diff --git a/subprojects/libcr51sign/meson.build b/subprojects/libcr51sign/meson.build
index 66f77f0..f122686 100644
--- a/subprojects/libcr51sign/meson.build
+++ b/subprojects/libcr51sign/meson.build
@@ -19,7 +19,7 @@
   meson_version: '>=0.57.0',
   default_options: [
     'warning_level=3',
-    'werror=false',
+    'werror=true',
     'c_std=c18',
   ])
 
diff --git a/subprojects/libcr51sign/src/libcr51sign.c b/subprojects/libcr51sign/src/libcr51sign.c
index 9bd86b9..f5cacd4 100644
--- a/subprojects/libcr51sign/src/libcr51sign.c
+++ b/subprojects/libcr51sign/src/libcr51sign.c
@@ -25,7 +25,7 @@
 #endif
 
 #ifndef USER_PRINT
-#define CPRINTS(ctx, format, args...) printf(format, ##args)
+#define CPRINTS(ctx, ...) fprintf(stderr, __VA_ARGS__)
 #endif
 
 #define MEMBER_SIZE(type, field) sizeof(((type*)0)->field)
@@ -291,8 +291,9 @@
                                  LIBCR51SIGN_SHA512_DIGEST_SIZE];
         uint8_t dcrypto_digest[LIBCR51SIGN_SHA512_DIGEST_SIZE];
         uint32_t byte_count, region_count, image_size, hash_offset, digest_size;
+        uint32_t i;
         uint8_t d_region_num = 0;
-        int i, rv;
+        int rv;
         struct image_region const* region;
 
         if (image_regions == NULL)
@@ -317,10 +318,9 @@
             return LIBCR51SIGN_ERROR_INVALID_REGION_SIZE;
         }
 
-        rv = intf->read(
-            ctx, d_offset + offsetof(struct image_descriptor, image_regions),
-            region_count * sizeof(struct image_region),
-            (uint8_t*)&image_regions->image_regions);
+        rv = intf->read(ctx, d_offset + sizeof(struct image_descriptor),
+                        region_count * sizeof(struct image_region),
+                        (uint8_t*)&image_regions->image_regions);
 
         image_regions->region_count = region_count;
 
@@ -338,7 +338,7 @@
 
             CPRINTS(ctx,
                     "validate_payload_regions: region #%d \"%s\" (%x - %x)", i,
-                    region->region_name, region->region_offset,
+                    (const char*)region->region_name, region->region_offset,
                     region->region_offset + region->region_size);
             if ((region->region_offset % IMAGE_REGION_ALIGNMENT) != 0 ||
                 (region->region_size % IMAGE_REGION_ALIGNMENT) != 0)
@@ -435,7 +435,7 @@
                                  hash_start);
                 }
                 CPRINTS("validate_payload_regions: hashing %s (%x - %x)",
-                        region->region_name, hash_start,
+                        (const char*)region->region_name, hash_start,
                         hash_start + hash_size);
                 // Read the image_region array.
                 rv = read_and_hash_update(ctx, intf, hash_start, hash_size);
diff --git a/subprojects/libcr51sign/src/libcr51sign_support.c b/subprojects/libcr51sign/src/libcr51sign_support.c
index 81f05c5..4e9c517 100644
--- a/subprojects/libcr51sign/src/libcr51sign_support.c
+++ b/subprojects/libcr51sign/src/libcr51sign_support.c
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 #include <libcr51sign/libcr51sign_support.h>
+#include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
@@ -25,6 +26,10 @@
 {
 #endif
 
+#ifndef USER_PRINT
+#define CPRINTS(ctx, ...) fprintf(stderr, __VA_ARGS__)
+#endif
+
     // @func hash_init get ready to compute a hash
     //
     // @param[in] ctx - context struct
@@ -117,10 +122,10 @@
         // By default returns error.
         int rv = LIBCR51SIGN_ERROR_INVALID_ARGUMENT;
 
