[arch-dev-public] Build issues due to -D_FORTIFY_SOURCE=2 in CPPFLAGS

[Allan McRae]

Hi,

With pacman-4.1 we introduced CPPFLAGS in makepkg.conf and moved the
-D_FORTIFY_SOURCE=2 flag out of C{,XX}FLAGS to there (where it should be).

I did a survey of packages and found for most this made no difference to
the build.  As I mentioned earlier, it even fixes the build of curl
which refuses the use of -D flags in CFLAGS.

However, there is an issue.  The use of _FORTIFY_SOURCE without
optimizations omits a warning.   This appears to affect software with
configure scripts using really old version of autoconf, as this warning
output is enough to make the compile think it can not find the C
preprocessor.  The preprocessor error is fixed in newer versions of
autoconf, although it appears that the warning is enough to cause header
detection to fail, even with new versions - I am seeing this with
gcc/binutils.

So we have an issue...  This is probably not going to magically fix
itself any time soon and other distributions patch FORTIFY_SOURCE into
their compiler to only turn on with optimization so will never see this
issue.   Also, going to the autoconf source would still require all
software to update their autotools files as an "autoreconf" will likely
have issues requiring old autoconf versions.


What do we do?   Do we need to ignore the fact the this should be in
CPPFLAGS and move it back to C{,XX}FLAGS?

The other options is for packages that are affected by this to unset the
CPPFLAGS and add it to CFLAGS in the PKGBUILD, but I have no idea how
many packages this affects.  What portion of KDE and GNOME were built
with pacman-4.1?

Allan