re: hard-coding -Werror into the build process<p>Yes, -Werror is normally going to break things badly and cause far too much unnecessary work... <i>for most projects</i>. There are a handful of projects, on the other hand, that I would argue -Werror is absolutely necessary. Crypto libraries such as openssl/libressl/gnutls and tools like gnupg are at the top of that list. This list <i>might</i> also include key-handling utils such as {gpg,ssh}-agent and maybe pinentry.<p>Breaking on new GCC features is a good thing, because for these important packages you <i>shouldn't ever</i> be guessing about the programmer intention or <i>assuming</i> that some new warning is safe.<p>Several people brought up -Wunused. We already know about that warning, and so libressl should expect it and compile cleanly. Yes, this might be annoying at times, but cleaning up the code was the goal anyway. What about future versions of GCC? There are only a few possibilities:<p><pre><code> 0) The warning actually is about an important bug.
</code></pre>
Obviously you don't want the build in this case.<p><pre><code> 1) Some new -W flag was added.
</code></pre>
Broken build are important here. The GCC authors probably added that flag for a reason, and you can't <i>guarantee</i>[1] the warning is a false-positive.<p><pre><code> 2) No flags have changed, but some other component has caused
a warning where there wasn't one previously.
</code></pre>
This means something else changed:<p><pre><code> 2a) A function prototype changed. (does it even compile properly?)
2b) Some defined type or macro changed. (could easily be a new bug)
</code></pre>
Yes, in many cases, these are probably trivial. The point is that for some software, forcing someone to actually check is <i>the goal</i>. The problems with openssl that were recently exposed by heartbleed was that <i>nobody was actually checking</i> security-critical components, and simply assuming those checks were being done by somebody else.<p>With -Werror, the fact that it doesn't compile will force someone to either fix some bug or silence the warning by adding the necessary cast or #ifdef or whatever. Really, I have to wonder about anybody who advocates for allowing unchecked builds: why are you ok with the kind of unchecked code that lead to heartbleed and many other security problems? As DJB[2] and PHK[3] both warned: are you <i>trying</i> to prevent a high-security environment?<p>[1] Why can't we guarantee such things? Because answering that would req1uire solving the Halting Problem.<p>[2] <a href="https://news.ycombinator.com/item?id=8023812" rel="nofollow">https://news.ycombinator.com/item?id=8023812</a><p>[3] <a href="http://ftp.belnet.be/FOSDEM/2014/Janson/Sunday/NSA_operation_ORCHESTRA_Annual_Status_Report.webm" rel="nofollow">http://ftp.belnet.be/FOSDEM/2014/Janson/Sunday/NSA_operation...</a>