Created attachment 50758 [details]
Workaround for -Wno-format flag injected during build process.

Comment on attachment 50757 [details]
Patch to fix -Werror=format-security errors

I doubt you have properly tested it, because it is clearly buggy.

          const char *message = (result & CPP_N_UNSIGNED) == CPP_N_UNSIGNED
                                ? N_("use of C++23 %<size_t%> integer constant")
                                : N_("use of C++23 %<make_signed_t<size_t>%> integer constant");
          cpp_warning_with_line (pfile, CPP_W_SIZE_T_LITERALS,
                                 virtual_location, 0, message);
Changing this to "%s", message obviously breaks it, it will not print
use of C++23 'size_t' integer constant (or with UTF-8 quotes etc. and with colors etc.), but
use of C++23 %<size_t%> integer constant

I had tested with a simple printf: 

#include <stdio.h>

#ifndef N_
# define N_(msgid) msgid
#endif

int
main(int argc, char* argv[]) {
  printf(N_("use of C++23 %<size_t%> integer constant"));
  printf(N_("use of C++23 %<make_signed_t<size_t>%> integer constant"));

  return 0;
}

which prints the same thing with or without the "%s" format string. 

I've been trying to trace where pfile->cb.diagnostic is set to see how the output is actually processed, but I haven't found it yet. 

Thanks for the feedback!

%< and %> are GCC diagnostics format specifiers, not printf.
They are more similar to e.g. GNU printf %m , something that doesn't take any va_arg, but is interpreted.
Try
printf ("%m\n");
vs.
printf ("%s", "%m\n");
to see the difference.
Anyway, for this case either using the conditional directly in the cpp_warning_with_line argument instead of in initializer of a temporary, or two cpp_warning_with_line calls each with a separate string would do.
Anyway, I strongly doubt your patch covers everything, I can see e.g.
gcc/c/c-convert.c:81:31: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/c/c-typeck.c:3681:28: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/c/c-typeck.c:4433:42: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/c/c-typeck.c:6587:43: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/c/c-typeck.c:11679:42: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/c-family/c-common.c:6358:30: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/c-family/c-common.c:6362:33: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/fold-const.c:303:42: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/ipa-devirt.c:951:47: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/analyzer/program-state.cc:1153:20: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/diagnostic.c:1887:52: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/cp/cvt.c:725:26: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/cp/error.c:799:20: warning: spurious leading punctuation sequence ‘<’ in format [-Wformat-diag]
gcc/cp/error.c:799:20: warning: spurious trailing punctuation sequence ‘>’ in format [-Wformat-diag]
gcc/cp/error.c:799:20: warning: spurious leading punctuation sequence ‘<’ in format [-Wformat-diag]
gcc/cp/error.c:799:20: warning: spurious trailing punctuation sequence ‘>’ in format [-Wformat-diag]
gcc/cp/decl.c:3485:22: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/cp/typeck.c:4721:24: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/cp/typeck.c:6630:24: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/cp/pt.c:19640:20: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/collect2.c:2422:37: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/collect-utils.c:200:37: warning: format not a string literal and no format arguments [-Wformat-security]
gcc/lto-wrapper.c:1606:31: warning: format not a string literal and no format arguments [-Wformat-security]
and you've only touched the gcc/diagnostic.c case from that.

I just started looking at these other cases (for some reason I didn't see them in my initial compilation), but I am not sure what format specifiers should be used. Are the format specifiers used by __gcc_tdiag__ documented somewhere? I tried grepping through the source, but couldn't find anything.