-        printf("\n sig_len %zu sig: ", sig_len);
-        for (int i = 0; i < sig_len; i++)
+        CPRINTS(ctx, "\n sig_len %zu sig: ", sig_len);
+        for (size_t i = 0; i < sig_len; i++)
         {
-            printf("%x", sig[i]);
+            CPRINTS(ctx, "%x", sig[i]);
         }
 
         struct libcr51sign_ctx* lctx = (struct libcr51sign_ctx*)ctx;
@@ -130,14 +135,14 @@
         BIO* bio = BIO_new(BIO_s_mem());
         if (!fp)
         {
-            printf("\n fopen failed: ");
+            CPRINTS(ctx, "\n fopen failed: ");
             goto clean_up;
         }
 
         pkey = PEM_read_PUBKEY(fp, 0, 0, 0);
         if (!pkey)
         {
-            printf("\n Read public key failed: ");
+            CPRINTS(ctx, "\n Read public key failed: ");
             goto clean_up;
         }
 
@@ -149,24 +154,24 @@
         pub_rsa = RSAPublicKey_dup(rsa);
         if (!RSA_print(bio, pub_rsa, 2))
         {
-            printf("\n RSA print failed ");
+            CPRINTS(ctx, "\n RSA print failed ");
         }
         if (!pub_rsa)
         {
-            printf("\n no pub rsa: ");
+            CPRINTS(ctx, "\n no pub rsa: ");
             goto clean_up;
         }
-        printf("\n public rsa \n");
+        CPRINTS(ctx, "\n public rsa \n");
         char buffer[1024];
         while (BIO_read(bio, buffer, sizeof(buffer) - 1) > 0)
         {
-            printf(" %s", buffer);
+            CPRINTS(ctx, " %s", buffer);
         }
         enum hash_type hash_type;
         rv = get_hash_type_from_signature(sig_scheme, &hash_type);
         if (rv != LIBCR51SIGN_SUCCESS)
         {
-            printf("\n Invalid hash_type! \n");
+            CPRINTS(ctx, "\n Invalid hash_type! \n");
             goto clean_up;
         }
         int hash_nid = -1;
@@ -188,25 +193,25 @@
         // OpenSSL RSA_verify returns 1 on success and 0 on failure
         if (!ret)
         {
-            printf("\n OPENSSL_ERROR: %s \n",
-                   ERR_error_string(ERR_get_error(), NULL));
+            CPRINTS(ctx, "\n OPENSSL_ERROR: %s \n",
+                    ERR_error_string(ERR_get_error(), NULL));
             rv = LIBCR51SIGN_ERROR_RUNTIME_FAILURE;
             goto clean_up;
         }
         rv = LIBCR51SIGN_SUCCESS;
-        printf("\n sig: ");
-        for (int i = 0; i < sig_len; i++)
+        CPRINTS(ctx, "\n sig: ");
+        for (size_t i = 0; i < sig_len; i++)
         {
-            printf("%x", sig[i]);
+            CPRINTS(ctx, "%x", sig[i]);
         }
 
-        printf("\n data: ");
-        for (int i = 0; i < data_len; i++)
+        CPRINTS(ctx, "\n data: ");
+        for (size_t i = 0; i < data_len; i++)
         {
-            printf("%x", data[i]);
+            CPRINTS(ctx, "%x", data[i]);
         }
         const unsigned rsa_size = RSA_size(pub_rsa);
-        printf("\n rsa size %d sig_len %d", rsa_size, (uint32_t)sig_len);
+        CPRINTS(ctx, "\n rsa size %d sig_len %d", rsa_size, (uint32_t)sig_len);
 
     clean_up:
         if (fp)
diff --git a/subprojects/libcr51sign/src/meson.build b/subprojects/libcr51sign/src/meson.build
index e85e65c..2a0ac0e 100644
--- a/subprojects/libcr51sign/src/meson.build
+++ b/subprojects/libcr51sign/src/meson.build
@@ -18,6 +18,7 @@
 
 libcr51sign_pre = declare_dependency(
   include_directories: libcr51sign_includes,
+  compile_args: '-DOMIT_VARIABLE_ARRAYS',
   dependencies: libcr51sign_deps)
 
 libcr51sign_lib = library(