In an attempt to build GCC (6.3) on NixOS (16.09), within a nix-shell, I get this:

make[1]: Entering directory '<my-build-path>/coreboot/util/crossgcc/build-i386-elf-GCC/build-x86_64-pc-linux-gnu/libcpp'
test -f config.h || (rm -f stamp-h1 && make stamp-h1)
g++  -I../../../gcc-6.3.0/libcpp -I. -I../../../gcc-6.3.0/libcpp/../include -I../../../gcc-6.3.0/libcpp/include  -O2  -fomit-frame-pointer -m64 -W -Wall -Wno-narrowing -Wwrite-strings -Wmissing-format-attribute -pedantic -Wno-long-long  -fno-exceptions -fno-rtti -I../../../gcc-6.3.0/libcpp -I. -I../../../gcc-6.3.0/libcpp/../include -I../../../gcc-6.3.0/libcpp/include   -c -o expr.o -MT expr.o -MMD -MP -MF .deps/expr.Tpo ../../../gcc-6.3.0/libcpp/expr.c
../../../gcc-6.3.0/libcpp/expr.c: In function 'unsigned int cpp_classify_number(cpp_reader*, const cpp_token*, const char**, source_location)':
../../../gcc-6.3.0/libcpp/expr.c:686:18: error: format not a string literal and no format arguments [-Werror=format-security]
        0, message);
../../../gcc-6.3.0/libcpp/expr.c:689:39: error: format not a string literal and no format arguments [-Werror=format-security]
           virtual_location, 0, message);
cc1plus: some warnings being treated as errors
make[1]: *** [Makefile:224: expr.o] Error 1
make[1]: Leaving directory '<my-build-path>/coreboot/util/crossgcc/build-i386-elf-GCC/build-x86_64-pc-linux-gnu/libcpp'
make: *** [Makefile:2730: all-build-libcpp] Error 2
sh ../gcc-6.3.0/mkinstalldirs <my-build-path>/coreboot/util/crossgcc/xgcc <my-build-path>/coreboot/util/crossgcc/xgcc
sh: line 3: cd: i386-elf/libgcc: No such file or directory
make: *** [Makefile:10462: install-target-libgcc] Error 1

Where -Werror=format-security seems to be the reason for the failure (although I don't see this exact option in the command). Yet in <nixpkgs>/pkgs/development/compilers/gcc/6/default.nix I find this:

hardeningDisable = [ "format" ];

And guess that the failure may be due to the security hardening measures of NixOS, some of which have to be disabled to get GCC compiled (let's assume GCC dev's know what they're doing in those functions). Tested it with GCC 6.2 and 5.4 -- same thing.

So the question is how do I disable the hardening options (in particular format) for a nix-shell environment? Or where else those "warnings being treated as errors" come from?

Description(s) of the option(s):

According to this answer

nix-shell has nothing to do with the Nix expressions... but when I call make with the NIX_DEBUG flag,

env NIX_DEBUG=' ' make crossgcc-i386

I get the output from <nixpkgs>/pkgs/build-support/cc-wrapper/add-hardening.sh, e.g. HARDENING: enabling format; from what I infer that those "format security" options are actually applied when I call make in the nix-shell.

Perhaps I simply need to bump something via nixos-option, but which exactly option? I can't just grep it... (there's no analogue of dconf dump / or gsettings list-recursively)

  • @drewbenn The warnings disappear, the compiler apparently works well, except maybe incorrectly working debug output; didn't test. The behavior should (almost) stay the same: it's just a va_list after all, as in printf, for example, but, because of some GCC's own format options (%<, %>), the argument isn't allowed to be a constant string.
    – Andrew
    May 29, 2017 at 4:58
  • Please post the solution as a self-answer instead of editing the question.
    – Zimm i48
    May 29, 2017 at 11:47
  • @drewbenn Fixing GCC seems to be a little bit more complicated than just inserting "%s" (see the Bugzilla thread). But NixOS provides a clean way to disable the Werrors for specific packages. -- The only problem here is that it apparently isn't possible to change the behavior of the compiler wrapper right in the nix-shell, i.e. without -A flag.
    – Andrew
    May 30, 2017 at 0:14
  • 1
    @Zimmi48 Done. Now it should better fit the SE paradigm, although the answer is just a workaround.
    – Andrew
    May 30, 2017 at 0:49

1 Answer 1


The format-security warnings have to be disabled, or at least not -Werror'd, because of this:

The hardening options are imposed by the compiler wrapper, that's why they are not shown in the log.

And hardeningDisable is apparently the only method to affect the wrapper.

One possible solution is to create a dummy Nix expression to be used with nix-shell -A. For example:
copy ~/.nix-defexpr/channels_root/nixos/ into a separate place (<nixpkgs'>) and make it writeable,
add <nixpkgs'>/pkgs/tools/misc/coreboot/default.nix containing

{ stdenv, gcc6, flex, bison, ncurses, iasl, doxygen, zlib, isl, python }:

stdenv.mkDerivation {
  name = "coreboot";

  buildInputs = [ gcc6 flex bison ncurses iasl doxygen zlib isl python ];

  hardeningDisable = [ "format" ];  # to build the cross-compiler

and register it in <nixpkgs'>/top-level/all-packages.nix as usual,
and, finally, call nix-shell <nixpkgs'> -A coreboot to create the environment needed.

Still I think it should be easier (workable for nix-shell -p).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.