[R-pkg-devel] Compilation used the "non-portable flag"

[Gábor Csárdi]

Thinking about this a bit more, I think this might be a bug in R CMD
check, actually.

I understand that these flags are not portable, and yes, they should
be reported if they are specified in the packages's Makevars* files.
But in this case they are coming from the Ubuntu system's Makevars
setup, and surely, they do work there. I would even say that it is
actually good practice to include them in the system setup.

I can probably provide a patch for this.

Best,
Gabor

On Fri, May 10, 2019 at 10:00 PM Dirk Eddelbuettel <edd using debian.org> wrote:
>
>
> On 10 May 2019 at 20:32, Goldfeld, Keith wrote:
> | Good afternoon –
> |
> | I am submitting an update to my package ‘simstudy’, and the ran the rhub checks. I received a note from one of the four platforms (the other three passed). The Ubuntu Linux 16.04 objected to the compilation flags:
> |
> | * checking compilation flags used ... NOTE
> | Compilation used the following non-portable flag(s):
> |   ‘-Wdate-time’ ‘-Werror=format-security’ ‘-Wformat’
> |
> | I did some searching and someone suggested I create a ‘Makevars’ in the ~/.R directory (which is different from my package directory). This is what I included in the Makevars file:
> |
> | # Settings from /etc/R/Makeconf with "non-portable flag(s):"
> | # ‘-Wdate-time’ ‘-Werror=format-security’ ‘-Wformat’ replaced by -Wall -pedantic
> | # and without -fdebug-prefix-map=...
> | CFLAGS = -g -O2 -Wall -pedantic -fstack-protector-strong -D_FORTIFY_SOURCE=2 $(LTO)
> | CXXFLAGS = -g -O2 -Wall -pedantic -fstack-protector-strong -D_FORTIFY_SOURCE=2 $(LTO)
> | CXX98FLAGS = -g -O2 -Wall -pedantic -fstack-protector-strong -D_FORTIFY_SOURCE=2
> | CXX11FLAGS = -g -O2 -Wall -pedantic -fstack-protector-strong -D_FORTIFY_SOURCE=2
> | CXX14FLAGS = -g -O2 -Wall -pedantic -fstack-protector-strong -D_FORTIFY_SOURCE=2
> |
> | I ran devtools::check(), and it seemed to find the Makevars file. However, when I reran devtools::check_rhub(), I still received a NOTE. Does anyone have any advice on what I might not be getting right?
>
> "A change is gonna come."
>
> This was arguably something I should have taken care of earlier.  The long
> story is that
>
>  - Debian (and thus Ubuntu) impose ‘-Wdate-time -Werror=format-security
>    -Wformat’ for security reasons, and have for a few years
>  - as an OS default these become active on Debian and Ubuntu when R is
>    compiled (see /etc/R/Makeconf)
>  - this confuses people, and what pushed me over the edge was that I had to
>    explain it to one of my STAT 430 students a week or two ago
>
> As discussed on r-sig-debian we currently have another good reason to update
> our R 3.6.0-1 package, and I will add this too.  In the meantime try this on
> local system (and I don't think you can influence the rhub build): just add
>
>    _R_CHECK_COMPILATION_FLAGS_KNOWN_=-Wformat -Werror=format-security -Wdate-time
>
> to any one of $RHOME/etc/Renviron, $RHOME/etc/Renviron.site (and those two
> can be accessed via /etc/R/ for convenience), your ~/.Renviron, your working
> directory's .Renviron (if any), your ~/.R/check.Renviron.
>
> Or wait a couple of days.
>
> Hope this helps,  Dirk
>
> --
> http://dirk.eddelbuettel.com | @eddelbuettel | edd using debian.org
>
> ______________________________________________
> R-package-devel using r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-package-devel