build: secp256k1 warnings not turned into errors in MSAN job #33284

master (7e58c94112d061af38648808aae87c369098f44c) https://cirrus-ci.com/task/6098524451897344:

[06:05:23.776] Treat compiler warnings as errors ..... ON
<snip>
[06:05:24.677] [ 10%] Building CXX object src/crypto/CMakeFiles/bitcoin_crypto.dir/sha256_avx2.cpp.o
[06:05:24.678] /ci_container_base/src/secp256k1/src/tests.c:6049:34: warning: variable 'pubkey' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer]
[06:05:24.678]  6049 |     SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
[06:05:24.678]       |                                  ^~~~~~
[06:05:24.678] 1 warning generated.
[06:05:24.679] /ci_container_base/src/secp256k1/src/tests.c:6049:34: warning: variable 'pubkey' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer]
[06:05:24.679]  6049 |     SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
[06:05:24.679]       |                                  ^~~~~~
[06:05:24.679] 1 warning generated.

I will take a look at this

The reason is that Werror is not passed down, so I guess the question is: What flags should be passed down under what circumstances?

My expectation would be that the CI shouldn't produce any spurious output, and any unexpected output would be an error. That way, any output is either fixed, or documented/suppressed. Otherwise anyone looking at the CI can't know what is expected, what should be fixed, or what doesn't matter, and we avoid issues like this, #33256, etc.

from CmakeLists.txt: The core_interface library aims to encapsulate common build flags. It is a usage requirement for all targets except for secp256k1, which gets its flags by other means.

We can simply add a section for WERROR to the cmake file just like for other flags like BUILD_TESTS, to inherit the WERROR setting.

I actually cannot reproduce the exact warning of this macro, not on clang or g++. But adding an explicitly undefined variable produces a warning and is properly turned into an error with -DWERROR=ON after adding the inheritance.

Related: https://github.com/bitcoin-core/secp256k1/pull/1750.

Related: bitcoin-core/secp256k1#1750.

It might be worth updating the secp256k1 subtree to get rid of these warnings.