diff --git a/cf-agent/Makefile.am b/cf-agent/Makefile.am
index afc788b761..8e1a9815fa 100644
--- a/cf-agent/Makefile.am
+++ b/cf-agent/Makefile.am
@@ -27,7 +27,6 @@ AM_CPPFLAGS = -I$(srcdir)/../libpromises -I$(srcdir)/../libntech/libutils \
 	-I$(srcdir)/../libcfecompat \
 	-I$(srcdir)/../libcfnet \
 	-I$(srcdir)/../cf-check \
-	@CPPFLAGS@ \
 	$(ENTERPRISE_CPPFLAGS) \
 	$(OPENSSL_CPPFLAGS) \
 	$(PCRE2_CPPFLAGS) \
@@ -38,7 +37,8 @@ AM_CPPFLAGS = -I$(srcdir)/../libpromises -I$(srcdir)/../libntech/libutils \
 	$(PAM_CPPFLAGS)
 
 AM_CFLAGS = \
-	@CFLAGS@ \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(ENTERPRISE_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(PCRE2_CFLAGS) \
diff --git a/cf-check/Makefile.am b/cf-check/Makefile.am
index c70b3f51a5..a9ea534dd0 100644
--- a/cf-check/Makefile.am
+++ b/cf-check/Makefile.am
@@ -26,14 +26,14 @@ noinst_LTLIBRARIES = libcf-check.la
 AM_CPPFLAGS = -I$(srcdir)/../libntech/libutils \
 	-I$(srcdir)/../libntech/libcompat \
 	-I$(srcdir)/../libcfecompat \
-	@CPPFLAGS@ \
 	$(PCRE2_CPPFLAGS) \
 	$(LIBYAML_CPPFLAGS) \
 	$(LMDB_CPPFLAGS) \
 	$(OPENSSL_CPPFLAGS)
 
 AM_CFLAGS = \
-	@CFLAGS@ \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(LMDB_CFLAGS) \
 	$(PCRE2_CFLAGS) \
 	$(LIBYAML_CFLAGS) \
diff --git a/cf-execd/Makefile.am b/cf-execd/Makefile.am
index 190dde9ffc..f0c8dbf86e 100644
--- a/cf-execd/Makefile.am
+++ b/cf-execd/Makefile.am
@@ -35,6 +35,8 @@ AM_CPPFLAGS = \
 	$(ENTERPRISE_CPPFLAGS)
 
 AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(PCRE2_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(PTHREAD_CFLAGS) \
diff --git a/cf-key/Makefile.am b/cf-key/Makefile.am
index 568429854d..8681b77014 100644
--- a/cf-key/Makefile.am
+++ b/cf-key/Makefile.am
@@ -33,6 +33,8 @@ AM_CPPFLAGS = \
 	$(ENTERPRISE_CPPFLAGS)
 
 AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(PCRE2_CFLAGS) \
 	$(ENTERPRISE_CFLAGS)
diff --git a/cf-monitord/Makefile.am b/cf-monitord/Makefile.am
index 9e332ab433..9f1bdaf5df 100644
--- a/cf-monitord/Makefile.am
+++ b/cf-monitord/Makefile.am
@@ -33,7 +33,9 @@ AM_CPPFLAGS = \
 	$(OPENSSL_CPPFLAGS) \
 	$(ENTERPRISE_CPPFLAGS)
 
-AM_CFLAGS = @CFLAGS@ \
+AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(ENTERPRISE_CFLAGS)
 
diff --git a/cf-net/Makefile.am b/cf-net/Makefile.am
index acaad3f8c5..19aa0abbf9 100644
--- a/cf-net/Makefile.am
+++ b/cf-net/Makefile.am
@@ -30,7 +30,9 @@ AM_CPPFLAGS = -I$(srcdir)/../libpromises -I$(srcdir)/../libntech/libutils \
 	$(PCRE2_CPPFLAGS) \
 	$(ENTERPRISE_CPPFLAGS)
 
