Add configure --enable-werror argument

This should be used instead of putting -Werror in CFLAGS
before configure, as -Werror interferes with conftests.

Update github actions to use that.

.github/workflows/build.yml

@@ -15,6 +15,8 @@ jobs:
         #   runcheck: 'no'
         # Otherwise GH expressions will make a None var
         # compare with False. We want an undefined default of True.
+
+        # MULTI and NOWRITEV are passed as integers to the build
         include:
           - name: plain linux
 
@@ -24,10 +26,10 @@ jobs:
           - name: bundled libtom, bionic , no writev()
             # test can use an older distro with bundled libtommath
             os: ubuntu-18.04
-            configure_flags: --enable-bundled-libtom
+            configure_flags: --enable-bundled-libtom --enable-werror
             # NOWRITEV is unrelated, test here to save a job
             nowritev: 1
-            # pytest relies on python3.7
+            # our tests expect >= python3.7
             runcheck: 'no'
 
           - name: linux clang
@@ -37,7 +39,7 @@ jobs:
             os: macos-10.15
             cc: clang
             # OS X says daemon() and utmp are deprecated
-            wextraflags: -Wno-deprecated-declarations -Werror
+            extracflags: -Wno-deprecated-declarations
             runcheck: 'no'
             apt: 'no'
             # fails with:
@@ -47,7 +49,7 @@ jobs:
           - name: macos 11
             os: macos-11
             cc: clang
-            wextraflags: -Wno-deprecated-declarations -Werror
+            extracflags: -Wno-deprecated-declarations
             runcheck: 'no'
             apt: 'no'
             ranlib: ranlib -no_warning_for_no_symbols
@@ -55,7 +57,7 @@ jobs:
           # # Fuzzers run standalone. A bit superfluous with cifuzz, but
           # # good to run the whole corpus to keep it working.
           # - name: fuzzing with address sanitizer
-          #   configure_flags: --enable-fuzz --disable-harden --enable-bundled-libtom
+          #   configure_flags: --enable-fuzz --disable-harden --enable-bundled-libtom --enable-werror
           #   ldflags: -fsanitize=address
           #   extracflags: -fsanitize=address
           #   fuzz: True
@@ -63,7 +65,7 @@ jobs:
 
           # # Undefined Behaviour sanitizer
           # - name: fuzzing with undefined behaviour sanitizer
-          #   configure_flags: --enable-fuzz --disable-harden --enable-bundled-libtom
+          #   configure_flags: --enable-fuzz --disable-harden --enable-bundled-libtom --enable-werror
           #   ldflags: -fsanitize=undefined
           #   # don't fail with alignment due to https://github.com/libtom/libtomcrypt/issues/549
           #   extracflags: -fsanitize=undefined -fno-sanitize-recover=undefined -fsanitize-recover=alignment
@@ -72,11 +74,10 @@ jobs:
 
     env:
       MULTI: ${{ matrix.multi }}
-      WEXTRAFLAGS: ${{ matrix.wextraflags || '-Werror' }}
       CC: ${{ matrix.cc || 'gcc' }}
       LDFLAGS: ${{ matrix.ldflags }}
       EXTRACFLAGS: ${{ matrix.extracflags }}
-      CONFIGURE_FLAGS: ${{ matrix.configure_flags }}
+      CONFIGURE_FLAGS: ${{ matrix.configure_flags || '--enable-werror' }}
       # for fuzzing
       CXX: clang++
       RANLIB: ${{ matrix.ranlib || 'ranlib' }}
@@ -106,7 +107,7 @@ jobs:
           key: "hg.ucc/fuzzcorpus"
 
       - name: configure
-        run: ./configure $CONFIGURE_FLAGS CFLAGS="-O2 -Wall -Wno-pointer-sign $WEXTRAFLAGS $EXTRACFLAGS" --prefix="$HOME/inst" || (cat config.log; exit 1)
+        run: ./configure $CONFIGURE_FLAGS CFLAGS="-O2 -Wall -Wno-pointer-sign $EXTRACFLAGS" --prefix="$HOME/inst" || (cat config.log; exit 1)
 
       - name: nowritev
         if: ${{ matrix.nowritev }}

configure

@@ -697,6 +697,7 @@ ac_user_opts='
 enable_option_checking
 enable_static
 enable_harden
+enable_werror
 enable_largefile
 with_zlib
 enable_zlib
@@ -1354,6 +1355,7 @@ Optional Features:
   --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
   --enable-static         Build static binaries
   --disable-harden        Don't set hardened build flags
+  --enable-werror         Set -Werror when building
   --disable-largefile     omit support for large files
   --disable-zlib          Don't include zlib support
   --enable-pam            Try to include PAM support
@@ -2378,6 +2380,7 @@ $as_echo "$as_me: Source directory Mercurial base revision $hgrev" >&6;}
 fi
 
 ORIGCFLAGS="$CFLAGS"
+LATE_CFLAGS=""
 # Checks for programs.
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
@@ -3506,6 +3509,20 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 
 fi
 
+# Check whether --enable-werror was given.
+if test "${enable_werror+set}" = set; then :
+  enableval=$enable_werror;
+		if test "x$enableval" = "xyes"; then
+			# -Werror shouldn't be set when configure runs tests.
+			# We add it to the Makefile's CFLAGS
+			LATE_CFLAGS+="$LATE_CFLAGS -Werror"
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: Enabling -Werror" >&5
+$as_echo "$as_me: Enabling -Werror" >&6;}
+		fi
+
+fi
+
+
 # large file support is useful for scp
 # Check whether --enable-largefile was given.
 if test "${enable_largefile+set}" = set; then :
@@ -7440,6 +7457,9 @@ if test $BUNDLED_LIBTOM = 1 ; then
 LIBTOM_FILES="libtomcrypt/Makefile libtommath/Makefile"
 fi
 
+# flags that should be set in Makefile but not for configure tests
+CFLAGS="$CFLAGS $LATE_CFLAGS"
+
 ac_config_headers="$ac_config_headers config.h"
 
 ac_config_files="$ac_config_files Makefile $LIBTOM_FILES test/Makefile"

configure.ac

@@ -16,6 +16,7 @@ if test -s "`which hg`" && test -d "$srcdir/.hg"; then
 fi
 
 ORIGCFLAGS="$CFLAGS"
+LATE_CFLAGS=""
 # Checks for programs.
 AC_PROG_CC
 
@@ -127,6 +128,17 @@ if test "$hardenbuild" -eq 1; then
 
 fi
 
+AC_ARG_ENABLE(werror,
+	[  --enable-werror         Set -Werror when building],
+	[
+		if test "x$enableval" = "xyes"; then
+			# -Werror shouldn't be set when configure runs tests.
+			# We add it to the Makefile's CFLAGS
+			LATE_CFLAGS+="$LATE_CFLAGS -Werror"
+			AC_MSG_NOTICE(Enabling -Werror)
+		fi
+	], [])
+
 # large file support is useful for scp
 AC_SYS_LARGEFILE
 
@@ -861,6 +873,9 @@ if test $BUNDLED_LIBTOM = 1 ; then
 LIBTOM_FILES="libtomcrypt/Makefile libtommath/Makefile"
 fi
 
+# flags that should be set in Makefile but not for configure tests
+CFLAGS="$CFLAGS $LATE_CFLAGS"
+
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_FILES(Makefile $LIBTOM_FILES test/Makefile)
 AC_OUTPUT