1 file changed, 15 insertions, 13 deletions
diff --git a/source/cgit.mk b/source/cgit.mk
index 0683cb7..1106b64 100644
--- a/source/cgit.mk
+++ b/source/cgit.mk
@@ -9,10 +9,10 @@
 # ../../build.
 include Makefile
 
-# TOOLSDIR and BUILDDIR are named relative to the project root, matching the
-# top level Makefile, because the version recipe changes into the root before
-# using them. CGIT_SRC and CGIT_BUILD lead to the sources and the output from
-# vendor/git, where everything else here runs.
+# TOOLSDIR and BUILDDIR are named relative to the project root because the
+# version recipe changes into the root before using them. CGIT_SRC and
+# CGIT_BUILD lead to the sources and the output from vendor/git, where
+# everything else here runs.
 CGIT_ROOT  = ../..
 SRCDIR     = source
 TOOLSDIR   = tools
@@ -24,8 +24,7 @@ CGIT_BUILD = $(CGIT_ROOT)/$(BUILDDIR)
 # Makefile exports, which leaves out the build options this file reads.
 -include $(CGIT_ROOT)/cgit.conf
 
-# CGIT_VERSION and the other CGIT_ values used below come from the top level
-# Makefile, which exports them, rather than being defined in this file.
+# The CGIT_ values used below are exported by the top level Makefile.
 $(CGIT_BUILD)/VERSION: force-version
 	@mkdir -p $(CGIT_BUILD)/
 	@cd $(CGIT_ROOT) && '$(SHELL_PATH_SQ)' $(TOOLSDIR)/gen-version.sh "$(CGIT_VERSION)" $(BUILDDIR)/VERSION
@@ -42,15 +41,16 @@ $(CGIT_BUILD)/VERSION: force-version
 # standard again.
 CGIT_STD ?= gnu17
 
-# CGIT_CFLAGS is tracked separately so that changing it does not force a
-# rebuild of Git itself.
+# CGIT_CFLAGS is tracked separately so that changing it does not force a rebuild
+# of Git itself.
 CGIT_CFLAGS += -std=$(CGIT_STD)
 CGIT_CFLAGS += -DCGIT_CONFIG='"$(CGIT_CONFIG)"'
 CGIT_CFLAGS += -DCGIT_SCRIPT_NAME='"$(CGIT_SCRIPT_NAME)"'
 CGIT_CFLAGS += -DCGIT_CACHE_ROOT='"$(CACHE_ROOT)"'
 
-# Reaches only the cgit objects, so a caller can tighten the build, the way CI
-# passes -Werror, without holding git's own sources to the same standard.
+# Reaches only the cgit objects, so a caller can tighten the build, the way the
+# release build passes -Werror=format-security, without holding git's own
+# sources to the same standard.
 CGIT_CFLAGS += $(CGIT_EXTRA_CFLAGS)
 
 PKG_CONFIG ?= pkg-config
@@ -161,10 +161,12 @@ $(CGIT_BUILD)/CGIT-CFLAGS: FORCE
 	    if test x"$$FLAGS" != x"`cat $(CGIT_BUILD)/CGIT-CFLAGS 2>/dev/null`" ; then \
 		echo 1>&2 "    * new CGit build flags"; \
 		echo "$$FLAGS" >$(CGIT_BUILD)/CGIT-CFLAGS; \
-            fi
+	    fi
 
-$(CGIT_OBJS): $(CGIT_BUILD)/%.o: $(CGIT_SRC)/%.c GIT-CFLAGS $(CGIT_BUILD)/CGIT-CFLAGS $(missing_dep_dirs)
-	$(QUIET_CC)$(CC) -o $@ -c $(dep_args) $(ALL_CFLAGS) $(EXTRA_CPPFLAGS) $(CGIT_CFLAGS) $<
+$(CGIT_OBJS): $(CGIT_BUILD)/%.o: $(CGIT_SRC)/%.c GIT-CFLAGS \
+		$(CGIT_BUILD)/CGIT-CFLAGS $(missing_dep_dirs)
+	$(QUIET_CC)$(CC) -o $@ -c $(dep_args) $(ALL_CFLAGS) $(EXTRA_CPPFLAGS) \
+		$(CGIT_CFLAGS) $<
 
 $(CGIT_BUILD)/cgit: $(CGIT_OBJS) GIT-LDFLAGS $(GITLIBS)
 	@echo 1>&2 "    * $(LUA_MESSAGE)"