gcc does not currently have a strong link with the sysroot:

thierry@linux-t88n:~/Radio/4a-softmixer-latest/build_arm (master)*$
aarch64-agl-linux-gcc -print-sysroot-headers-suffix
aarch64-agl-linux-gcc: fatal error: not configured with sysroot headers suffix
compilation terminated.

and:

thierry@linux-t88n:~/Radio/4a-softmixer-latest/build_arm (master)*$
aarch64-agl-linux-gcc -print-sysroot
/not/exist

That means that gcc cmdline must be provided with and extra '-isystem' option.

A safer way is to configure gcc in such a way that the link to the sysroot is hardcoded.

Another point, that affects the build reproducibility and safety, is that we do not pass the -Wpoison-system-directories to cmdline.

When that option is available (depends on gcc configuration, see '--enable-poison-system-directories'), gcc will complain when invoked with options like '(I/usr/include'), that can happen with applications that do not use the autotools.

Adding the option to global CFLAGS would make sure that it cannot happen