Re: [PATCH v3 00/12] Improvements to static checker invocation

[Stefano Brivio <sbrivio@redhat.com>]

On Tue, 12 May 2026 15:52:44 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> While working on pesto, I ran into a number of awkward errors with the
> static checkers.  This series reworks the invocation of the checkers
> in a way that will let us deal with that.  As a bonus, it also gives
> us static checking for passt-repair.  It also a number of other
> cleanups to the Makefile that seemed natural along the way.
> 
> v3:
>  - Rework changes to $(FLAGS) so they're much less likely to have
>    side effects we're not ready for.
> v2:
>  - Fixed nasty test failure in test/build/build.py

Tested with current packaging rules / build scripts on Alpine, Debian,
Fedora, openSUSE, and applied (dropping extra whitespace in 4/12 as
noted).

I think it would be nice, as a follow-up, to drop the comments that 4/12
introduced:

+# Mandatory preprocessor flags that won't be overridden with $(CFLAGS)
+# FIXME: Could some of these be default, rather than required?

(same for CPPFLAGS), because, as we discussed, those are all default,
can actually be overridden as distribution packages already do (so this
is misleading for distribution maintainers), and I don't see a
particular value in distinguishing what flags *could* be perhaps
dropped to have something strictly building. They are all useful for a
reason or another.

But I didn't touch those, I didn't feel like sneaking in a substantial
change like that and I didn't want to delay this series further, either.

I had a quick look at package recipes of Chimera, PLD, and Void Linux,
I didn't test things there but I don't see any way this series could
cause issues there.

Somewhat interestingly, I came across many different ways to override
flags, taking -D_FORTIFY_SOURCE as example:

- Alpine doesn't override / set it at all, the test in our Makefile
  doesn't set it there, either. Notably, this test was added in commit
  38363964fc96 ("Makefile: Enable _FORTIFY_SOURCE iff needed"),
  specifically for Gentoo

- Debian and Void Linux append -D_FORTIFY_SOURCE=2, that is, they
  duplicate our flag, in CFLAGS

- Fedora (with my spec file, where I didn't set any %_fortify_level)
  overrides it with -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 in CFLAGS

- openSUSE used to append -D_FORTIFY_SOURCE=3 (similar to Debian and
  Void Linux), but now uses -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3

- PLD Linux appends -Wp,-D_FORTIFY_SOURCE=2

I found a rather impressive summary here:

  https://www.anthes.is/nix-internals-cflags.html

-- 
Stefano