Failing to build lzma due to format-security even though it's disabled

I'm on commit 221fbfa2d854ccb6cd003c065ec308fbc0651b11 (HEAD -> 22.0.3, tag: v22.03.3) . Running make tools/lzma/compile -j1 V=s gives me the following error (I've pulled out what I think are the relevant parts).

make -C /home/austin/Documents/openwrt/build_dir/host/lzma-4.65/C/LzmaUtil -f makefile.gcc
make[3]: Entering directory '/home/austin/Documents/openwrt/build_dir/host/lzma-4.65/C/LzmaUtil'
gcc -c -O2 -Wall LzmaUtil.c
LzmaUtil.c: In function 'Decode2':
LzmaUtil.c:95:39: warning: suggest parentheses around '&&' within '||' [-Wparentheses]
   95 |       if (res != SZ_OK || thereIsSize && unpackSize == 0)
      |                           ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~
LzmaUtil.c: In function 'main':
LzmaUtil.c:252:10: error: format not a string literal and no format arguments [-Werror=format-security]
  252 |   printf(rs);
      |          ^~
cc1: some warnings being treated as errors
make[3]: *** [makefile.gcc:24: LzmaUtil.o] Error 1

Despite the fact that in my .config file I've disabled FORMAT_SECURITY.

openwrt-fhs-chrootenv:austin@austin-work:~/Documents/openwrt$ rg FORMAT_SECURITY .config
374:# CONFIG_PKG_CHECK_FORMAT_SECURITY is not set

What's even stranger is that yesterday I had this problem, found what I thought was the solution (disabling format-security), and had a fully successful image build. But I wanted to make sure my steps were repeatable so I started over (distclean, copied over the .config), and I've hit the same issue again.

Anyone else having a similar issue? What am I doing wrong? Keep in mind I didn't know how to compile OpenWRT at all until 2-3 days ago.

I should note I also tried adding PKG_CHECK_FORMAT_SECURITY:=0 to tools/lzma/Makefile, same issue.

@K900 I see on GitHub you've mentioned this issue, any ideas?

Did either of you ever find an answer here? Running into the same issue building on NixOS 23.05 with the OpenWRT nix-environment

Never did and haven't gone back to it since. Still interested, though. Was considering posting in the NixOS Networking Matrix channel.

Neither did I, went with a Podman build container instead and haven't had issues since.

At least not with the build environment. :joy:

I ran into this issue on NixOS unstable too today. And solved it after a while of tinkering.

You have to be aware of nixpkgs hardening when building on NixOS.

Consider setting hardeningDisable = [ "all" ]; in your dev shell.

This made this error disappear for me.

1 Like