Re: Missing Hardening Flags (freefem++)

2021-07-04 Thread François Mazen
Hi Andrey, > Anyway, some (I guess all) of those libs are compiled with ff-c++ > which > just doesn't pass LDFLAGS from the environment. Indeed! Patching ff-c++ removed almost all hardening lintian warnings. I'll track the remaining ones. > Unrelated to this, the package uses -mmmx -avx, is this

Re: Missing Hardening Flags (freefem++)

2021-07-04 Thread Andrey Rahmatullin
On Sun, Jul 04, 2021 at 10:42:06PM +0500, Andrey Rahmatullin wrote: > Unrelated to this, the package uses -mmmx -avx, is this an RC bug or is > all code compiled with those flags only enabled at the run time on CPUs > supporting them? I see this is already filed as #924009. I'll fix the severity.

Re: Missing Hardening Flags (freefem++)

2021-07-04 Thread Andrey Rahmatullin
On Sun, Jul 04, 2021 at 01:28:05PM +0200, François Mazen wrote: > > Can you publish the build log or at least make the repo buildable? > > Unless I'm mistaken, the repo is buildable. See salsa CI [1] and > associated build-log [2]. Not sure how does that work, as gbp requires the upstream/4.9+dfsg

Re: Missing Hardening Flags (freefem++)

2021-07-04 Thread François Mazen
Hello Andrey, > Can you publish the build log or at least make the repo buildable? Unless I'm mistaken, the repo is buildable. See salsa CI [1] and associated build-log [2]. I hope this help to point me in the right direction. Thanks, François [1] https://salsa.debian.org/science-team/freefempp

Re: Missing Hardening Flags (freefem++)

2021-07-03 Thread Andrey Rahmatullin
On Sat, Jul 03, 2021 at 09:59:30PM +0200, François Mazen wrote: > Dear Mentors, > > I'm updating the freefem++ package to 4.9 release [1] and I get > hardening-no-bindnow lintian warnings on several binary outputs [2]. > > Of course the appropriate variable is set in debian/rules (export > DEB_BU

Missing Hardening Flags (freefem++)

2021-07-03 Thread François Mazen
Dear Mentors, I'm updating the freefem++ package to 4.9 release [1] and I get hardening-no-bindnow lintian warnings on several binary outputs [2]. Of course the appropriate variable is set in debian/rules (export DEB_BUILD_MAINT_OPTIONS = hardening=+all), see [3]. According to [4] it means that s