I'm building CPython on my own CI infrastructure for Forky (Debian 14, testing). Currently the output of dpkg-buildflags --get LDLAGS is broken, because:

• it contains a space and breaks further concatenations in the Dockerfile e.g. with ,--strip-all
• it emits a compiler flag appended to linker flags.

The output I see is:
LDFLAGS="-Wl,-z-relro -fcf-protection,--strip-all"

When debugging the output from dpkg-buildflags, I get
LDFLAGS="-Wl,-z-relro -fcf-protection"

Looking at the outputs of make, I noticed -fcf-protection close to other compiler flags, which is correct. Thus, -fcf-protection seems to be applied two times.

Workaround:
LDFLAGS="${LDFLAGS%% *}"

I'm not sure who is responsible for dpkg-buildflags and where to report it.
I just wanted to inform docker-library of a potential future problem for upcoming Forky - if not fixed until then.

I checked Forky and Trixie images from Docker Hub:

Documentation for -fcf-protection: https://gcc.gnu.org/onlinedocs/gcc-15.2.0/gcc/Instrumentation-Options.html#index-fcf-protection

This option is not a linker option.

/cc @skoehler