brp-llvm-compile-lto-elf

@@ -48,7 +48,5 @@ check_convert_bitcode () {
 
 echo "Checking for LLVM bitcode artifacts"
 export -f check_convert_bitcode
-# Deduplicate by device:inode to avoid processing hardlinks in parallel.
+find "$RPM_BUILD_ROOT" -type f -name "*.[ao]" -print0 | \
-find "$RPM_BUILD_ROOT" -type f -name "*.[ao]" -printf "%D:%i %p\n" | \
+  xargs -0 -r -n1 -P$NCPUS sh -c "check_convert_bitcode \$@ $CLANG_FLAGS" ARG0
-  awk '!seen[$1]++' | cut -d" " -f2- | \
-  xargs -d"\n" -r -n1 -P$NCPUS sh -c "check_convert_bitcode \$@ $CLANG_FLAGS" ARG0

buildflags.md

@@ -117,17 +117,15 @@ or:
 ### Controlling Type Safety
 
 The macro `%build_type_safety_c` can be set to change the C type
-safety level.  The default level is 1, see below.  It can be set to 0
+safety level.  By default (value 0), all C constructs that GCC accepts
-to get historic levels of type safety.  Changing the type safety level
+for backwards compatibility with obsolete language standards are
-may depend on correct `CFLAGS` propagation during the build.  The
+accepted during package builds.  Packages can set
-`%build_type_safety_c` macro needs to be set before `CFLAGS`-related
+`%build_type_safety_c` to higher values to adopt future
-macros are expanded by RPM (that is, earlier in the file works
+distribution-wide type-safety increases early.
-better).
 
-Packages can set `%build_type_safety_c` to higher values to adopt
+When changing the `%build_type_safety_c` level to increase it, spec
-future distribution-wide type-safety increases early.  When changing
+file should use a construct like this to avoid *lowering* a future
-the `%build_type_safety_c` level to increase it, spec file should use
+default:
-a construct like this to avoid *lowering* a future default:
 
 ```
 %if %build_type_safety_c < 2
@@ -135,10 +133,6 @@ a construct like this to avoid *lowering* a future default:
 %endif
 ```
 
-At level 0, all C constructs that GCC accepts for backwards
-compatibility with obsolete language standards are accepted during
-package builds.
-
 At level 1, the following additional error categories are enabled:
 
 * `-Werror=implicit-int`: Reject declarations and definitions that
@@ -599,11 +593,7 @@ tuning in the `gcc` package.  These settings are:
   CPU level of zEC12, while optimizing for a subsequent CPU generation
   (z13).
 * **x86_64**: `-mtune=generic` selects tuning which is expected to
-   beneficial for a broad range of current CPUs.  Distribution-specific
+   beneficial for a broad range of current CPUs.
-   defaults for `-march=x86-64-v2` or `-march=x86-64-v3` may be
-   applied.  The default can be overriden (for any distribution)
-   by specifying `--target x86_64_v2`, `--target x86_64_v3`,
-   `--target x86_64_v4` in the `rpmbuild` invocation.
 * **aarch64** does not have any architecture-specific tuning.
 
 ### Vala-specific compiler flags
@@ -670,11 +660,16 @@ with such toolchains.
 The macros `%{extension_cflags}`, `%{extension_cxxflags}`,
 `%{extension_fflags}`, `%{extension_ldflags}` contain a subset of
 flags that have been adjusted for compatibility with alternative
-toolchains.
+toolchains, while still preserving some of the compile-time security
+hardening that the standard Fedora build flags provide.
 
-Currently the -fexceptions and -fcf-protection flags are preserved
+The current set of differences are:
-for binary compatibility with the languages the extensions are
+
-built against.
+* No GCC plugins (such as annobin) are activated.
+* No GCC spec files (`-specs=` arguments) are used.
+
+Additional flags may be removed in the future if they prove to be
+incompatible with alternative toolchains.
 
 Extension builders should detect whether they are performing a regular
 RPM build (e.g., by looking for an `RPM_OPT_FLAGS` variable).  In this