-AM_CFLAGS = @CFLAGS@ \
+AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(ENTERPRISE_CFLAGS)
 
diff --git a/cf-promises/Makefile.am b/cf-promises/Makefile.am
index 998057ce39..d78b006550 100644
--- a/cf-promises/Makefile.am
+++ b/cf-promises/Makefile.am
@@ -28,12 +28,13 @@ AM_CPPFLAGS = \
 	-I$(srcdir)/../libpromises \
 	-I$(srcdir)/../libcfecompat \
 	-I$(srcdir)/../libcfnet \
-	@CPPFLAGS@ \
 	$(OPENSSL_CPPFLAGS) \
 	$(PCRE2_CPPFLAGS) \
 	$(ENTERPRISE_CPPFLAGS)
 
-AM_CFLAGS = @CFLAGS@ \
+AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(ENTERPRISE_CFLAGS)
 
diff --git a/cf-runagent/Makefile.am b/cf-runagent/Makefile.am
index 4daf9d489b..cfa302072c 100644
--- a/cf-runagent/Makefile.am
+++ b/cf-runagent/Makefile.am
@@ -30,7 +30,9 @@ AM_CPPFLAGS = -I$(srcdir)/../libpromises -I$(srcdir)/../libntech/libutils \
 	$(PCRE2_CPPFLAGS) \
 	$(ENTERPRISE_CPPFLAGS)
 
-AM_CFLAGS = @CFLAGS@ \
+AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(ENTERPRISE_CFLAGS)
 
diff --git a/cf-secret/Makefile.am b/cf-secret/Makefile.am
index ca35702f4a..76c583bcb8 100644
--- a/cf-secret/Makefile.am
+++ b/cf-secret/Makefile.am
@@ -30,7 +30,9 @@ AM_CPPFLAGS = -I$(srcdir)/../libpromises -I$(srcdir)/../libntech/libutils \
 	$(PCRE2_CPPFLAGS) \
 	$(ENTERPRISE_CPPFLAGS)
 
-AM_CFLAGS = @CFLAGS@ \
+AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(ENTERPRISE_CFLAGS)
 
diff --git a/cf-serverd/Makefile.am b/cf-serverd/Makefile.am
index 327151fdf4..f40d66c561 100644
--- a/cf-serverd/Makefile.am
+++ b/cf-serverd/Makefile.am
@@ -32,6 +32,8 @@ AM_CPPFLAGS = -I$(srcdir)/../libpromises -I$(srcdir)/../libntech/libutils \
 	$(ENTERPRISE_CPPFLAGS)
 
 AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(PTHREAD_CFLAGS) \
 	$(ENTERPRISE_CFLAGS)
diff --git a/cf-serverd/strlist.c b/cf-serverd/strlist.c
index 72f72b86b5..a35d950a00 100644
--- a/cf-serverd/strlist.c
+++ b/cf-serverd/strlist.c
@@ -401,7 +401,7 @@ size_t StrList_bsearch(const StrList *sl,
 {
     if (sl != NULL && sl->len > 0)
     {
-        struct string **ret =
+        struct string *const*ret =
             bsearch(&s, sl->list, sl->len, sizeof(sl->list[0]),
                     (int (*)(const void *, const void *)) comparator);
         struct string * const *base = &sl->list[0];
@@ -625,7 +625,7 @@ size_t StrList_SearchLongestPrefix(const StrList *sl,
      * no reason to keep going. */
     while (longer_match_possible && (s_prefix_len < s_len))
     {
-        char *separator_at;
+        const char *separator_at;
         if (direction_forward)
         {
             /* Find next separator, skipping the previous one. */
diff --git a/cf-testd/Makefile.am b/cf-testd/Makefile.am
index ddd24fdf29..9bd7ebe64b 100644
--- a/cf-testd/Makefile.am
+++ b/cf-testd/Makefile.am
@@ -33,6 +33,8 @@ AM_CPPFLAGS = -I$(srcdir)/../libpromises -I$(srcdir)/../libntech/libutils \
 	$(ENTERPRISE_CPPFLAGS)
 
 AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
 	$(OPENSSL_CFLAGS) \
 	$(ENTERPRISE_CFLAGS)
 
diff --git a/cf-testd/cf-testd.c b/cf-testd/cf-testd.c
index f089ce118a..b4364b8f80 100644
--- a/cf-testd/cf-testd.c
+++ b/cf-testd/cf-testd.c
@@ -738,7 +738,7 @@ static char *IncrementIPaddress(const char *ip_str)
     }
 
     int step = 1;
-    char *last_dot = strrchr(ip_str, '.');
+    const char *last_dot = strrchr(ip_str, '.');
     assert(last_dot != NULL);   /* the doc comment says there must be dots! */
     if (StringEqual(last_dot + 1, "255"))
     {
diff --git a/cf-upgrade/Makefile.am b/cf-upgrade/Makefile.am
index cbbf2b2b4e..866b07b635 100644
--- a/cf-upgrade/Makefile.am
+++ b/cf-upgrade/Makefile.am
@@ -27,6 +27,8 @@ LIBS=                                # This tool should not link to anything
 AM_LDFLAGS=
 AM_CPPFLAGS=-I$(top_srcdir)/libntech/libutils # platform.h
 
+AM_CFLAGS = $(CF3_CFLAGS) $(DEBUG_CFLAGS)
+
 LDADD=../libntech/libcompat/libcompat.la
 
 cf_upgrade_SOURCES = \
diff --git a/configure.ac b/configure.ac
index 6202c22835..66bf5beaed 100644
--- a/configure.ac
+++ b/configure.ac
@@ -110,10 +110,11 @@ m4_define(incstart,sinc)
 m4_define(incend,lude)
 
 dnl
-dnl Save environment CFLAGS before autoconf starts messing with it.
-dnl It is restored later.
+dnl Prevent AC_PROG_CC from defaulting to "-g -O2".
+dnl CFLAGS is left for the user; project flags go into CF3_CFLAGS via cf3_gcc_flags.m4.
 dnl
-ENV_CFLAGS="$CFLAGS"
+: ${CFLAGS=""}
+: ${CPPFLAGS=""}
 
 dnl ######################################################################
 dnl Checks for programs.
@@ -286,20 +287,16 @@ AC_ARG_ENABLE(debug,
               [debug=no])
 AM_CONDITIONAL([NDEBUG], [test x"$debug" = x"no"])
 
-dnl Even though CFLAGS should contain the command-line CFLAGS
-dnl as last, some macro seem to messes the order up and insert
-dnl its own optimisation flags as well. So we append ENV_CFLAGS
-dnl at the end manually, causing a bit of flag duplication.
-
 AC_MSG_CHECKING([for debug option])
 if test x"$debug" = x"yes"
 then
     AC_MSG_RESULT(yes)
-    CFLAGS="$CFLAGS -g3 -O0 $ENV_CFLAGS"
+    DEBUG_CFLAGS="-g3 -O0"
 else
     AC_MSG_RESULT(no)
-    CFLAGS="$CFLAGS -O2 -DNDEBUG $ENV_CFLAGS"
+    DEBUG_CFLAGS="-O2 -DNDEBUG"
 fi
+AC_SUBST([DEBUG_CFLAGS])
 
 dnl ######################################################################
 dnl Checks for libraries.
@@ -1397,8 +1394,8 @@ dnl ######################################################################
 dnl Collect all the options
 dnl ######################################################################
 
