Arch Linux User Repository

I have found the workaround to disable the "-Werror=format-security" flag. Turns out that Module::Build introduced it from the "optimize" variable in Config.pm of the Perl core, which in turn reflects the default settings of the CFLAGS in the Arch Build System, which should be the same as those in /etc/makepkg.conf. For now I'd release the package with this workaround. For the future, I have also opened an issue on the Github project site (https://github.com/Starlink/perl-Starlink-AST/issues/1).

Maybe you (or me) should let upstream know, so that they can fix this potential vulnerability for later versions? https://github.com/Starlink/perl-Starlink-AST

Yes, it also fails for me. The reason is in the source code file lib/Starlink/AST.xs, where the original author uses a possibly dangerous construct (the first argument for printf is a variable, not a literal), which might be exploited by malicious users. The "-Werror=format-security" switch of GCC makes this an error, instead of a warning. This switch is set in makepkg.conf since pacman v6.0.0. I tried to override this by adding "-Wno-error=format-security" in the PKGBUILD to the CFLAGS environment variable, but for some strange reason, it is added back:

$ cc -Isrc -Iast -I/usr/lib/perl5/5.34/core_perl/CORE -DVERSION="3.01" -DXS_VERSION="3.01" -fPIC -Iextsrc -DHAVE_DECL_ISNAN=1 -DSIZEOF_LONG=8 -DSIZEOF_LONG_LONG=8 -DHAVE_INT64_T=1 -DHAVE_UINT64_T=1 -c -D_REENTRANT -D_GNU_SOURCE -fwrapv -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -Wno-error=format-security -march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -flto -o lib/Starlink/AST.o lib/Starlink/AST.c

Whole portions of the CFLAGS environment variable are repeated (starting with -march=x86-64), and I'm not sure where this comes in. I'm not a Perl expert, but suspect that Module::Build does something fishy. I will try to debug this next week.

Build fails for me with same error as already reported https://aur.archlinux.org/packages/perl-starlink-ast#comment-847154

I have no idea why, does it also fail for you @awacha?

I've uploaded perl-tk-zinc to AUR so you can add it to depends too.

Is there a way to disable certain tests? Graphics::PLplot module not installed. This is annoying, it did hang test for me (had to close window manually) and I don't really want to upload to AUR because last upstream update was in 2004.

Sorry for bothering you so many times, this package also needs perl-module-build in makedepends otherwise build fails.

Also it gave warning about some checking prerequisites missing and then later in check it skipped some tests

t/plot00_pgplot.t ... skipped: PGPLOT module not installed.
t/plot00_plplot.t ... skipped: Graphics::PLplot module not installed.
t/plot00_tk.t ....... skipped: Tk modules not installed
t/plot00_tk_zinc.t .. skipped: Tk modules not installed
t/plot_pg.t ......... skipped: PGPLOT module not installed.
t/plot_pl.t ......... skipped: Graphics::PLplot module not installed.
t/plot_tk.t ......... skipped: Tk modules not installed
t/plot_tk_zinc.t .... skipped: Tk module not installed

but honestly this isn't so important.

The error is caused by the '-Werror=format-security' compiler flag in the /etc/makepkg.conf file. In my version of the file this compiler flag was not there (it introduced by commit aa30b5ebf3ef5c1a0415b2adbb80f120224ca8eb to the pacman package on May 20, 2021). Updating the makepkg.conf to the current version brought out the error for me, too.

Sadly, this is an upstream issue (sloppy code / too strict compiler), which I cannot fix. As a workaround, the switch is now disabled (-Wno-error=format-security) explicitly in the PKGBUILD file.

Thanks for reporting!

