From d1e0c27a43e71dccdac6ecc4a072911889fa2ed3 Mon Sep 17 00:00:00 2001
From: Michal Schorm <mschorm@redhat.com>
Date: Aug 08 2025 08:53:43 +0000
Subject: [PATCH 1/2] Enhance the 'Compiler Flags' section.


Link to this document:
https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/rawhide/f/buildflags.md
for descibing the correct way to manipulate the  compiler flags.

Set the requirement to:
  "SHOULD avoid editing the 'CFLAGS' etc. environment variables by hand".

The goal of this change is to encourage people to start using the standard
set of macros we have, instead of inventing their own ways to edit
the CFLAGS / CXXFLAGS etc. enviromental variables.

This is a part of this Fedora Change for F43:
  https://fedoraproject.org/wiki/Changes/Package-specific_RPM_Macros_For_Build_Flags
which introduced a set of macros for adding flags at the end of the default set,
which should obsolete any other way people invented to edit the content
of the CFLAGS / CXXFLAGS etc. enviromental variables.

The main advantages are that it is propagated to all calls of the %set_build_flags macro,
in every section, in the whole SPECfile. (instead of just the lines after
the "export CFLAGS" etc. call until the end of the current section)
Also, it is much more auditable.

---

diff --git a/guidelines/modules/ROOT/pages/index.adoc b/guidelines/modules/ROOT/pages/index.adoc
index b10e81c..bdc50c0 100644
--- a/guidelines/modules/ROOT/pages/index.adoc
+++ b/guidelines/modules/ROOT/pages/index.adoc
@@ -1294,6 +1294,10 @@ Adding to and overriding or filtering parts of these flags is permitted
 if there's a good reason to do so;
 the rationale for doing so must be documented in the specfile.
 
+Packages SHOULD avoid editing the 'CFLAGS' etc. environment variables by hand,
+and instead use methods for compiler flags manipulation described in
+https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/rawhide/f/buildflags.md[this documentation]
+
 There are certain, security related flags that are commonly allowed.
 These flags may degrade performance slightly
 but the increased security can be worthwhile for some programs.

From d07c4db168f98f069cb6feca4cf09a1fdb9461c4 Mon Sep 17 00:00:00 2001
From: Michal Schorm <mschorm@redhat.com>
Date: Aug 12 2025 23:12:53 +0000
Subject: [PATCH 2/2] Update the section "Macros providing compiler and linker flags" for year 2025


Update the evaluation of the macros, so users trying it out see
something more current / more familiar.

Remove the part mentioning '%{__global_cflags}'. It does not match
the '%{optflags}' macro anymore. Also refrain from teaching packages using
macros prefixed with multiple underscores.

---

diff --git a/guidelines/modules/ROOT/pages/RPMMacros.adoc b/guidelines/modules/ROOT/pages/RPMMacros.adoc
index d02f0fd..65293ef 100644
--- a/guidelines/modules/ROOT/pages/RPMMacros.adoc
+++ b/guidelines/modules/ROOT/pages/RPMMacros.adoc
@@ -111,23 +111,23 @@ For example, they are set by `fedpkg` to override the default directories.
 
 == Macros providing compiler and linker flags
 
-The default build flags for binaries on fedora are also available via macros.
+The default build flags for binaries on fedora are available via macros.
 They are used by the build system macros to setup the build environment,
 so it is usually not necessary to use them directly --
 except, for example, when doing bare bones compilation with `gcc` directly.
 
-The set of flags listed below reflects the current state of fedora 28
+The set of flags listed below reflects the current state of fedora 42
 on a `x86_64` machine, as defined in the file `/usr/lib/rpm/redhat/macros`.
 
 The `+%{optflags}+` macro contains flags that determine `CFLAGS`, `CXXFLAGS`,
-`FFLAGS`, etc. -- the `+%{__global_cflags}+` macro evaluates to the same string.
+`FFLAGS`, etc.
 
 The current definitions of these values
 can be found in the `redhat-rpm-config` package, in the {build-flags}.
 
 ....
 $ rpm --eval "%{optflags}"
--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
+-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer
 ....
 
 The value of the `LDFLAGS` environment variable set by build systems
@@ -135,6 +135,6 @@ is determined by the `+%{build_ldflags}+` macro:
 
 ....
 $ rpm -E "%{build_ldflags}"
--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
+-Wl,-z,relro -Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1
 ....