-CORE_CPPFLAGS="$LMDB_CPPFLAGS $TOKYOCABINET_CPPFLAGS $QDBM_CPPFLAGS $PCRE2_CPPFLAGS $OPENSSL_CPPFLAGS $SQLITE3_CPPFLAGS $LIBACL_CPPFLAGS $LIBCURL_CPPFLAGS $LIBRSYNC_CPPFLAGS $LIBYAML_CPPFLAGS $POSTGRESQL_CPPFLAGS $MYSQL_CPPFLAGS $LIBXML2_CPPFLAGS $CPPFLAGS $CFECOMPAT_CPPFLAGS"
-CORE_CFLAGS="$LMDB_CFLAGS $TOKYOCABINET_CFLAGS $QDBM_CFLAGS $PCRE2_CFLAGS $OPENSSL_CFLAGS $SQLITE3_CFLAGS $LIBACL_CFLAGS $LIBCURL_CFLAGS $LIBRSYNC_CFLAGS $LIBYAML_CFLAGS $POSTGRESQL_CFLAGS $MYSQL_CFLAGS $LIBXML2_CFLAGS $CFLAGS"
+CORE_CPPFLAGS="$LMDB_CPPFLAGS $TOKYOCABINET_CPPFLAGS $QDBM_CPPFLAGS $PCRE2_CPPFLAGS $OPENSSL_CPPFLAGS $SQLITE3_CPPFLAGS $LIBACL_CPPFLAGS $LIBCURL_CPPFLAGS $LIBRSYNC_CPPFLAGS $LIBYAML_CPPFLAGS $POSTGRESQL_CPPFLAGS $MYSQL_CPPFLAGS $LIBXML2_CPPFLAGS $CFECOMPAT_CPPFLAGS $CPPFLAGS"
+CORE_CFLAGS="$LMDB_CFLAGS $TOKYOCABINET_CFLAGS $QDBM_CFLAGS $PCRE2_CFLAGS $OPENSSL_CFLAGS $SQLITE3_CFLAGS $LIBACL_CFLAGS $LIBCURL_CFLAGS $LIBRSYNC_CFLAGS $LIBYAML_CFLAGS $POSTGRESQL_CFLAGS $MYSQL_CFLAGS $LIBXML2_CFLAGS $CF3_CFLAGS $DEBUG_CFLAGS"
 CORE_LDFLAGS="$LMDB_LDFLAGS $TOKYOCABINET_LDFLAGS $QDBM_LDFLAGS $PCRE2_LDFLAGS $OPENSSL_LDFLAGS $SQLITE3_LDFLAGS $LIBACL_LDFLAGS $LIBCURL_LDFLAGS $LIBRSYNC_LDFLAGS $LIBYAML_LDFLAGS $POSTGRESQL_LDFLAGS $MYSQL_LDFLAGS $LIBXML2_LDFLAGS $LDFLAGS"
 CORE_LIBS="$LMDB_LIBS $TOKYOCABINET_LIBS $QDBM_LIBS $PCRE2_LIBS $OPENSSL_LIBS $SQLITE3_LIBS $LIBACL_LIBS $LIBCURL_LIBS $LIBRSYNC_LIBS $LIBYAML_LIBS $POSTGRESQL_LIBS $MYSQL_LIBS $LIBXML2_LIBS $LIBS"
 
@@ -1825,11 +1822,12 @@ if test "x$use_coverage" = "xyes"; then
 
   dnl Remove all optimization flags from CFLAGS
   changequote({,})
-  CFLAGS=`echo "$CFLAGS" | $SED -e 's/-O[0-9]*//g'`
+  CF3_CFLAGS=`echo "$CF3_CFLAGS" | $SED -e 's/-O[0-9]*//g'`
+  DEBUG_CFLAGS=""
   changequote([,])
 
   dnl Add the special gcc flags
-  CFLAGS="$CFLAGS -fprofile-arcs -ftest-coverage"
+  CF3_CFLAGS="$CF3_CFLAGS -fprofile-arcs -ftest-coverage"
   LDFLAGS="$LDFLAGS -lgcov"
   # Need to set ENABLE_COVERAGE so that tests/unit/Makefile.am can adapt for one
   # test which needs gcov stubs if core not built with coverage.
diff --git a/ext/Makefile.am b/ext/Makefile.am
index 0fba6d3611..04b0b52f75 100644
--- a/ext/Makefile.am
+++ b/ext/Makefile.am
@@ -23,4 +23,6 @@
 #
 bin_PROGRAMS = rpmvercmp
 
+AM_CFLAGS = $(CF3_CFLAGS) $(DEBUG_CFLAGS)
+
 LDADD = ../libntech/libcompat/libcompat.la
diff --git a/libcfecompat/Makefile.am b/libcfecompat/Makefile.am
index d078f845cc..eeb7545a4c 100644
--- a/libcfecompat/Makefile.am
+++ b/libcfecompat/Makefile.am
@@ -26,6 +26,8 @@ noinst_LTLIBRARIES = libcfecompat.la
 
 AM_CPPFLAGS = -I$(top_srcdir)/libntech/libutils            # platform.h
 
+AM_CFLAGS = $(CF3_CFLAGS) $(DEBUG_CFLAGS)
+
 libcfecompat_la_LIBADD = $(LTLIBOBJS)
 
 libcfecompat_la_SOURCES = \
diff --git a/libcfnet/Makefile.am b/libcfnet/Makefile.am
index 38b5b566fa..39d78dada0 100644
--- a/libcfnet/Makefile.am
+++ b/libcfnet/Makefile.am
@@ -30,6 +30,8 @@ AM_CPPFLAGS = -I$(top_srcdir)/libntech/libutils \
 	$(LIBRSYNC_CPPFLAGS) \
 	$(OPENSSL_CPPFLAGS)
 
+AM_CFLAGS = $(CF3_CFLAGS) $(DEBUG_CFLAGS)
+
 libcfnet_la_SOURCES = \
 	addr_lib.c addr_lib.h \
 	client_protocol.c client_protocol.h cfnet.h\
diff --git a/libenv/Makefile.am b/libenv/Makefile.am
index 2c66662361..1f4124e148 100644
--- a/libenv/Makefile.am
+++ b/libenv/Makefile.am
@@ -46,6 +46,8 @@ AM_CPPFLAGS += $(PCRE2_CPPFLAGS)
 AM_CPPFLAGS += -I$(top_srcdir)/libcfnet
 AM_CPPFLAGS += -I$(top_srcdir)/libpromises
 
+AM_CFLAGS = $(CF3_CFLAGS) $(DEBUG_CFLAGS)
+
 CLEANFILES = *.gcno *.gcda
 
 #
diff --git a/libenv/sysinfo.c b/libenv/sysinfo.c
index 16f44c70e2..55e9fd8a33 100644
--- a/libenv/sysinfo.c
+++ b/libenv/sysinfo.c
@@ -325,7 +325,7 @@ void CalculateDomainName(const char *nodename, const char *dnsname,
     {
         /* If hostname is qualified */
 
-        char *p = strchr(nodename, '.');
+        const char *p = strchr(nodename, '.');
 
         if (p != NULL)
         {
diff --git a/libpromises/class.c b/libpromises/class.c
index 01bf7af510..dcd4f5c6bd 100644
--- a/libpromises/class.c
+++ b/libpromises/class.c
@@ -294,7 +294,7 @@ void ClassTableIteratorDestroy(ClassTableIterator *iter)
 
 ClassRef ClassRefParse(const char *expr)
 {
-    char *name_start = strchr(expr, ':');
+    const char *name_start = strchr(expr, ':');
     if (!name_start)
     {
         return (ClassRef) { .ns = NULL, .name = xstrdup(expr) };
diff --git a/libpromises/eval_context.c b/libpromises/eval_context.c
index 1c82b1dcb2..4d25864eaf 100644
--- a/libpromises/eval_context.c
+++ b/libpromises/eval_context.c
@@ -1911,7 +1911,7 @@ bool EvalContextClassPutSoftTagsSetWithComment(EvalContext *ctx, const char *nam
 {
     bool ret;
     char *ns = NULL;
-    char *delim = strchr(name, ':');
+    const char *delim = strchr(name, ':');
 
     if (delim)
     {
diff --git a/libpromises/generic_agent.c b/libpromises/generic_agent.c
index eadb188d2c..3e282c946e 100644
--- a/libpromises/generic_agent.c
+++ b/libpromises/generic_agent.c
@@ -344,7 +344,7 @@ static inline bool CanSetVariable(const EvalContext *ctx, VarRef *var_ref)
 static inline bool CanSetClass(const EvalContext *ctx, const char *class_spec)
 {
     char *ns = NULL;
-    char *ns_delim = strchr(class_spec, ':');
+    const char *ns_delim = strchr(class_spec, ':');
     if (ns_delim != NULL)
     {
         ns = xstrndup(class_spec, ns_delim - class_spec);
diff --git a/libpromises/keyring.c b/libpromises/keyring.c
index 9c5b2cb191..72136e933d 100644
--- a/libpromises/keyring.c
+++ b/libpromises/keyring.c
@@ -79,7 +79,7 @@ int RemovePublicKey(const char *id)
 
     while ((dirp = DirRead(dirh)) != NULL)
     {
-        char *c = strstr(dirp->d_name, suffix);
+        const char *c = strstr(dirp->d_name, suffix);
 
         if (c && c[strlen(suffix)] == '\0')     /* dirp->d_name ends with suffix */
         {
diff --git a/libpromises/policy.c b/libpromises/policy.c
index d539dd4532..0b9fc3ae49 100644
--- a/libpromises/policy.c
+++ b/libpromises/policy.c
@@ -311,7 +311,7 @@ const char *PolicyGetPolicyFileHash(const Policy *policy, const char *policy_fil
 
 static const char *StripNamespace(const char *full_symbol)
 {
-    char *sep = strchr(full_symbol, CF_NS);
+    const char *sep = strchr(full_symbol, CF_NS);
 
     if (sep == NULL)
     {
@@ -871,7 +871,7 @@ char *QualifiedNameNamespaceComponent(const char *qualified_name)
  */
 char *QualifiedNameScopeComponent(const char *qualified_name)
 {
-    char *sep = strchr(qualified_name, CF_NS);
+    const char *sep = strchr(qualified_name, CF_NS);
     if (sep)
     {
         return xstrdup(sep + 1);
diff --git a/libpromises/promises.c b/libpromises/promises.c
index 93e3bc7739..1c2d46891e 100644
--- a/libpromises/promises.c
+++ b/libpromises/promises.c
@@ -639,7 +639,7 @@ static void DereferenceAndPutComment(Promise* pp, const char *comment)
 {
     free(pp->comment);
 
-    char *sp;
+    const char *sp;
     if ((sp = strstr(comment, "$(this.promiser)")) != NULL ||
         (sp = strstr(comment, "${this.promiser}")) != NULL)
     {
diff --git a/libpromises/verify_vars.c b/libpromises/verify_vars.c
index 234aa06107..17a3164df1 100644
--- a/libpromises/verify_vars.c
+++ b/libpromises/verify_vars.c
@@ -73,8 +73,8 @@ static bool IsLegalVariableName(EvalContext *ctx, const Promise *pp)
         return false;
     }
 
-    char *bracket = strchr(var_name, '[');
-    char *dot = strchr(var_name, '.');
+    const char *bracket = strchr(var_name, '[');
+    const char *dot = strchr(var_name, '.');
     /* we only care about variable name prefix, not dots inside array keys */
     if ((dot != NULL) && ((bracket == NULL) || (dot < bracket)))
     {
diff --git a/m4/cf3_gcc_flags.m4 b/m4/cf3_gcc_flags.m4
index 7bfc06b80a..6eb9b75006 100644
--- a/m4/cf3_gcc_flags.m4
+++ b/m4/cf3_gcc_flags.m4
@@ -22,7 +22,9 @@
 # included file COSL.txt.
 #
 dnl ####################################################################
-dnl Set GCC CFLAGS only if using GCC.
+dnl Set GCC flags only if using GCC.
+dnl Flags are collected into CF3_CFLAGS for use in AM_CFLAGS.
+dnl CFLAGS is left untouched for the user.
 dnl ####################################################################
 
 AC_PREPROC_IFELSE([AC_LANG_SOURCE([[
@@ -31,8 +33,7 @@ AC_PREPROC_IFELSE([AC_LANG_SOURCE([[
 #endif
 ]])], [
 HP_UX_AC="no"], [
-CFLAGS="$CFLAGS -Agcc"
-CPPFLAGS="$CPPFLAGS -Agcc"
+CF3_CFLAGS="$CF3_CFLAGS -Agcc"
 HP_UX_AC="yes"])
 
 AC_MSG_CHECKING(for HP-UX aC)
@@ -44,48 +45,43 @@ fi
 
 AC_MSG_CHECKING(for GCC specific compile flags)
 if test x"$GCC" = "xyes" && test x"$HP_UX_AC" != x"yes"; then
-    CFLAGS="$CFLAGS -g -Wall"
-    CPPFLAGS="$CPPFLAGS -std=gnu99"
+    CF3_CFLAGS="$CF3_CFLAGS -std=gnu99 -g -Wall"
     AC_MSG_RESULT(yes)
 
-    save_CFLAGS="$CFLAGS"
-    CFLAGS="$CFLAGS -Wno-pointer-sign"
     AC_MSG_CHECKING(for -Wno-pointer-sign)
     AC_COMPILE_IFELSE([AC_LANG_SOURCE([int main() {}])],
-     [AC_MSG_RESULT(yes)],
-     [AC_MSG_RESULT(no)
-     CFLAGS="$save_CFLAGS"])
+     [AC_MSG_RESULT(yes)
+     CF3_CFLAGS="$CF3_CFLAGS -Wno-pointer-sign"],
+     [AC_MSG_RESULT(no)])
 
-    save_CFLAGS="$CFLAGS"
-    CFLAGS="$CFLAGS -Werror=implicit-function-declaration"
     AC_MSG_CHECKING(for -Werror=implicit-function-declaration)
     AC_COMPILE_IFELSE([AC_LANG_SOURCE([int main() {}])],
-     [AC_MSG_RESULT(yes)],
-     [AC_MSG_RESULT(no)
-     CFLAGS="$save_CFLAGS"])
+     [AC_MSG_RESULT(yes)
+     CF3_CFLAGS="$CF3_CFLAGS -Werror=implicit-function-declaration"],
+     [AC_MSG_RESULT(no)])
 
-    save_CFLAGS="$CFLAGS"
-    CFLAGS="$CFLAGS -Wunused-parameter"
     AC_MSG_CHECKING(for -Wunused-parameter)
     AC_COMPILE_IFELSE([AC_LANG_SOURCE([int main() {}])],
-     [AC_MSG_RESULT(yes)],
-     [AC_MSG_RESULT(no)
-     CFLAGS="$save_CFLAGS"])
+     [AC_MSG_RESULT(yes)
+     CF3_CFLAGS="$CF3_CFLAGS -Wunused-parameter"],
+     [AC_MSG_RESULT(no)])
+
+    AC_MSG_CHECKING(for -Wno-incompatible-pointer-types)
+    AC_COMPILE_IFELSE([AC_LANG_SOURCE([int main() {}])],
+     [AC_MSG_RESULT(yes)
+     CF3_CFLAGS="$CF3_CFLAGS -Wno-incompatible-pointer-types"],
+     [AC_MSG_RESULT(no)])
 
-    dnl Clang does not like 'const const' construct arising from
-    dnl expansion of TYPED_SET_DECLARE macro
-    dnl
-    dnl This check is relying on explicit compilator detection due to
-    dnl GCC irregularities checking for -Wno-* command-line options
-    dnl (command line is not fully checked until actual warning occurs)
     AC_MSG_CHECKING(for -Wno-duplicate-decl-specifier)
     AC_COMPILE_IFELSE([AC_LANG_SOURCE([#ifndef __clang__
-# error Not a clang
+# GET_DIR_ERROR Not a clang
 #endif
 int main() {}])],
      [AC_MSG_RESULT(yes)
-     CFLAGS="$save_CFLAGS -Wno-duplicate-decl-specifier"],
+     CF3_CFLAGS="$CF3_CFLAGS -Wno-duplicate-decl-specifier"],
      [AC_MSG_RESULT(no)])
-else 
+else
     AC_MSG_RESULT(no)
 fi
+
+AC_SUBST([CF3_CFLAGS])
diff --git a/tests/unit/Makefile.am b/tests/unit/Makefile.am
index 8fb3dfb6ea..7120db9560 100644
--- a/tests/unit/Makefile.am
+++ b/tests/unit/Makefile.am
@@ -48,7 +48,10 @@ LDADD = ../../libpromises/libpromises.la libtest.la
 LIBS = $(CORE_LIBS)
 AM_LDFLAGS = $(CORE_LDFLAGS)
 
-AM_CFLAGS = $(PTHREAD_CFLAGS)
+AM_CFLAGS = \
+	$(CF3_CFLAGS) \
+	$(DEBUG_CFLAGS) \
+	$(PTHREAD_CFLAGS)
 
 
 check_LTLIBRARIES = libtest.la