I'm running a package review request for a package which uses suid and rpmlint complaints that it is not using hardened build flags. However, the specfile doesn't explicitly disable them with %undefine _hardened_build. Looking at the build log of this one [1] I see that export CFLAGS and other flags are missing -fPIE/-fPIC, so the hardened build flags seems to not be truly applied by default to builds... this is a Golang package, but I see the same to other Koji builds made with cmake, rust, etc. So, where -fPIE/-fPIC are supposed to be injected in build flags? Mattia [1] https://koji.fedoraproject.org/koji/taskinfo?taskID=82863274 _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