Build fails

lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Frame_new’:
lib/Starlink/AST.xs:592:3: error: format not a string literal and no format arguments [-Werror=format-security]
  592 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__FrameSet_new’:
lib/Starlink/AST.xs:628:3: error: format not a string literal and no format arguments [-Werror=format-security]
  628 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__CmpFrame_new’:
lib/Starlink/AST.xs:654:3: error: format not a string literal and no format arguments [-Werror=format-security]
  654 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__FluxFrame_new’:
lib/Starlink/AST.xs:670:3: error: format not a string literal and no format arguments [-Werror=format-security]
  670 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__SpecFluxFrame_new’:
lib/Starlink/AST.xs:686:3: error: format not a string literal and no format arguments [-Werror=format-security]
  686 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__CmpMap_new’:
lib/Starlink/AST.xs:703:3: error: format not a string literal and no format arguments [-Werror=format-security]
  703 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__GrismMap_new’:
lib/Starlink/AST.xs:844:3: error: format not a string literal and no format arguments [-Werror=format-security]
  844 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__IntraMap_new’:
lib/Starlink/AST.xs:861:3: error: format not a string literal and no format arguments [-Werror=format-security]
  861 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__LutMap_new’:
lib/Starlink/AST.xs:883:3: error: format not a string literal and no format arguments [-Werror=format-security]
  883 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__MathMap_new’:
lib/Starlink/AST.xs:913:24: error: format not a string literal and no format arguments [-Werror=format-security]
  913 |                        ninv, (const char**)cinv, options );
      |                        ^~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__MatrixMap_new’:
lib/Starlink/AST.xs:946:3: error: format not a string literal and no format arguments [-Werror=format-security]
  946 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__NormMap_new’:
lib/Starlink/AST.xs:962:3: error: format not a string literal and no format arguments [-Werror=format-security]
  962 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Plot__new’:
lib/Starlink/AST.xs:990:3: error: format not a string literal and no format arguments [-Werror=format-security]
  990 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__PcdMap_new’:
lib/Starlink/AST.xs:1041:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1041 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__PermMap_new’:
lib/Starlink/AST.xs:1086:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1086 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__PolyMap_new’:
lib/Starlink/AST.xs:1133:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1133 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__ChebyMap_new’:
lib/Starlink/AST.xs:1277:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1277 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__SelectorMap_new’:
lib/Starlink/AST.xs:1323:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1323 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__ShiftMap_new’:
lib/Starlink/AST.xs:1344:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1344 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__SwitchMap_new’:
lib/Starlink/AST.xs:1367:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1367 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__UnitNormMap_new’:
lib/Starlink/AST.xs:1388:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1388 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__SkyFrame_new’:
lib/Starlink/AST.xs:1403:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1403 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__SpecFrame_new’:
lib/Starlink/AST.xs:1429:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1429 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__DSBSpecFrame_new’:
lib/Starlink/AST.xs:1443:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1443 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__TimeFrame_new’:
lib/Starlink/AST.xs:1457:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1457 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__SlaMap_new’:
lib/Starlink/AST.xs:1482:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1482 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__SphMap_new’:
lib/Starlink/AST.xs:1496:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1496 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__SpecMap_new’:
lib/Starlink/AST.xs:1512:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1512 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__TimeMap_new’:
lib/Starlink/AST.xs:1526:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1526 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__TranMap_new’:
lib/Starlink/AST.xs:1557:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1557 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__UnitMap_new’:
lib/Starlink/AST.xs:1572:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1572 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__WcsMap_new’:
lib/Starlink/AST.xs:1590:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1590 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__WinMap_new’:
lib/Starlink/AST.xs:1614:23: error: format not a string literal and no format arguments [-Werror=format-security]
 1614 |                       pack1D(newRV_noinc((SV*)outb),'d'),options );
      |                       ^~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__ZoomMap_new’:
lib/Starlink/AST.xs:1628:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1628 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Set’:
lib/Starlink/AST.xs:1811:3: error: format not a string literal and no format arguments [-Werror=format-security]
 1811 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__KeyMap_new’:
lib/Starlink/AST.xs:2081:3: error: format not a string literal and no format arguments [-Werror=format-security]
 2081 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Table_new’:
lib/Starlink/AST.xs:2614:3: error: format not a string literal and no format arguments [-Werror=format-security]
 2614 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__FitsTable_new’:
lib/Starlink/AST.xs:2765:3: error: format not a string literal and no format arguments [-Werror=format-security]
 2765 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__RateMap_new’:
lib/Starlink/AST.xs:3825:3: error: format not a string literal and no format arguments [-Werror=format-security]
 3825 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Ellipse_new’:
lib/Starlink/AST.xs:4145:3: error: format not a string literal and no format arguments [-Werror=format-security]
 4145 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Box_new’:
lib/Starlink/AST.xs:4217:4: error: format not a string literal and no format arguments [-Werror=format-security]
 4217 |    ASTCALL(
      |    ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Interval_new’:
lib/Starlink/AST.xs:4247:4: error: format not a string literal and no format arguments [-Werror=format-security]
 4247 |    ASTCALL(
      |    ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Polygon_new’:
lib/Starlink/AST.xs:4295:4: error: format not a string literal and no format arguments [-Werror=format-security]
 4295 |    ASTCALL(
      |    ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__NullRegion_new’:
lib/Starlink/AST.xs:4323:4: error: format not a string literal and no format arguments [-Werror=format-security]
 4323 |    ASTCALL(
      |    ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Region_CmpRegion’:
lib/Starlink/AST.xs:4342:4: error: format not a string literal and no format arguments [-Werror=format-security]
 4342 |    ASTCALL(
      |    ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Circle_new’:
lib/Starlink/AST.xs:4414:3: error: format not a string literal and no format arguments [-Werror=format-security]
 4414 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Moc_new’:
lib/Starlink/AST.xs:4458:3: error: format not a string literal and no format arguments [-Werror=format-security]
 4458 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__Prism_new’:
lib/Starlink/AST.xs:4633:3: error: format not a string literal and no format arguments [-Werror=format-security]
 4633 |   ASTCALL(
      |   ^~~~~~~
lib/Starlink/AST.xs: In function ‘XS_Starlink__AST__PointList_new’:
lib/Starlink/AST.xs:4661:3: error: format not a string literal and no format arguments [-Werror=format-security]
 4661 |   ASTCALL(
      |   ^~~~~~~
cc1: some warnings being treated as errors
error building lib/Starlink/AST.o from 'lib/Starlink/AST.c' at /usr/share/perl5/core_perl/ExtUtils/CBuilder/Base.pm line 185.