Re: Retrospective by 'gpg.fail' authors
Sam James replies to GnuPG author Werner Koch that upstream may freely adopt stricter -W compiler warnings, while distros should avoid blanket -Werror.
This is an oss-security mailing list reply by Sam James (Gentoo toolchain maintainer) to Werner Koch in the thread on the 'gpg.fail' authors' retrospective about GnuPG. James states that upstream projects like GnuPG should feel free to enable whatever -W* warning flags they need. He adds that distributions should not use -Werror indiscriminately, allowing narrow exceptions such as -Werror=format-security, and may reject warning-driven bugs that do not reflect real issues. No new CVE or vulnerability details are disclosed in this reply.
- Reply in oss-security thread on gpg.fail retrospective about GnuPG
- Upstream projects free to enable any compiler -W* warning flags
- Distros advised against blanket -Werror except specific flags like format-security
- No new vulnerability, CVE, or exploit discussed in this post
From the original article
Posted by Sam James on Sep 15 Werner Koch writes: Thank you Werner! You should feel free these days to use whatever -W* you want/need to.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.