This fix for libgcrypt CFLAGS filtering OK?

["Dr. Thomas Orgis" <thomas.orgis%uni-hamburg.de@localhost>]

Hi,

I've seen that libgcrypt fails to build with my CFLAGS at a crucial
spot where it really wants -O0, but trips over -O2 in my CFLAGS later
on. The fix present in the Makefile seems incomplete. So I first tried
this change*:

diff -ruN pkgsrc-2025Q1/security/libgcrypt/Makefile pkgsrc/security/libgcrypt/Makefile
--- pkgsrc-2025Q1/security/libgcrypt/Makefile   2025-04-02 05:01:42.000000000 +0200
+++ pkgsrc/security/libgcrypt/Makefile  2025-04-11 15:57:14.058983268 +0200
@@ -25,7 +25,7 @@

 # Parts of the code actively reject optimisation.  The configure script
 # strips out most flags but oddly does not handle -O so do it ourselves.
-CFLAGS:=               ${CFLAGS:C/^-O$//g}
+CFLAGS:=               ${CFLAGS:C/^-O[1-9]?$//g}

 SUBST_CLASSES+=                rpath
 SUBST_FILES.rpath=     src/libgcrypt-config.in

… which works for me, but misses the point. See below.

I realize that this only hit me because I had my CFLAGS in the
environment as wells as mk.conf doing

CFLAGS += …

to add to them instead of CFLAGS= … So the filter code of libgcrypt
does not fully catch the doubled -O2. It does:

  sed -e 's/[[:blank:]]-O\([1-9sgz][1-9sgz]*\)/ -O0 /' -e 's/[[:blank:]]-Ofast/ -O0 /g'

It filters also -Os and friends, as well as -Ofast … but only the
latter with /g.

It seems that only -O<level> is causing the hard error in the build.
Maybe some specific optimization option will break the respective code
and won't be detected as such by the libgcrypt build. That's a guess.
Crypto code is fun!

This is the error:

--- rndgetentropy.lo ---
libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I.. -I../src -I/tmp/work/pkgsrc/2025Q1-devel/bw/security/libgcrypt/work/.buildlink/include -march=native -O2 -fno-math-errno -ftree-vectorize -march=native -O2 -fno-math-errno -ftree-vectorize -I/sw/env/gcc-13.2.0/openmpi/4.1.6/include -I/sw/compiler/gcc-13.2.0/include -fvisibility=hidden -fno-delete-null-pointer-checks -Wall -MT rndgetentropy.lo -MD
 -MP -MF .deps/rndgetentropy.Tpo -c rndgetentropy.c  -fPIC -DPIC -o .libs/rndgetentropy.o
--- rndjent.lo ---
libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I.. -I../src -I/tmp/work/pkgsrc/2025Q1-devel/bw/security/libgcrypt/work/.buildlink/include -march=native -O0 -fno-math-errno -ftree-vectorize -march=native -O2 -fno-math-errno -ftree-vectorize -I/sw/env/gcc-13.2.0/openmpi/4.1.6/include -I/sw/compiler/gcc-13.2.0/include -fvisibility=hidden -fno-delete-null-pointer-checks -Wall -c ./rndjent.c  -fPIC -DPIC -o .libs/rndjent.o
In file included from ./rndjent.c:99:
./jitterentropy-base.c:58:3: error: #error "The CPU Jitter random number generator must not be compiled with optimizations. See documentation. Use the compiler switch -O0 for compiling jitterentropy.c."
   58 |  #error "The CPU Jitter random number generator must not be compiled with optimizations. See documentation. Use the compiler switch -O0 for compiling jitterentropy.c."
      |   ^~~~~

You see that one -O2 got converted to -O0, but the second one is still
there.

The proper fix might be to patch the filtering that libgcrypt does.

$ echo "$CFLAGS $CFLAGS" | sed -e 's/[[:blank:]]-O\([1-9sgz][1-9sgz]*\)/ -O0 /' -e 's/[[:blank:]]-Ofast/ -O0 /g'
-march=native -O0  -fno-math-errno -ftree-vectorize -march=native -O2 -fno-math-errno -ftree-vectorize
$ echo "$CFLAGS $CFLAGS" | sed -e 's/[[:blank:]]-O\([1-9sgz][1-9sgz]*\)/ -O0 /g' -e 's/[[:blank:]]-Ofast/ -O0 /g'
-march=native -O0  -fno-math-errno -ftree-vectorize -march=native -O0  -fno-math-errno -ftree-vectorize

Not sure why the exp adds spaces, but they don't hurt.

