switch to bookworm since bullseye support ends in August; omit -fhardened again

git-svn-id: svn://tug.org/texlive/trunk/Build/source@78933 c570f23f-e606-0410-a88d-b1316a301751

Author: kberry

.github/ChangeLog

@@ -1,5 +1,11 @@
 2026-05-07  Karl Berry  <karl@freefriends.org>
 
+	* workflows/main.yml (debian): update from bullseye(11) to
+	bookworm (12), since bullseye support ends August 2026.
+	* scripts/build-tl.sh (CFLAGS): omit -fhardened for now;
+	requires gcc15. Warns on FreeBSD, where it is recognized but
+	unsupported.
+
 	* scripts/build-tl.sh (CFLAGS): add -fhardened. Try doing so
 	unconditionally, though it only has effect on GNU/Linux targets.
 	tlsecurity 29 Apr 2026 03:20:12 et al.

.github/scripts/build-tl.sh

@@ -144,14 +144,16 @@ export TL_MAKE_FLAGS
 export CXXFLAGS="$CXXFLAGS -std=c++17"
 
 # Make binaries harder to exploit. This option is only supported on
-# GNU/Linux, but harmless on other targets.
-export CFLAGS="$CFLAGS -fhardened"
-
-# It's up to us to enable optimization, since we are overriding what
-# Autoconf does. Due to the above two assignments, we always set CFLAGS
-# and CXXFLAGS, so can just add to them now.
-CFLAGS="$CFLAGS -O2"
-CXXFLAGS="$CXXFLAGS -O2"
+# GNU/Linux, and only as of GCC 15; although it's only a warning if not
+# supported, it's too annoying to see the warning on every compilation.
+#if echo "$arch" | grep linux >/dev/null; then
+#  export CFLAGS="$CFLAGS -fhardened"
+#fi
+
+# It's up to us to enable optimization if we are overriding the
+# compilation flags.
+test -z "$CFLAGS" || CFLAGS="$CFLAGS -O2"
+test -z "$CXXFLAGS" || CXXFLAGS="$CXXFLAGS -O2"
 
 echo "$0: variables set:"
 echo "  BUILDARGS=$BUILDARGS"

.github/workflows/main.yml

@@ -53,7 +53,7 @@ jobs:
           - ${{ startsWith(github.ref, 'refs/tags/') }}
         include:
           - tl_name: i386-linux
-            image: i386/debian:bullseye
+            image: i386/debian:bookworm
             platform: 386
             ci_build: true
             use_qemu: false
@@ -71,14 +71,14 @@ jobs:
             use_qemu: false
             buildsys: alpine
           - tl_name: aarch64-linux
-            image: arm64v8/debian:bullseye
+            image: arm64v8/debian:bookworm
             platform: aarch64
             ci_build: true
             use_qemu: false
             buildsys: debian
             runner: ubuntu-24.04-arm
           - tl_name: armhf-linux
-            image: arm32v7/debian:bullseye
+            image: arm32v7/debian:bookworm
             platform: arm/v7
             ci_build: true
             use_qemu: false