Use hardening-wrapper to harden the binaries

* Build-Depend on hardening-wrapper and enable it to work around the
  current upstream munging of CFLAGS and LDFLAGS.  (Closes: #659663)

diff --git a/debian/changelog b/debian/changelog
index b17638698c7eada7ac9af200d6e800068e31d70a..060785de80c0669e97d099f1f976c1025aaa9557 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -16,6 +16,8 @@ openafs (1.6.2~pre2-1) UNRELEASED; urgency=low
       read and write to a file, the reading client may see first couple
       bytes of a file as nulls.
     - Support newer glibc versions.
+  * Build-Depend on hardening-wrapper and enable it to work around the
+    current upstream munging of CFLAGS and LDFLAGS.  (Closes: #659663)
   * Fix server installation instructions in README.servers, which used the
     early demand-attach syntax before separate demand-attach binaries were
     built.  Thanks, Björn Torkelsson.  (Closes: #693311)

diff --git a/debian/control b/debian/control
index 565bcea14c6e6f5edbb3a3b0179048bba122f258..537d9cf01724b1de923eba274ee3f6181fd2fac7 100644 (file)
--- a/debian/control
+++ b/debian/control
@@ -5,8 +5,8 @@ Maintainer: Russ Allbery <rra@debian.org>
 Uploaders: Sam Hartman <hartmans@debian.org>
 Build-Depends: debhelper (>= 9), autoconf, automake, bison, comerr-dev,
  cpio, dblatex, dkms (>= 2.1.1.1), docbook-xsl, doxygen, flex,
- libfuse-dev, libkrb5-dev, libncurses5-dev, libpam0g-dev, libxml2-utils,
- perl, pkg-config, xsltproc
+ hardening-wrapper, libfuse-dev, libkrb5-dev, libncurses5-dev,
+ libpam0g-dev, libxml2-utils, perl, pkg-config, xsltproc
 Standards-Version: 3.9.4
 Homepage: http://www.openafs.org/
 Vcs-Git: git://anonscm.debian.org/pkg-k5-afs/openafs.git

diff --git a/debian/rules b/debian/rules
index e8cc6cb4541d4f2a4ba22990b4ea49d2ee465047..9cd935d11c33a976e3c26c7ac20a7d1b7534443c 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -1,5 +1,10 @@
 #!/usr/bin/make -f
 
+# Enable hardening flags in hardening-wrapper.  This is a temporary
+# workaround until upstream supports using user-provided CFLAGS, CPPFLAGS,
+# and LDFLAGS.
+export DEB_BUILD_HARDENING = 1
+
 # Tell Autoconf the correct system types.
 DEB_HOST_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
 DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)