From e5c6835234b3d9145dbcc41b3c33e0d2a477c0d0 Mon Sep 17 00:00:00 2001
From: Mathieu Benoit <mathben@technolibre.ca>
Date: Sat, 22 Aug 2026 00:08:00 -0400
Subject: [PATCH] [FIX] libxcrypt: a compiler newer than the release expects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

  lib/crypt-gost-yescrypt.c:134:16: error: initialization discards 'const'
    qualifier from pointer target type

A warning, promoted by libxcrypt's own -Werror. Our gcc is 16.2.1 and libxcrypt
4.5.2 was released against considerably older ones; the same code warns the same
way on x86_64 with the same compiler, so this says nothing about s390x.

--disable-werror is libxcrypt's own switch. Patching the source would mean
carrying a diff against upstream C for a const-correctness nit in an
implementation of a Russian hash standard nothing here uses. Declining to treat
warnings as errors is what a distribution does when its compiler is ahead of a
release.

Both configure calls: libxcrypt is built twice, once for the obsolete-API compat
library. Fixing only the first leaves the second failing identically, which reads
as if the flag had done nothing.

--- FR ---

  lib/crypt-gost-yescrypt.c:134:16: error: initialization discards 'const'
    qualifier from pointer target type

Un avertissement, promu par le -Werror de libxcrypt lui-même. Notre gcc est en
16.2.1 et libxcrypt 4.5.2 est sorti face à bien plus anciens ; le même code
avertit de la même façon sur x86_64 avec le même compilateur — cela ne dit rien
de s390x.

--disable-werror est l'interrupteur de libxcrypt. Corriger la source
supposerait de porter un correctif contre du C amont pour une vétille de
const-correction dans une implémentation d'une norme de hachage russe dont rien
ici ne se sert. Refuser de traiter les avertissements en erreurs est ce que fait
une distribution quand son compilateur devance une version.

Les deux appels à configure : libxcrypt est bâti deux fois, dont une pour la
bibliothèque de compatibilité. Ne corriger que le premier laisse le second
échouer à l'identique, ce qui se lit comme un drapeau sans effet.

Assisted-by: Claude Opus 5
---
 patches/pkgbuild/libxcrypt.sh | 37 +++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100755 patches/pkgbuild/libxcrypt.sh

diff --git a/patches/pkgbuild/libxcrypt.sh b/patches/pkgbuild/libxcrypt.sh
new file mode 100755
index 0000000..5126b79
--- /dev/null
+++ b/patches/pkgbuild/libxcrypt.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# libxcrypt: build with a compiler newer than it expects.
+#
+#   lib/crypt-gost-yescrypt.c:134:16: error: initialization discards 'const'
+#     qualifier from pointer target type
+#
+# A warning, promoted to an error by libxcrypt's own -Werror. Our gcc is 16.2.1;
+# libxcrypt 4.5.2 was released against considerably older ones, and this
+# diagnostic is not about the port -- the same code warns the same way on x86_64
+# with the same compiler.
+#
+# --disable-werror is libxcrypt's own switch. Patching the source would mean
+# carrying a diff against upstream C for a const-correctness nit in an
+# implementation of a Russian hash standard that nothing here uses; declining to
+# treat warnings as errors is what a distribution does when its compiler is
+# ahead of a release.
+#
+# BOTH CONFIGURE CALLS. libxcrypt is built twice -- once normally and once for
+# the obsolete-API compat library -- and fixing only the first leaves the second
+# failing identically, which reads as if the flag had no effect.
+set -euo pipefail
+python3 - <<'ZZPY'
+import io, re
+lines = io.open("PKGBUILD", encoding="utf-8").read().split("\n")
+hit = [i for i, l in enumerate(lines) if re.search(r"/configure[ \t]*\\\\?$", l)]
+assert len(hit) == 2, "libxcrypt: expected two configure calls, got %d" % len(hit)
+# Backwards, so inserting does not move the indices still to be used.
+for i in reversed(hit):
+    ind = re.match(r"^[ \t]*", lines[i]).group(0)
+    assert lines[i].rstrip().endswith("\\"), \
+        "libxcrypt: a configure call does not continue: %r" % lines[i]
+    lines.insert(i + 1, ind + "  --disable-werror \\")
+io.open("PKGBUILD", "w", encoding="utf-8").write("\n".join(lines))
+ZZPY
+n=$(grep -c -- "--disable-werror" PKGBUILD)
+[ "$n" = 2 ] || { echo "libxcrypt: expected 2 --disable-werror, found $n" >&2; exit 1; }
+echo "libxcrypt: -Werror disabled in both builds"