Inspired by Timo Aaltonen's patch and SSSD's build aliases, I've added CFLAGS="-Wall -Wextra -Wno-unused-parameter -Wno-sign-compare -Wformat-security" to my build. There are 3 more warnings we might want to fix:

• ipa_kdb.c:186: missing initializer for field 'name' of 'const struct <anonymous>' [-Wmissing-field-* initializers]
• otp.c:64: missing initializer for field 'algo' of 'const struct <anonymous>' [-Wmissing-field-initializers]
• default_encoding_utf8.c:48: missing initializer for field 'ml_flags' of 'PyMethodDef' [-Wmissing-field-initializers]

All these are in sentinel values, for example:

static const struct {
    const char *algo;
    CK_MECHANISM_TYPE mech;
} algo2mech[] = {
   ...
   { "sha512", CKM_SHA512_HMAC },
   { } // <- warning here
};