Bug#1147712: marked as done (strongswan: FTBFS with GCC 16: custom printf specifier %B rejected because -Wno-format is overridden)

Debian Bug Tracking System Tue, 15 Sep 2026 00:07:47 -0700

Your message dated Tue, 15 Sep 2026 09:04:33 +0200
with message-id <[email protected]>
and subject line Re: [Pkg-swan-devel] Bug#1147712: strongswan: FTBFS with GCC 
16: custom printf specifier %B rejected because -Wno-format is overridden
has caused the Debian Bug report #1147712,
regarding strongswan: FTBFS with GCC 16: custom printf specifier %B rejected 
because -Wno-format is overridden
to be marked as done.


This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


-- 
1147712: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147712
Debian Bug Tracking System
Contact [email protected] with problems

--- Begin Message ---

Package: strongswan
Version: 6.1.0-2
Severity: serious
Justification: fails to build from source
Tags: patch ftbfs
X-Debbugs-Cc: [email protected]


Dear Debian folks,

AI disclaimer: Analyzed and drafted by claude-opus-5, and reviewed and edited by me.


Building strongswan with `debuild -us -uc -b` on Debian sid/unstable
with *gcc* 4:16.1.0-3 fails:

credentials/certificates/certificate_printer.c: In function 'print_x509': credentials/certificates/certificate_printer.c:90:36: error: format '%B' expects argument of type 'unsigned int', but argument 3 has type 'chunk_t *' [-Werror=format=]

       90 |         fprintf(f, "  serial:    %#B\n", &chunk);
          |                                  ~~^     ~~~~~~
          |                                    |     |
          |                                    |     chunk_t *
          |                                    unsigned int

credentials/certificates/certificate_printer.c:105:30: error: unknown conversion type character 'Y' in format [-Werror=format=] 105 | fprintf(f, "%Y", id); | ^ Analysis -------- strongSwan registers custom printf conversion specifiers at runtime via register_printf_specifier(3) – %B prints a chunk_t, %Y an identification_t, %H a host_t and so on (see src/libstrongswan/utils/printf_hook/printf_hook_glibc.c). GCC knows nothing about these, so upstream’s configure.ac disables the format warnings: # disable some warnings, whether explicitly enabled above or by default # these are not compatible with our custom printf specifiers WARN_CFLAGS="$WARN_CFLAGS -Wno-format" WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security" [...] # add the flags before existing CFLAGS so warning flags can be overridden

    CFLAGS="$WARN_CFLAGS $CFLAGS"

Note that these flags are *prepended*. Since d/rules sets `DEB_BUILD_MAINT_OPTIONS=hardening=+all`, dpkg-buildflags puts `-Wformat -Werror=format-security` into CFLAGS, i.e. after -Wno-format, which re-enables format checking for the whole package: x86_64-linux-gnu-gcc [...] -Wno-format -Wno-format-security [...] \ -g -O2 [...] -Wformat -Werror=format-security -fcf-protection \ -c credentials/certificates/certificate_printer.c

That has been harmless so far because GCC did not know %B either. GCC 16
does: %b/%B is C23’s conversion specifier for binary output, so GCC now
type-checks the argument and rejects the chunk_t pointer.

The runtime behavior is not affected – register_printf_specifier()
still overrides glibc’s built-in %B, verified with glibc 2.43 using a
small test program. So this is purely about the warning flags.

Proposed fix
------------

The root cause is upstream’s flag ordering: -Wno-format and
-Wno-format-security are not a style preference, they are required for
the code to compile at all, so they must not be overridable via CFLAGS.
The attached patch keeps them in a separate variable and appends it,
leaving the remaining warning flags overridable as before:

-# add the flags before existing CFLAGS so warning flags can be overridden

    -CFLAGS="$WARN_CFLAGS $CFLAGS"

+# add the flags before existing CFLAGS so warning flags can be overridden, +# but append those required by our custom printf specifiers so they can't be

    +# re-enabled by flags in CFLAGS
    +CFLAGS="$WARN_CFLAGS $CFLAGS $PRINTF_CFLAGS"

Alternatively, or in addition, d/rules can append the flags itself,
which does not depend on the patch surviving the next upstream merge:

    export DEB_CFLAGS_MAINT_APPEND=-Wno-format -Wno-format-security

With either change the package builds cleanly, including with an
additional -Werror=format in CFLAGS.


Kind regards,

Paul

From: Paul Menzel <[email protected]>
Date: Mon, 14 Sep 2026 16:30:00 +0200
Subject: Do not let CFLAGS re-enable -Wformat

strongSwan registers custom printf specifiers (%B, %H, %Y, ...) at runtime
via register_printf_specifier(3), which GCC knows nothing about, so
configure adds -Wno-format and -Wno-format-security.  Those are prepended
to CFLAGS, though, so Debian's hardening build flags (-Wformat
-Werror=format-security) re-enable format checking.

