> I'm running a package review request for a package which uses suid and > rpmlint complaints that it is not using hardened build flags. However, > the specfile doesn't explicitly disable them with %undefine _hardened_build. > > Looking at the build log of this one [1] I see that export CFLAGS and > other flags are missing -fPIE/-fPIC, so the hardened build flags seems > to not be truly applied by default to builds... this is a Golang > package, but I see the same to other Koji builds made with cmake, rust, etc. > > So, where -fPIE/-fPIC are supposed to be injected in build flags? Via the various rpm macros like %configure > [1] https://koji.fedoraproject.org/koji/taskinfo?taskID=82863274 You're probably better off referencing the review as opposed to a build. _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
