Leont
commented
6 months ago -Wall shouldn't cause any compilation to fail, it should cause warnings to be be printed. Can you paste the full output of the build?
Closed rlauer6 closed 4 months ago
Leont
commented
6 months ago -Wall shouldn't cause any compilation to fail, it should cause warnings to be be printed. Can you paste the full output of the build?
rlauer6
commented
6 months ago Yes, as noted -Wall was not the issue and only printed all of the errors, the offending flag was `-Wformat=security'. Diving into that module's code a bit I found that modifying the code solved the problem. Essentially the compiler was correctly pointing out the security issue regarding passing a non-string literal to printf. I'm still curious as to how one could "turn off flags", although in this case the flag was there to harden the module a bit.
Leont
commented
6 months ago Yes, as noted -Wall was not the issue and only printed all of the errors, the offending flag was `-Wformat=security'. Diving
No, the offending flag is -Werror=format-security, which actually does make sense. The whole point of -Werror is to make warnings fatal. It's explicitly asking for this.
Diving into that module's code a bit I found that modifying the code solved the problem. Essentially the compiler was correctly pointing out the security issue regarding passing a non-string literal to printf.
Yeah prepending a "%s", in a few places should solve the entire issue. I'm not sure if it's really a security issue (that depends on how much the attacker can affect the error message itself), but it's definitely something that should be changed. This should probably be fixed upstream but I'm not sure the author is still around so that might require someone taking over the module.
I'm still curious as to how one could "turn off flags", although in this case the flag was there to harden the module a bit.
You can't easily do that, except by overriding ccflags completely (e.g. perl Build.PL --config ccflags="...")
rlauer6
commented
6 months ago No, the offending flag is
-Werror=format-security, which actually does make sense. The whole point of-Werroris to make warnings fatal. It's explicitly asking for this.
Yeah -Werror=format-security forces the compiler to consider that warning an error, I was typing that from memory...been looking cross-eyed at building a bunch of stuff in Amazon Linux (AL2023) - what a nightmare!
You can't easily do that, except by overriding
ccflagscompletely (e.g.perl Build.PL --config ccflags="...")
Thanks for the replies - at least I know I'm not missing anything wrt the flags. But it seems almost impossible to override them completely unless I am missing something. No matter how hard I tried to override the flags it seemed that somewhere new flags were added - perhaps I didn't try supplying them on the command line to Build.PL. The journey started of course with cpanm so I'll have to see that works.
Thanks again
jkeenan
commented
4 months ago @Leont, it appears that you have addressed the OP's concerns and there has been no further discussion in this ticket since May 13. I'll close it in a week unless you think there's some reason to keep it open.
Update
Module: ExtUtils::CBuilder::Base
Description Using the latest Amazon Linux container (
amazonlinux:latest) ...While trying to compile Archive::Extract::Libarchive, compiling fails because the perl supplied in their repo is compiled with the
-Wallflag which is included whenModule::Buildattempts to compile the module (and there are warnings when compiling).Removing -Wall right before Module::Build runs the compiler allows the module to proceed..
Not sure if this is a bug in
Module::Build, ExtUtils::CBuilder::Baseor just a deficiency of the tool chain's ability to remove flags that might cause downstream issues? In any event, there are many modules that compile with warnings so this may be a bigger issue when trying to install modules on the latest version of Amazon Linux.Steps to Reproduce
FROM amazonlinux:latest)Perl configuration