Attempt to fix Debian bug report #1124874 on hardening build-deps

[smoe]

Experimenting.

[andypugh]

I rather suspect that many of the build-flags are hangovers from needing to create kernel modules in the RTAI builds.
(Not that the base version of LinuxCNC can do that any more, I need to patch the /debian folder to build RTAI debs.)

[smoe]

I just took this from the "rip and test"

Compiling hal/user_comps/mb2hal/mb2hal_modbus.c
gcc -c -I. -Ilibnml/linklist -Iemc -Ilibnml/cms -Ilibnml/rcs -Ilibnml/inifile -Ilibnml/os_intf -Ilibnml/nml -Ilibnml/buffer -Ilibnml/posemath -Irtapi -Ihal -Iemc -Iemc/nml_intf -Iemc/kinematics -Iemc/tp -Iemc/motion -Iemc/ini -Iemc -Iemc/rs274ngc -Iemc/sai -Iemc/pythonplugin -Iemc/tooldata -Iemc -I/home/runner/work/linuxcnc/linuxcnc/src/include -I/usr/include/python3.12 -I/usr/include/tirpc  -O2 -fwrapv  -g -Wall -D_FORTIFY_SOURCE=2 -DULAPI -std=gnu11 -Werror=implicit-function-declaration -g -O2 -I/usr/include/tirpc  -Wextra   -DDEBUG -Wall -I. -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include  -I/usr/include/modbus  \
   -MP -MD -MF "objects/hal/user_comps/mb2hal/mb2hal_modbus.d" -MT "objects/hal/user_comps/mb2hal/mb2hal_modbus.o" \
   hal/user_comps/mb2hal/mb2hal_modbus.c -o objects/hal/user_comps/mb2hal/mb2hal_modbus.o

which does not reflect the buildflags:

$ dpkg-buildflags 
ASFLAGS=
ASFLAGS_FOR_BUILD=
CFLAGS=-g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
CFLAGS_FOR_BUILD=-g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2
CPPFLAGS_FOR_BUILD=-Wdate-time -D_FORTIFY_SOURCE=2
CXXFLAGS=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
CXXFLAGS_FOR_BUILD=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
DFLAGS=-frelease
DFLAGS_FOR_BUILD=-frelease
FCFLAGS=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -fcf-protection
FCFLAGS_FOR_BUILD=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -fcf-protection
FFLAGS=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -fcf-protection
FFLAGS_FOR_BUILD=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -fcf-protection
LDFLAGS=-Wl,-z,relro -fcf-protection
LDFLAGS_FOR_BUILD=-Wl,-z,relro -fcf-protection
OBJCFLAGS=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
OBJCFLAGS_FOR_BUILD=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
OBJCXXFLAGS=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
OBJCXXFLAGS_FOR_BUILD=-g -O2 -ffile-prefix-map=/home/moeller/GitHub/linuxcnc=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection

but I fail to grasp why the CFLAGS are not showing up and only the CPPFLAGS are seen.

[smoe]

I need to patch the /debian folder to build RTAI debs.

Would a DEB_BUILD_OPTION "rtai" be beneficial?

[andypugh]

I need to patch the /debian folder to build RTAI debs.

Would a DEB_BUILD_OPTION "rtai" be beneficial?

Maybe. It's complicated. Jeff (wrongly) decided that we had no working RTAI images and re-worked the build system in
6f28560
But there was a lot of churn in the build system after that and I have never quite got things back in shape.
However as neither the buildbots or Github will use an RTAI kernel it't not a massive issue, I just merge https://github.com/LinuxCNC/linuxcnc/tree/andypugh/2.9-rtai and build by hand whenever I can be bothered.
(I am an RTAI user and fan, but it is troublesome)

[smoe]

I need to patch the /debian folder to build RTAI debs.

Would a DEB_BUILD_OPTION "rtai" be beneficial?

Maybe. It's complicated. Jeff (wrongly) decided that we had no working RTAI images and re-worked the build system in 6f28560

I had a look at that patch. Does not seem too bad. It is four years ago, though, and yes, many small changes since, nothing conceptually different, though. It is a bit unfortunate these "long winter nights" do not happen for me any more, somehow.

Somehow this triggered me to have another thought at #1835 - I took the freedom to assign this to me to have this rebased on master.