Your message dated Thu, 19 Mar 2026 00:20:02 +0000
with message-id <[email protected]>
and subject line Bug#1119397: fixed in drogon 1.9.12+ds-1
has caused the Debian Bug report #1119397,
regarding drogon: please build using the default build flags
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1119397: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119397
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: drogon
Version: 1.9.11+ds-1
User: [email protected]
Usertags: hardening-buildflags
drogon is not currently using the default build flags set by dpkg-buildflags(1).
The default flags are chosen for multiple reasons including security,
performance, reproducibility, adherence to standards, and error handling.
Please make sure that drogon builds using the default build flags. blhc(1p)
and hardening-check(1) can be used to confirm that the issue is fixed.
In the general case, packages honoring CFLAGS, LDFLAGS, and other
similar environment variables get the default build flags for free
without the need for any work on the maintainer side. In the case of
drogon, the flags are either ignored or overridden.
The most common reasons for this are:
Hand-written Makefiles
----------------------
Some upstream Makefiles either override the values of variables such as
CFLAGS and similar or do not use them at all. See:
https://wiki.debian.org/HardeningWalkthrough#Handwritten_Makefiles
Misconfigured build systems
---------------------------
If the upstream code uses autotools, CMake, or other popular build
systems, it usually requires no further modifications. If might however
be that some variables are hardcoded in some way.
In this CMake snippet, the value of CXXFLAGS is overwritten with "-O2":
set(CMAKE_CXX_FLAGS "-O2")
If the intention is to append to CXXFLAGS, one should use the following
instead:
set(CMAKE_CXX_FLAGS "-O2 ${CMAKE_CXX_FLAGS}")
See #655870 for a similar autotools example.
Very old debhelper usage
------------------------
Packages not using dh(1), or those using a debhelper compatibility level
less than 9, need to manually include /usr/share/dpkg/buildflags.mk in
order for the dpkg-buildflags variables to be set:
https://wiki.debian.org/Hardening#dpkg-buildflags
Flags hardcoded in debian/rules (either voluntarily or not)
-----------------------------------------------------------
Some packages voluntarily hardcode the values of CFLAGS and friends in
debian/rules, ignoring the defaults set by dpkg-buildflags(1).
Others attempt to append to the variables, but end up accidentally
overriding the defaults:
#!/usr/bin/make -f
export CFLAGS += -pipe -fPIC -Wall
%:
dh $@
Debhelper only sets CFLAGS if it is not set yet. In the example above,
when dh is invoked the value of CFLAGS is "-pipe -fPIC -Wall", hence the
hardened defaults are not used. The right way to append to CFLAGS is
using DEB_CFLAGS_MAINT_APPEND instead, as documented in
dpkg-buildflags(1).
For a detailed analysis of this issue, see:
https://people.debian.org/~ema/nocflags_paper.pdf (eprint: hal-05334704)
--- End Message ---
--- Begin Message ---
Source: drogon
Source-Version: 1.9.12+ds-1
Done: Pierre-Elliott Bécue <[email protected]>
We believe that the bug you reported is fixed in the latest version of
drogon, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Pierre-Elliott Bécue <[email protected]> (supplier of updated drogon package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 19 Mar 2026 00:49:37 +0100
Source: drogon
Architecture: source
Version: 1.9.12+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Pierre-Elliott Bécue <[email protected]>
Changed-By: Pierre-Elliott Bécue <[email protected]>
Closes: 1119397
Changes:
drogon (1.9.12+ds-1) unstable; urgency=medium
.
