Re: Provenpackagers dealing with -Werror=format-security issues

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



For some reason you email landed in my spam folder :)

On Wed, 2017-03-29 at 10:15 +0100, Jonathan Wakely wrote:
> On 19/03/17 03:33 +0000, Tomasz Kłoczko wrote:
> > Started cleaning parted.spec and found method *much* more often used.
> > 
> > [tkloczko@domek SPECS.fedora]$ grep CFLAGS * | grep -- -Wno
> > alex4.spec:  CFLAGS="$RPM_OPT_FLAGS *-Wno*-deprecated-declarations"
> 
> There's nothing wrong with this option. Many C++ packages want to
> support building with a C++98 compiler, so they use std::auto_ptr.
> That gives warnings when built with a modern GCC using default
> settings. Disabling the warning is reasonable.

Generally you are right. However you cannot fix something if you don't know that some issue with code exist :)
What I'm trying to tell is that as long as suppressing such warnings is hard coded in spec files it decreases probability of fixing the
code.
Packages build logs are preserved and served publicly.
Number of all compile warnings says something as well about general "heal"s of the source code.

> > xscreensaver.spec:export CFLAGS="$CFLAGS *-Wno*-long-long"
> > xscreensaver.spec:export CFLAGS="$CFLAGS *-Wno*-variadic-macros"
> 
> These are harmless to disable, but also redundant. Fedora's GCC
> defaults to C11 which supports long long and variadic macros, so won't
> warn about them anyway.

> Not everything in your report is a problem. Automatically emailing
> somebody from upstream or refusing to allow those -Wno-* options in
> spec files would not improve Fedora measurably.

Please "#define problem". No one here is talking about any problems per se.
Does it mean that enable reporting compile warnings is changing the code? Of course not.
Does it mean that enable suppressing those warnings allows make somehow "faulty" code better in the future? Of course as well not.
And that is the issue that full viability of those warnings only makes build logs slightly shorter and nothing more.
It does not help in anything .. do you see this now?

BTW xscreensaver is perfect example code which public interest of maintaining its source code is declining because some undergoing X11-
>Wayland changes.
As gcc is constantly progressing with reporting some type of more of less potential issues as warnings there is no to many people
interested in maintaining code which maintenance stagnates.
If package like xscreensaver in the future will start producing come compile/linking time errors something like number of warnings may
help make decision about final abandon such package.
Almost every week few packages are coming into Fedora and few as well are marked as dead packages.

rpm package has possibility to add executing in %check section some test suits embedded in the original source tree.
IMO it would be not bad add in pre or post this section script finding in source tree all C code and passing over some external lint
programs exposing some security potential issues. Reporting those issues every time when someone is trying to build some package would
not wise. However passing over such automated auditing programs when official packages will be produced would be IMO helpful.
As long as set of rpm macros allows to add such additional tests in build procedure without any changes in spec file can be done even
buying by Fedora foundation some commercial product doing such automatic auditing is possible. Maybe even such companies could donate
few licenses  to use them on Fedora build systems to make such product better, spread knowledge about such products and make public
code better.
Potentially only win<>win situation.

When I was shadow-utils source tree code maintainers I've passed source code of his package trough whatever I was able to find.
By this I was able to learn new things about how to write better code and to correct some potential issues.

Visibility of all possible compile time warnings is not big deal. It is minor thing. However as long as exposing those things may have
only positive or none effects hiding or suppressing those warnings has only negative or neutral consequences.

All this is more about taste and it is very close to some quite popular few years ago in Poland beer advert that "<A> beer is almost
the same good as Żywiec beer but 'almost' makes the difference" :)

kloczek
-- 
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux