disclaimer: Analyzed and drafted by claude-opus-5, and reviewed and
edited by me.
Building strongswan with `debuild -us -uc -b` on Debian sid/unstable
with *gcc* 4:16.1.0-3 fails:
credentials/certificates/certificate_printer.c: In function
'print_x509':
credentials/certificates/certificate_printer.c:90:36: error: format
'%B' expects argument of type 'unsigned int', but argument 3 has type
'chunk_t *' [-Werror=format=]
90 | fprintf(f, " serial: %#B\n", &chunk);
| ~~^ ~~~~~~
| | |
| | chunk_t *
| unsigned int
credentials/certificates/certificate_printer.c:105:30: error:
unknown conversion type character 'Y' in format [-Werror=format=]
105 | fprintf(f, "%Y", id);
| ^
Analysis
--------
strongSwan registers custom printf conversion specifiers at runtime via
register_printf_specifier(3) – %B prints a chunk_t, %Y an
identification_t, %H a host_t and so on (see
src/libstrongswan/utils/printf_hook/printf_hook_glibc.c). GCC knows
nothing about these, so upstream’s configure.ac disables the format
warnings:
# disable some warnings, whether explicitly enabled above or by
default
# these are not compatible with our custom printf specifiers
WARN_CFLAGS="$WARN_CFLAGS -Wno-format"
WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security"
[...]
# add the flags before existing CFLAGS so warning flags can be
overridden
CFLAGS="$WARN_CFLAGS $CFLAGS"
Note that these flags are *prepended*. Since d/rules sets
`DEB_BUILD_MAINT_OPTIONS=hardening=+all`, dpkg-buildflags puts
`-Wformat -Werror=format-security` into CFLAGS, i.e. after -Wno-format,
which re-enables format checking for the whole package:
x86_64-linux-gnu-gcc [...] -Wno-format -Wno-format-security [...] \
-g -O2 [...] -Wformat -Werror=format-security -fcf-protection \
-c credentials/certificates/certificate_printer.c
That has been harmless so far because GCC did not know %B either. GCC 16
does: %b/%B is C23’s conversion specifier for binary output, so GCC now
type-checks the argument and rejects the chunk_t pointer.
The runtime behavior is not affected – register_printf_specifier()
still overrides glibc’s built-in %B, verified with glibc 2.43 using a
small test program. So this is purely about the warning flags.
Proposed fix
------------
The root cause is upstream’s flag ordering: -Wno-format and
-Wno-format-security are not a style preference, they are required for
the code to compile at all, so they must not be overridable via CFLAGS.
The attached patch keeps them in a separate variable and appends it,
leaving the remaining warning flags overridable as before:
-# add the flags before existing CFLAGS so warning flags can be
overridden
-CFLAGS="$WARN_CFLAGS $CFLAGS"
+# add the flags before existing CFLAGS so warning flags can be
overridden,
+# but append those required by our custom printf specifiers so
they can't be
+# re-enabled by flags in CFLAGS
+CFLAGS="$WARN_CFLAGS $CFLAGS $PRINTF_CFLAGS"
Alternatively, or in addition, d/rules can append the flags itself,
which does not depend on the patch surviving the next upstream merge:
export DEB_CFLAGS_MAINT_APPEND=-Wno-format -Wno-format-security
With either change the package builds cleanly, including with an
additional -Werror=format in CFLAGS.
Kind regards,
PaulFrom: Paul Menzel <[email protected]>
Date: Mon, 14 Sep 2026 16:30:00 +0200
Subject: Do not let CFLAGS re-enable -Wformat
strongSwan registers custom printf specifiers (%B, %H, %Y, ...) at runtime
via register_printf_specifier(3), which GCC knows nothing about, so
configure adds -Wno-format and -Wno-format-security. Those are prepended
to CFLAGS, though, so Debian's hardening build flags (-Wformat
-Werror=format-security) re-enable format checking.
With GCC 16, which knows %B as C23's conversion specifier for binary
output, this makes the build fail:
credentials/certificates/certificate_printer.c: In function 'print_x509':
credentials/certificates/certificate_printer.c:90:36: error: format '%B' expects argument of type 'unsigned int', but argument 3 has type 'chunk_t *' [-Werror=format=]
90 | fprintf(f, " serial: %#B\n", &chunk);
| ~~^ ~~~~~~
| | |
| | chunk_t *
| unsigned int
Keep the two flags in a separate variable and append it to CFLAGS, so they
always take effect. The remaining warning flags stay overridable as before.
The custom specifiers keep working at runtime: register_printf_specifier()
still overrides glibc's built-in %B (verified with glibc 2.43).
---
diff --git a/configure.ac b/configure.ac
index 50b06c439..eedaf4604 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1406,9 +1406,10 @@ else
AC_MSG_RESULT([no])
fi
# disable some warnings, whether explicitly enabled above or by default
-# these are not compatible with our custom printf specifiers
-WARN_CFLAGS="$WARN_CFLAGS -Wno-format"
-WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security"
+# these are not compatible with our custom printf specifiers, so they are
+# kept separate below and must not be overridable via CFLAGS
+PRINTF_CFLAGS="-Wno-format"
+PRINTF_CFLAGS="$PRINTF_CFLAGS -Wno-format-security"
# we generally use comments, but GCC doesn't seem to recognize many of them
WARN_CFLAGS="$WARN_CFLAGS -Wno-implicit-fallthrough"
# we often omit fields when initializing structs (e.g. when using INIT)
@@ -1421,8 +1422,11 @@ WARN_CFLAGS="$WARN_CFLAGS -Wno-sign-compare"
WARN_CFLAGS="$WARN_CFLAGS -Wno-type-limits"
# we often don't use function parameters when implementing interfaces
WARN_CFLAGS="$WARN_CFLAGS -Wno-unused-parameter"
-# add the flags before existing CFLAGS so warning flags can be overridden
-CFLAGS="$WARN_CFLAGS $CFLAGS"
+# add the flags before existing CFLAGS so warning flags can be overridden,
+# but append those required by our custom printf specifiers so they can't be
+# re-enabled by flags in CFLAGS (e.g. the -Wformat added by Debian's hardening
+# build flags, which makes GCC 16 reject %B as C23's binary conversion)
+CFLAGS="$WARN_CFLAGS $CFLAGS $PRINTF_CFLAGS"
# ===============================================
# collect plugin list for strongSwan components
