Get build flags from dpkg-buildflags, and fix the resulting

-Wformat-security errors using patch from Colin Watson (closes:
#627403)

git-svn-id: svn://svn.debian.org/pkg-ntp/ntp/trunk@337 0070b5ef-2f16-0410-befa-9a02bd1d6ddb

4 files changed, 96 insertions, 8 deletions

diff --git a/debian/changelog b/debian/changelog
index 27b97ac..e85024f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,8 +3,11 @@ ntp (1:4.2.6.p3+dfsg-2) UNRELEASED; urgency=low
   * Use architecture wildcard for libcap2-dev build dependency, removing
     type-handing dependency (closes: #587871)
   * Updated standards version
+  * Get build flags from dpkg-buildflags, and fix the resulting
+    -Wformat-security errors using patch from Colin Watson (closes:
+    #627403)
 
- -- Peter Eisentraut <petere@debian.org>  Sat, 26 Nov 2011 23:02:44 +0200
+ -- Peter Eisentraut <petere@debian.org>  Sun, 27 Nov 2011 01:17:14 +0200
 
 ntp (1:4.2.6.p3+dfsg-1) unstable; urgency=low
 
diff --git a/debian/patches/format-security.patch b/debian/patches/format-security.patch
new file mode 100644
index 0000000..3175db6
--- /dev/null
+++ b/debian/patches/format-security.patch
@@ -0,0 +1,87 @@
+Description: Fix build failures with -Werror=format-security
+ The change to ntp_config.c is merely pacifying GCC, since signd_warning is
+ a constant string containing no '%' characters.  In the other cases, it is
+ much more difficult to prove that the format string cannot contain any '%'
+ characters.
+Author: Colin Watson <cjwatson@ubuntu.com>
+Last-Update: 2011-05-20
+
+Index: b/lib/isc/unix/ifiter_ioctl.c
+===================================================================
+--- a/lib/isc/unix/ifiter_ioctl.c
++++ b/lib/isc/unix/ifiter_ioctl.c
+@@ -159,7 +159,7 @@
+ 				break;
+ 		}
+ 		if (iter->bufsize >= IFCONF_BUFSIZE_MAX) {
+-			UNEXPECTED_ERROR(__FILE__, __LINE__,
++			UNEXPECTED_ERROR(__FILE__, __LINE__, "%s",
+ 					 isc_msgcat_get(isc_msgcat,
+ 							ISC_MSGSET_IFITERIOCTL,
+ 							ISC_MSG_BUFFERMAX,
+@@ -260,7 +260,7 @@
+ 				break;
+ 		}
+ 		if (iter->bufsize6 >= IFCONF_BUFSIZE_MAX) {
+-			UNEXPECTED_ERROR(__FILE__, __LINE__,
++			UNEXPECTED_ERROR(__FILE__, __LINE__, "%s",
+ 					 isc_msgcat_get(isc_msgcat,
+ 							ISC_MSGSET_IFITERIOCTL,
+ 							ISC_MSG_BUFFERMAX,
+Index: b/ntpd/ntp_config.c
+===================================================================
+--- a/ntpd/ntp_config.c
++++ b/ntpd/ntp_config.c
+@@ -2324,7 +2324,7 @@
+ 		if ((RES_MSSNTP & flags) && !warned_signd) {
+ 			warned_signd = 1;
+ 			fprintf(stderr, "%s\n", signd_warning);
+-			msyslog(LOG_WARNING, signd_warning);
++			msyslog(LOG_WARNING, "%s", signd_warning);
+ 		}
+ 	}
+ }
+Index: b/ntpd/ntp_control.c
+===================================================================
+--- a/ntpd/ntp_control.c
++++ b/ntpd/ntp_control.c
+@@ -2948,7 +2948,7 @@
+ 			    " %s", str);
+ 		}
+ 		NLOG(NLOG_SYSEVENT)
+-		    msyslog(LOG_INFO, statstr);
++		    msyslog(LOG_INFO, "%s", statstr);
+ 	} else {
+ 
+ 		/*
+@@ -2980,7 +2980,7 @@
+ 			    " %s", str);
+ 		}
+ 		NLOG(NLOG_PEEREVENT)
+-		    msyslog(LOG_INFO, statstr);
++		    msyslog(LOG_INFO, "%s", statstr);
+ 	}
+ 	record_proto_stats(statstr);
+ #if DEBUG
+Index: b/ntpd/ntpd.c
+===================================================================
+--- a/ntpd/ntpd.c
++++ b/ntpd/ntpd.c
+@@ -1283,7 +1283,7 @@
+ 
+ 	msyslog(LOG_ERR, "%s:%d: fatal error:", file, line);
+ 	vsnprintf(errbuf, sizeof(errbuf), format, args);
+-	msyslog(LOG_ERR, errbuf);
++	msyslog(LOG_ERR, "%s", errbuf);
+ 	msyslog(LOG_ERR, "exiting (due to fatal error in library)");
+ 
+ 	abort();
+@@ -1305,7 +1305,7 @@
+ 
+ 	msyslog(LOG_ERR, "%s:%d: unexpected error:", file, line);
+ 	vsnprintf(errbuf, sizeof(errbuf), format, args);
+-	msyslog(LOG_ERR, errbuf);
++	msyslog(LOG_ERR, "%s", errbuf);
+ 
+ 	if (++unexpected_error_cnt == MAX_UNEXPECTED_ERRORS)
+ 	{
diff --git a/debian/patches/series b/debian/patches/series
index eea1dff..c51774f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,3 +7,4 @@ ntpd-ni-maxhost.patch
 openssl-disable-check.patch
 libedit.patch
 autotools.patch
+format-security.patch
diff --git a/debian/rules b/debian/rules
index d9a8e77..a851a95 100755
--- a/debian/rules
+++ b/debian/rules
@@ -8,12 +8,9 @@ export AUTOHEADER = : autoheader
 
 DEB_HOST_ARCH_OS ?= $(shell dpkg-architecture -qDEB_HOST_ARCH_OS)
 
-CFLAGS = -g -fno-strict-aliasing
-ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
-CFLAGS += -O0
-else
-CFLAGS += -O2
-endif
+CPPFLAGS = $(shell dpkg-buildflags --get CPPFLAGS) -D_GNU_SOURCE
+CFLAGS   = $(shell dpkg-buildflags --get CFLAGS) -fno-strict-aliasing
+LDFLAGS  = $(shell dpkg-buildflags --get LDFLAGS)
 
 config.status:
 	dh_testdir
@@ -22,7 +19,7 @@ ifeq (hurd, $(DEB_HOST_ARCH_OS))
 	exit 1
 endif
 	cp /usr/share/misc/config.guess /usr/share/misc/config.sub .
-	./configure CFLAGS='$(CFLAGS)' CPPFLAGS='-D_GNU_SOURCE' \
+	./configure CFLAGS='$(CFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' \
 		ac_cv_var_tick=no ac_cv_var_tickadj=no \
 		--prefix=/usr \
 		--enable-all-clocks --enable-parse-clocks --enable-SHM \