Re: [meta-networking][PATCH v2 2/2] meta-networking: override SECURITY_CFLAGS for c-ares

["André Draszik" <git@andred.net>]

On Mo, 2016-07-18 at 01:37 -0700, Andre McCurdy wrote:
> On Mon, Jul 18, 2016 at 1:16 AM, Khem Raj <raj.khem@gmail.com> wrote:
> > 
> > On Mon, Jul 18, 2016 at 1:03 AM <git@andred.net> wrote:
> > 
> > > 
> > > From: André Draszik <adraszik@tycoint.com>
> > > 
> > > c-ares doesn't build if the distro has enabled usage of the
> > > security_flags.inc file as it is picky about what is placed
> > > into CPPFLAGS and CFLAGS. It complains and errors out if any
> > > preprocessor options appear in CFLAGS.
> 
> Curl (on which c-ares's configure files seem to be based) used to have
> the same problem but was fixed upstream by:
> 
>  
> https://github.com/curl/curl/commit/5d3cbde72ece7d83c280492957a26e26ab4e5c
> ca

I must say I agree with c-ares' error here, and this really highlights a bug
in how OE handles the security flags. By convention, preprocessor flags
belong into CPPFLAGS, not CFLAGS.

The real solution hence should be to have OE place -D flags (including
${lcl_maybe_fortify} into CPPFLAGS, not CFLAGS in the first place.

But that'd be a change I am not in a position to test, as it would touch
everything. E.g. there might be build-environments that (silently) ignore
user-supplied CPPFLAGS completely (cmake being one of those [1]).

a.

[1]
https://gitlab.kitware.com/cmake/cmake/issues/12928
https://cmake.org/Bug/view.php?id=12928