To conclude … I guess the better change is this plus upstream report:

diff -ruN pkgsrc-2025Q1/security/libgcrypt/Makefile pkgsrc/security/libgcrypt/Makefile
--- pkgsrc-2025Q1/security/libgcrypt/Makefile   2025-04-02 05:01:42.000000000 +0200
+++ pkgsrc/security/libgcrypt/Makefile  2025-04-11 16:39:53.958633274 +0200
@@ -23,10 +23,6 @@
 CFLAGS+=               -fheinous-gnu-extensions
 .endif

-# Parts of the code actively reject optimisation.  The configure script
-# strips out most flags but oddly does not handle -O so do it ourselves.
-CFLAGS:=               ${CFLAGS:C/^-O$//g}
-
 SUBST_CLASSES+=                rpath
 SUBST_FILES.rpath=     src/libgcrypt-config.in
 SUBST_STAGE.rpath=     pre-configure
diff -ruN pkgsrc-2025Q1/security/libgcrypt/distinfo pkgsrc/security/libgcrypt/distinfo
--- pkgsrc-2025Q1/security/libgcrypt/distinfo   2025-04-02 05:01:42.000000000 +0200
+++ pkgsrc/security/libgcrypt/distinfo  2025-04-11 16:40:40.125872971 +0200
@@ -8,4 +8,6 @@                                                      
 SHA1 (patch-cipher_rijndael-arm.S) = ef3cb7f481022440780eb48ae31cbfad0a3ec115
 SHA1 (patch-config.h.in) = b065aca0c4bf11cd45507b14d60b682be10ab8c9 
 SHA1 (patch-mpi_config.links) = 0e87480ead46914653405bb9c693554180ccd126
+SHA1 (patch-random_Makefile.am) = 651e5af8596868a4f7fc58baff6b2bb4a0edc96e
+SHA1 (patch-random_Makefile.in) = bc2353f5537b38cfeb0f4aa39820a18c578fab69
 SHA1 (patch-src_visibility.h) = 8cbbf6803ab34b4b7dda832aa8ee18247aa89518
diff -ruN pkgsrc-2025Q1/security/libgcrypt/patches/patch-random_Makefile.am pkgsrc/security/libgcrypt/patches/patch-random_Makefile.am
--- pkgsrc-2025Q1/security/libgcrypt/patches/patch-random_Makefile.am   1970-01-01 01:00:00.000000000 +0100
+++ pkgsrc/security/libgcrypt/patches/patch-random_Makefile.am  2025-04-11 16:40:23.100145134 +0200
@@ -0,0 +1,15 @@                                                     
+$NetBSD$                                                            
+                                                                    
+Remove multiple -On flags that could occur in constructed CFLAGS.   
+                                                                    
+--- random/Makefile.am.orig    2025-04-11 14:38:44.506744935 +0000  
++++ random/Makefile.am                                              
+@@ -56,7 +56,7 @@ jitterentropy-base.c jitterentropy.h jit          
+                                                                    
+ # The rndjent module needs to be compiled without optimization.  */
+ if ENABLE_O_FLAG_MUNGING                                           
+-o_flag_munging = sed -e 's/[[:blank:]]-O\([1-9sgz][1-9sgz]*\)/ -O0 /' -e 's/[[:blank:]]-Ofast/ -O0 /g'
++o_flag_munging = sed -e 's/[[:blank:]]-O\([1-9sgz][1-9sgz]*\)/ -O0 /g' -e 's/[[:blank:]]-Ofast/ -O0 /g'
+ else                                                               
+ o_flag_munging = cat                                               
+ endif                                                              
diff -ruN pkgsrc-2025Q1/security/libgcrypt/patches/patch-random_Makefile.in pkgsrc/security/libgcrypt/patches/patch-random_Makefile.in
--- pkgsrc-2025Q1/security/libgcrypt/patches/patch-random_Makefile.in   1970-01-01 01:00:00.000000000 +0100
+++ pkgsrc/security/libgcrypt/patches/patch-random_Makefile.in  2025-04-11 16:40:34.639955638 +0200
@@ -0,0 +1,15 @@                                                     
+$NetBSD$                                                            
+                                                                    
+Remove multiple -On flags that could occur in constructed CFLAGS.   
+                                                                    
+--- random/Makefile.in.orig    2025-04-11 14:38:48.120687327 +0000  
++++ random/Makefile.in                                              
+@@ -407,7 +407,7 @@ jitterentropy-base.c jitterentropy.h jit        
+ @ENABLE_O_FLAG_MUNGING_FALSE@o_flag_munging = cat                  
+                                                                    
+ # The rndjent module needs to be compiled without optimization.  */
+-@ENABLE_O_FLAG_MUNGING_TRUE@o_flag_munging = sed -e 's/[[:blank:]]-O\([1-9sgz][1-9sgz]*\)/ -O0 /' -e 's/[[:blank:]]-Ofast/ -O0 /g'
++@ENABLE_O_FLAG_MUNGING_TRUE@o_flag_munging = sed -e 's/[[:blank:]]-O\([1-9sgz][1-9sgz]*\)/ -O0 /g' -e 's/[[:blank:]]-Ofast/ -O0 /g'
+ all: all-am                                                        
+                                                                    
+ .SUFFIXES:                                                         

Any opinions? Does this warrant a PKGREVISION? The former behaviour was
not-building for repeated -O flags.


Alrighty then,

Thomas

PS: Apart from libgcrypt upstream, generally, pkgsrc seems to favour
code-works-at-all over heavy optimization, which means that I have to
remove some settings in packages that explicitly opt out  of
CPU-specific optimizations, for example. Understandable for
portability, but maybe a general switch for either

1. „opmitized build for the build host CPU, give me all native stuff“ or
2. „portable binaries for this arch family”

would be nice and those opt-outs be conditional.

* You got a good pointer to the bmake regex syntax description?

-- 
Dr. Thomas Orgis
HPC @ Universität Hamburg