dpkg-buildflags: Add a canary feature to the qa feature area

This can be used to test the propagation of build flags by checking the
build logs for any omission.

Closes: #628516

debian/changelog

@@ -41,6 +41,8 @@ dpkg (1.17.14) UNRELEASED; urgency=low
   * Add a new dpkg-buildflags qa feature area:
     - Add a new bug feature, disabled by default, which will enable fatal
       warnings for code that can pose actual problems. Closes: #682659
+    - Add a new canary feature, disabled by default, which will allow tracking
+      build flags propagation. Closes: #628516
 
   [ Raphaël Hertzog ]
   * Explain better in deb-triggers(5) why interest/activate-noawait should be

man/dpkg-buildflags.1

@@ -220,6 +220,15 @@ problems in the source code or build system.
 .B bug
 This setting (disabled by default) adds any warning option that reliably
 detects problematic source code. The warnings are fatal.
+.TP
+.B canary
+This setting (disabled by default) adds dummy canary options to the build
+flags, so that the build logs can be checked for how the build flags
+propagate and to allow finding any omission of normal build flag settings.
+The only currently supported flags are \fBCPPFLAGS\fP, \fBCFLAGS\fP,
+\fBOBJCFLAGS\fP, \fBCXXFLAGS\fP and \fBOBJCXXFLAGS\fP with flags set
+to \fB\-D__DEB_CANARY_\fP\fIflag\fP_\fIrandom-id\fP\fB__\fP, and
+\fBLDFLAGS\fP set to \fB\-Wl,\-z,deb-canary\-\fP\fIrandom-id\fP.
 .
 .SS Hardening
 Several compile-time options (detailed below) can be used to help harden

scripts/Dpkg/Vendor/Debian.pm

@@ -105,6 +105,7 @@ sub _add_qa_flags {
     # Default feature states.
     my %use_feature = (
         bug => 0,
+        canary => 0,
     );
 
     # Adjust features based on Maintainer's desires.
@@ -119,6 +120,17 @@ sub _add_qa_flags {
         }
     }
 
+    # Inject dummy canary options to detect issues with build flag propagation.
+    if ($use_feature{canary}) {
+        require Digest::MD5;
+        my $id = Digest::MD5::md5_hex(int rand 4096);
+
+        foreach my $flag (qw(CPPFLAGS CFLAGS OBJCFLAGS CXXFLAGS OBJCXXFLAGS)) {
+            $flags->append($flag, "-D__DEB_CANARY_${flag}_${id}__");
+        }
+        $flags->append('LDFLAGS', "-Wl,-z,deb-canary-${id}");
+    }
+
     # Store the feature usage.
     while (my ($feature, $enabled) = each %use_feature) {
         $flags->set_feature('qa', $feature, $enabled);