From 0d74b2b15ce8490133be1ce1b804bea96869613f Mon Sep 17 00:00:00 2001
From: Otto Urpelainen <oturpe@iki.fi>
Date: Jun 03 2022 19:51:38 +0000
Subject: Compiler flags updates


* Add named anchor to a section in RPMMacros.adoc.
The index page already attempts to link to such anchor,
but fails because it is not defined.

* Update the example results for optflags and build_ldflags
to match Fedora 36 configuration,
up from Fedora 28.

* Remove a paragraph about allowing adding some security related build
flags.
This is a reference to the PIE section immediately after,
but at some point, PIE became the default and that section does not
suggest adding any flags any more.

---

diff --git a/guidelines/modules/ROOT/pages/RPMMacros.adoc b/guidelines/modules/ROOT/pages/RPMMacros.adoc
index d5e78a1..0c98d3f 100644
--- a/guidelines/modules/ROOT/pages/RPMMacros.adoc
+++ b/guidelines/modules/ROOT/pages/RPMMacros.adoc
@@ -108,7 +108,7 @@ For example, they are set by `fedpkg` to override the default directories.
 | +%{_buildrootdir}+   | +%{_topdir}/BUILDROOT+       |
 |=================================
 
-
+[#build-flags-macros-and-variables]
 == Macros providing compiler and linker flags
 
 The default build flags for binaries on fedora are also available via macros.
@@ -116,7 +116,7 @@ They are used by the build system macros to setup the build environment,
 so it is usually not necessary to use them directly --
 except, for example, when doing bare bones compilation with `gcc` directly.
 
-The set of flags listed below reflects the current state of fedora 28
+The set of flags listed below reflects the current state of Fedora 36
 on a `x86_64` machine, as defined in the file `/usr/lib/rpm/redhat/macros`.
 
 The `+%{optflags}+` macro contains flags that determine `CFLAGS`, `CXXFLAGS`,
@@ -127,14 +127,14 @@ can be found in the `redhat-rpm-macros` package, in the {build-flags}.
 
 ....
 $ rpm --eval "%{optflags}"
--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
+-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1       -m64  -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
 ....
 
 The value of the `LDFLAGS` environment variable set by build systems
 is determined by the `+%{build_ldflags}+` macro:
 
 ....
-$ rpm -E "%{build_ldflags}"
--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
+$ rpm --eval "%{build_ldflags}"
+-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1
 ....
 
diff --git a/guidelines/modules/ROOT/pages/index.adoc b/guidelines/modules/ROOT/pages/index.adoc
index 40cbb35..21e9132 100644
--- a/guidelines/modules/ROOT/pages/index.adoc
+++ b/guidelines/modules/ROOT/pages/index.adoc
@@ -1317,10 +1317,6 @@ Adding to and overriding or filtering parts of these flags is permitted
 if there's a good reason to do so;
 the rationale for doing so must be documented in the specfile.
 
-There are certain, security related flags that are commonly allowed.
-These flags may degrade performance slightly
-but the increased security can be worthwhile for some programs.
-
 === PIE
 
 PIE adds security to executables