Your message dated Sat, 19 May 2012 15:27:55 +0200
with message-id <201205191528.31688.panfa...@gmail.com>
and subject line Closing some hardening flags bugs
has caused the Debian Bug report #665480,
regarding rekonq: CPPFLAGS hardening flags missing
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
665480: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665480
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: rekonq
Version: 0.9.9-1-1
Severity: important
Tags: patch

Dear Maintainer,

The CPPFLAGS hardening flags are missing because CMake ignores
them by default.

The following patch fixes the issue by adding them to
CFLAGS/CXXFLAGS. For more hardening information please have a
look at [1], [2] and [3].

diff -Nru rekonq-0.9.0-1/debian/rules rekonq-0.9.0-1/debian/rules
--- rekonq-0.9.0-1/debian/rules 2012-03-20 19:26:04.000000000 +0100
+++ rekonq-0.9.0-1/debian/rules 2012-03-24 16:27:09.000000000 +0100
@@ -1,6 +1,12 @@
 #!/usr/bin/make -f
 
 export DEB_BUILD_MAINT_OPTIONS = hardening=+bindnow
+# CMake doesn't use CPPFLAGS, pass them to CFLAGS/CXXFLAGS to enable the
+# missing (hardening) flags. dpkg_buildflags is necessary because $(shell ..)
+# doesn't use local environment variables.
+dpkg_buildflags = DEB_BUILD_MAINT_OPTIONS=$(DEB_BUILD_MAINT_OPTIONS) 
dpkg-buildflags
+export DEB_CFLAGS_MAINT_APPEND   = $(shell $(dpkg_buildflags) --get CPPFLAGS)
+export DEB_CXXFLAGS_MAINT_APPEND = $(shell $(dpkg_buildflags) --get CPPFLAGS)
 export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
 
 %:

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9

Attachment: signature.asc
Description: Digital signature


--- End Message ---
--- Begin Message ---
I'm closing these bugs because the involved packages are using the dh 
sequencer addon for kde. While cmake still doesn't respect CPPFLAGS, a 
workaround was added to the mentioned addon, so if you build any of the 
packages involved it will include the hardening flags.

At least one of the involved packages (amarok) was built before the workaround 
mentioned above was done. Therefore if you think it's really important to get 
any of them built with the hardening flags feel free to request a binNMU.

Attachment: signature.asc
Description: This is a digitally signed message part.


--- End Message ---
_______________________________________________
pkg-kde-extras mailing list
pkg-kde-extras@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-kde-extras

Reply via email to