Makefile: use additional hardening flags from Debian

diff --git a/Makefile b/Makefile
index 48d848ab9c692511e16fd4935b48293334720e3d..8ffbbff5afabd9ab7bdab3a73fc8a0cc856282dd 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,12 @@
-CFLAGS := -g -O2 -fPIE -fstack-protector-strong -Wall -Wextra -Wconversion $(CFLAGS)
-CPPFLAGS := -D_FORTIFY_SOURCE=2 $(CPPFLAGS)
-LDFLAGS := -fPIE -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)
+CFLAGS := -Wall -Wextra -Wconversion $(CFLAGS)
+# Default on Debian, enforce it for all systems.
+CFLAGS := -fPIE $(CFLAGS)
+LDFLAGS := -fPIE -pie $(LDFLAGS)
+
+# DEB_BUILD_MAINT_OPTIONS='qa=+all,-canary hardening=+all reproducible=+all,-fixdebugpath' dpkg-buildflags --export=make
+export CFLAGS := -g -O2 -Werror=array-bounds -Werror=clobbered -Werror=volatile-register-var -Werror=implicit-function-declaration -fstack-protector-strong -Wformat -Werror=format-security $(CFLAGS)
+export CPPFLAGS := -Wdate-time -D_FORTIFY_SOURCE=2 $(CPPFLAGS)
+export LDFLAGS := -Wl,-z,relro -Wl,-z,now $(LDFLAGS)
 
 
 ptyas: ptyas.c