With GCC 16, which knows %B as C23's conversion specifier for binary
output, this makes the build fail:

  credentials/certificates/certificate_printer.c: In function 'print_x509':
  credentials/certificates/certificate_printer.c:90:36: error: format '%B' expects argument of type 'unsigned int', but argument 3 has type 'chunk_t *' [-Werror=format=]
     90 |         fprintf(f, "  serial:    %#B\n", &chunk);
        |                                  ~~^     ~~~~~~
        |                                    |     |
        |                                    |     chunk_t *
        |                                    unsigned int

Keep the two flags in a separate variable and append it to CFLAGS, so they
always take effect.  The remaining warning flags stay overridable as before.

The custom specifiers keep working at runtime: register_printf_specifier()
still overrides glibc's built-in %B (verified with glibc 2.43).
---
diff --git a/configure.ac b/configure.ac
index 50b06c439..eedaf4604 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1406,9 +1406,10 @@ else
 	AC_MSG_RESULT([no])
 fi
 # disable some warnings, whether explicitly enabled above or by default
-# these are not compatible with our custom printf specifiers
-WARN_CFLAGS="$WARN_CFLAGS -Wno-format"
-WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security"
+# these are not compatible with our custom printf specifiers, so they are
+# kept separate below and must not be overridable via CFLAGS
+PRINTF_CFLAGS="-Wno-format"
+PRINTF_CFLAGS="$PRINTF_CFLAGS -Wno-format-security"
 # we generally use comments, but GCC doesn't seem to recognize many of them
 WARN_CFLAGS="$WARN_CFLAGS -Wno-implicit-fallthrough"
 # we often omit fields when initializing structs (e.g. when using INIT)
@@ -1421,8 +1422,11 @@ WARN_CFLAGS="$WARN_CFLAGS -Wno-sign-compare"
 WARN_CFLAGS="$WARN_CFLAGS -Wno-type-limits"
 # we often don't use function parameters when implementing interfaces
 WARN_CFLAGS="$WARN_CFLAGS -Wno-unused-parameter"
-# add the flags before existing CFLAGS so warning flags can be overridden
-CFLAGS="$WARN_CFLAGS $CFLAGS"
+# add the flags before existing CFLAGS so warning flags can be overridden,
+# but append those required by our custom printf specifiers so they can't be
+# re-enabled by flags in CFLAGS (e.g. the -Wformat added by Debian's hardening
+# build flags, which makes GCC 16 reject %B as C23's binary conversion)
+CFLAGS="$WARN_CFLAGS $CFLAGS $PRINTF_CFLAGS"
 
 # ===============================================
 #  collect plugin list for strongSwan components

--- End Message ---

--- Begin Message ---

On Mon, 2026-09-14 at 23:32 +0200, Paul Menzel wrote:
> > I'm not comfortable disabling this part of upstream checks. You might want
> > to
> > reach them to check if those could be overridden.
> 
> What checks do you mean exactly, that would get disabled? Upstream’s 
> configure explicitly adds `-Wno-format` [1]:
> 
>      # disable some warnings, whether explicitly enabled above or by default
>      # these are not compatible with our custom printf specifiers
>      WARN_CFLAGS="$WARN_CFLAGS -Wno-format"
>      WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security"

Then I'm not actually sure what's the problem anyway. Warnings are enabled by
default if .git is present [1] but you can pass --disable-warnings [2] or just
override CFLAGS [3].

You (or Claude) actually said it in your first message:

> Alternatively, or in addition, d/rules can append the flags itself,
> which does not depend on the patch surviving the next upstream merge:
> 
>     export DEB_CFLAGS_MAINT_APPEND=-Wno-format -Wno-format-security
> 

So I don't think there's a bug at all here. The package builds fine in Debian
environment, and if you build in your own environment (for investigating/debug
purposes) you can override things at will.

[1]
https://github.com/strongswan/strongswan/blob/78937d2190656f175599411c14be5ecbeb2c2c02/configure.ac#L518
[2]
https://github.com/strongswan/strongswan/blob/78937d2190656f175599411c14be5ecbeb2c2c02/configure.ac#L316
[3]
https://github.com/strongswan/strongswan/blob/78937d2190656f175599411c14be5ecbeb2c2c02/configure.ac#L1425

Regards,
-- 
Yves-Alexis

signature.asc
Description: This is a digitally signed message part

--- End Message ---

Bug#1147712: marked as done (strongswan: FTBFS with GCC 16: custom printf specifier %B rejected because -Wno-format is overridden)

Reply via email to