build: enable missing OpenSSF-recommended warnings, with fixes #12489
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vszakats
changed the title
vszakats
commented
Dec 8, 2023
bagder
reviewed
Dec 8, 2023
vszakats
changed the title
vszakats
force-pushed
the
openssf
branch
6 times, most recently
from
8467031
to
722d4c8
Compare
|
This is ready now. |
bagder
reviewed
Dec 11, 2023
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Dec 11, 2023
vszakats
commented
Dec 11, 2023
|
Renamed to use Is there something else to address? |
also add `-Wsign-conversion` commented, with FIXME
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Apr 29, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Apr 29, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
This was referenced Apr 29, 2024
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Apr 30, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Apr 30, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 5, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 5, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 7, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 7, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
that referenced
this pull request
May 11, 2024
- extend `FD_SET()` hack to all platforms (was only Cygwin). Warnings may also happen in other envs, e.g. OmniOS. Ref: https://github.com/libssh2/libssh2/actions/runs/8854199687/job/24316762831#step:3:2021 - tidy-up `CURLcode` vs `int` use. - cast an unsigned to `long` before passing to `curl_easy_setopt()`. Cherry-picked from #13489 Follow-up to 3829759 #12489 Closes #13501
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 11, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 11, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 12, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 12, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 13, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 13, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 14, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
May 14, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Jun 2, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Jun 2, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Jun 5, 2024
Warn by default in all builds, but without triggering error. Once all new warnings revealed by CI are cleared, we can drop the `-Wno-error=sign-conversion` options in cmake/autotools. Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
vszakats
added a commit
to vszakats/curl
that referenced
this pull request
Jun 5, 2024
Before this patch, cmake/autotools builds made an exception for this warning to not cause an error. The codebase is warning-free now, so this patch deletes this exception. Follow-up [...] Follow-up to3829759bd042c03225ae862062560f568ba1a231 curl#12489 Closes #xxxxx
1 task
vszakats
added a commit
that referenced
this pull request
Sep 2, 2024
Change mingw-w64 printf format checks in public curl headers to use `__MINGW_PRINTF_FORMAT` instead of `gnu_printf`. This syncs the format checker with format string macros published via `curl/system.h`. (Also disable format checks for mingw-w64 older than 3.0.0 (2013-09-20) and classic-mingw, which do not support this macro.) This fixes bogus format checker `-Wformat` warnings in 3rd party code using curl format strings with the curl printf functions, when using mingw-w64 7.0.0 (2019-11-10) and older (with GCC, MSVCRT). It also allows to delete two workaounds for this within curl itself: - setting `-D__USE_MINGW_ANSI_STDIO=1` for mingw-w64 via cmake and configure for `docs/examples` and `tests/http/clients`. Ref: c730c85 #14640 The format check macro is incompatible (depending on mingw-w64 version and configuration) with the C99 `%z` (`size_t`) format string used internally by curl. To work around this problem, override the format check style in curl public headers to use `gnu_printf`. This is compatible with `%z` in all mingw-w64 versions and allows keeping the C99 format strings internally. Also: - lib/ws.c: add missing space to an error message. - docs/examples/ftpgetinfo.c: fix to use standard printf. Ref: #14643 (take 1) Follow-up to 3829759 #12489 Closes #14703
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
[as of 2023-11-29]
Enable new recommended warnings (except
-Wsign-conversion):-Wformat=2for clang (in both cmake and autotools).CURL_PRINTF()internal attribute and mark functions acceptingprintf arguments with it. This is a copy of existing
CURL_TEMP_PRINTF()but using__printf__to make it compatiblewith redefinting the
printfsymbol:https://gcc.gnu.org/onlinedocs/gcc-3.0.4/gcc_5.html#SEC94
CURL_PRINTF()and existingCURL_TEMP_PRINTF()formingw-w64 and enable it on this platform.
-Wimplicit-fallthrough.-Wtrampolines.-Wsign-conversioncommented with a FIXME.-pedantic-errorsthe way we do it with autotools.Follow-up to d5c0351 Enable and fix more GCC warnings #2747
CURL_FORMAT(), this also fixes it to enable formatchecks. Previously it was always disabled due to the internal
printfmacro.
Fix them:
set_ipv6_v6only()call was missed in builds with--disable-verbose/CURL_DISABLE_VERBOSE_STRINGS=ON.FALLTHROUGH()macro.FALLTHROUGH().warnings in most cases). Add missing ones. Fix indentation.
-Wformat-nonliteralwarnings with llvm/clang.-Wformat-nonliteralwarning.-Wformatand-Wformat-securitywarnings.CURL_FORMAT_SOCKET_Tvalue for mingw-w64. Also move itsdefinition to
lib/curl_setup.hallowing use intests/server.Co-authored-by: Jay Satiro
-Wformatwarnings on mingw-w64.Closes #12489
TODO:
-Warith-conversionwarnings. [other PR]-Wsign-conversionwarnings. [other PR]