* New upstream release 1.9.12+ds
* d/watch: add missing parameters to repack properly and mangle
* d/copyright refreshed
* Bump Standards-Version to 4.7.3
* d/rules:
- Drop custom CXXFLAGS and append the relevant one via the proper tooling
(Closes: #1119397)
- Drop the chrpath call in favour of CMAKE_SKIP_INSTALL_RPATH logic I just
discovered and that works for all binaries \o/
* Drop d/libdrogon1t64.lintian-overrides
Checksums-Sha1:
4a5bf18572f8015bcfc66edbcde6ef48a7beac2b 2189 drogon_1.9.12+ds-1.dsc
38a8f9f668e74d43d570c628c7222c820d53285b 420904 drogon_1.9.12+ds.orig.tar.xz
c4a5eb058eefc463edbde90f4d6d295e7c88e529 31064 drogon_1.9.12+ds-1.debian.tar.xz
81c3f74cbdb900fc11619464b0c30082b0daf48a 9279
drogon_1.9.12+ds-1_amd64.buildinfo
Checksums-Sha256:
b0e5efc4002ca182f11c0a431f2e99b9652a01f49ab38f26db337f8cc76dc1f3 2189
drogon_1.9.12+ds-1.dsc
6752b4748e2d5f73007a9fb6ecc71198c235bad4b5026dbf01603651755ca932 420904
drogon_1.9.12+ds.orig.tar.xz
eddb720540c33daedec69a058223b00a63fe322f78f38ec31fd04d5e8c31f8f7 31064
drogon_1.9.12+ds-1.debian.tar.xz
d1cbae08ee7c419e7a1956cc5812c0b0fc5a18ce70d120d5e64b29488a91d947 9279
drogon_1.9.12+ds-1_amd64.buildinfo
Files:
1513ecb932d11525c31be67abd8b0d70 2189 web optional drogon_1.9.12+ds-1.dsc
5babfd4162235e95d8bee86790f8f67f 420904 web optional
drogon_1.9.12+ds.orig.tar.xz
91d878794e7b239aacc313a7f4766736 31064 web optional
drogon_1.9.12+ds-1.debian.tar.xz
37707782c5a95cbb1bf48e36642ef09a 9279 web optional
drogon_1.9.12+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJDBAEBCgAtFiEE5CQeth7uIW7ehIz87iFbn7jEWwsFAmm7O94PHHBlYkBkZWJp
YW4ub3JnAAoJEO4hW5+4xFsLKhYP/Rk4CNiRaAZmrvDW8t97fEhFDIwQ70TBYt3r
h5rXPPhgT05AWwUey54k2UIwQtPl2wIyi9m7adZ9G4LMSdb1AglWvNMKYhkHqBNJ
sQVQhdMrrFG1RxcCjusZrMSgn0ZQOkDCThy0h9FCHDgQ+qGS7n9T54UFA44liR6u
r5A48UiAspn6euIHgOxFpzXkx7Bo7CjOwD7SCFOvW//9xLUi2blLLH15Ivd8qap2
ZYngPRAed6kNJ5fhF5NR+yotn3CKuzXr//hSI36rXj3iFCmPkMreXqg9uWeTgqsv
0SDrvOjVwSMunZiv5T1t3WTbCh02ODNYMgouDbC/1lhOPXfB3vsd0GFTnzrTdS9P
FgyMppIDCT8EYqzRpB5MW3V90GsN52aBObNRxy5IFWFKYweYgxlU2tiqiGrK9WsT
7jG1PpPkA0Juccnyppl8eIS9kQOdmxNBaNGHtAsRQVOYSx+YV39LjJSHF9klUE4X
hPEeiVU0Z5+xoB1c5cEtmJChLLZaUd/ywfLjBYwtTkxfIVxDqsAkmoZYCthvTcp9
VZxNXcMoS1BtfcJqZOSsSAJ+b+RaElxanTFHQslJvN22erUc/4fShpaMYBNETQlb
0imWMgx8jDUnl2ZhMiM4wRPt/yfaEOxeOd3oxk+NurVEpDQBV7eg/YQFWNlg2E/x
K5RBZO45
=Jap5
-----END PGP SIGNATURE-----
pgpc52lUAbkdD.pgp
Description: PGP signature
--- End Message ---
