Re: Retrospective by 'gpg.fail' authors
Sam James replies to GnuPG author Werner Koch that upstream may freely adopt stricter -W compiler warnings, while distros should avoid blanket -Werror.
This is an oss-security mailing list reply by Sam James (Gentoo toolchain maintainer) to Werner Koch in the thread on the 'gpg.fail' authors' retrospective about GnuPG. James states that upstream projects like GnuPG should feel free to enable whatever -W* warning flags they need. He adds that distributions should not use -Werror indiscriminately, allowing narrow exceptions such as -Werror=format-security, and may reject warning-driven bugs that do not reflect real issues. No new CVE or vulnerability details are disclosed in this reply.
- Reply in oss-security thread on gpg.fail retrospective about GnuPG
- Upstream projects free to enable any compiler -W* warning flags
- Distros advised against blanket -Werror except specific flags like format-security
- No new vulnerability, CVE, or exploit discussed in this post
Posted by Sam James on Sep 15 Werner Koch writes: Thank you Werner! You should feel free these days to use whatever -W* you want/need to. No distros should be using -Werror without at least being willing to investigate the problem a bit, some exceptions would be things like -Werror=format-security or similar (so for a specific warning), but even then you're within your rights to say no to such bugs if you think they're not showing a real...
This source does not provide full text. Read it at seclists.org.