forge.lua

@@ -0,0 +1,331 @@
+-- Lua code used by macros.forge and derivatives
+
+-- Computes the suffix of a version string, removing vprefix if it matches
+-- For example with vprefix 1.2.3: 1.2.3.rc2 → .rc2 but 1.2.30 → 1.2.30 not 0
+local function getversionsuffix(vstring,vprefix)
+  if (string.sub(vstring, 1, #vprefix) == vprefix) and
+     (not string.match(string.sub(vstring, #vprefix + 1), "^%.?%d")) then
+    return string.sub(vstring, #vprefix + 1)
+  else
+    return vstring
+  end
+end
+
+-- Check if an identified url is sane
+local function checkforgeurl(url, id, silent)
+  local checkedurl  = nil
+  local checkedid   = nil
+  local urlpatterns = {
+    gitlab = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://(…[-.])gitlab[-.]…/owner/repo'},
+    pagure = {
+      pattern     = 'https://[^/]+/[^/#?]+',
+      description = 'https://pagure.io/repo'},
+    pagure_ns = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://pagure.io/namespace/repo'},
+    pagure_fork = {
+      pattern     = 'https://[^/]+/fork/[^/]+/[^/#?]+',
+      description = 'https://pagure.io/fork/owner/repo'},
+    pagure_ns_fork = {
+      pattern     = 'https://[^/]+/fork/[^/]+/[^/]+/[^/#?]+',
+      description = 'https://pagure.io/fork/owner/namespace/repo'},
+    ["gitea.com"] = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://gitea.com/owner/repo'},
+    github = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://(…[-.])github[-.]…/owner/repo'},
+    ["code.googlesource.com"] = {
+      pattern     = 'https://code.googlesource.com/[^#?]*[^/#?]+',
+      description = 'https://code.googlesource.com/…/repo'},
+    ["bitbucket.org"] = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://bitbucket.org/owner/repo'},
+    sourcehut = {
+      pattern     = 'https://[^/]+/~[^/]+/[^/#?]+',
+      description = 'https://git.sr.ht/~owner/repo'}}
+  if (urlpatterns[id] ~= nil) then
+    checkedurl = string.match(url,urlpatterns[id]["pattern"])
+    if (checkedurl == nil) then
+      if not silent then
+        rpm.expand("%{error:" .. id .. " URLs must match " .. urlpatterns[id]["description"] .. " !}")
+      end
+    else
+      checkedid = id
+    end
+  end
+  return checkedurl, checkedid
+end
+
+-- Check if an url matches a known forge
+local function idforge(url, silent)
+  local forgeurl = nil
+  local forge    = nil
+  if (url ~= "") then
+    forge = string.match(url, "^[^:]+://([^/]+)/")
+    if (forge == nil) then
+      if not silent then
+        rpm.expand("%{error:URLs must include a protocol such as https:// and a path starting with / !}")
+      end
+    else
+      if (forge == "pagure.io") then
+        if     string.match(url, "[^:]+://pagure.io/fork/[^/]+/[^/]+/[^/]+") then
+          forge = "pagure_ns_fork"
+        elseif string.match(url, "[^:]+://pagure.io/fork/[^/]+/[^/]+") then
+          forge = "pagure_fork"
+        elseif  string.match(url, "[^:]+://pagure.io/[^/]+/[^/]+") then
+          forge = "pagure_ns"
+        elseif  string.match(url, "[^:]+://pagure.io/[^/]+") then
+          forge = "pagure"
+        end
+      elseif (string.match(forge, "^gitlab[%.-]") or string.match(forge, "[%.-]gitlab[%.]")) then
+        forge = "gitlab"
+      elseif (string.match(forge, "^github[%.-]") or string.match(forge, "[%.-]github[%.]")) then
+        forge = "github"
+        elseif  string.match(url, "[^:]+://git.sr.ht/") then
+        forge = "sourcehut"
+      end
+      forgeurl, forge = checkforgeurl(url, forge, silent)
+    end
+  end
+  return forgeurl, forge
+end
+
+-- The forgemeta macro main processing function
+-- See the documentation in the macros.forge file for argument description
+-- Also called directly by gometa
+local function meta(suffix, verbose, informative, silent)
+  local fedora = require "fedora.common"
+  local ismain = (suffix == "") or (suffix == "0")
+  if ismain then
+    fedora.zalias({"forgeurl", "forgesource", "forgesetupargs",
+                      "archivename", "archiveext", "archiveurl",
+                      "topdir", "extractdir", "repo", "owner", "namespace",
+                      "scm", "tag", "commit", "shortcommit", "branch", "version",
+                      "date", "distprefix"}, verbose)
+  end
+  local variables = {
+    default = {
+      scm         = "git",
+      archiveext  = "tar.bz2",
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/[^/]+/([^/?#]+)"))}',
+      archivename = "%{repo"         .. suffix .. "}-%{ref"           .. suffix .. "}",
+      topdir      = "%{archivename"  .. suffix .. "}" },
+    gitlab = {
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/-/archive/%{ref" .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    pagure = {
+      archiveext  = "tar.gz",
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/([^/?#]+)"))}',
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    pagure_ns = {
+      archiveext  = "tar.gz",
+      namespace   = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/([^/]+)/[^/?#]+"))}',
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/[^/]+/([^/?#]+)"))}',
+      archivename = "%{namespace"    .. suffix .. "}-%{repo"          .. suffix .. "}-%{ref"         .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    pagure_fork = {
+      archiveext  = "tar.gz",
+      owner       = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/([^/]+)/[^/?#]+"))}',
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/[^/]+/([^/?#]+)"))}',
+      archivename = "%{owner"        .. suffix .. "}-%{repo"          .. suffix .. "}-%{ref"         .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    pagure_ns_fork = {
+      owner       = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/([^/]+)/[^/]+/[^/?#]+"))}',
+      namespace   = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/[^/]+/([^/]+)/[^/?#]+")}',
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/[^/]+/[^/]+/([^/?#]+)")}',
+      archivename = "%{owner"        .. suffix .. "}-%{namespace"     .. suffix .. "}-%{repo"        .. suffix .. "}-%{ref"        .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    ["gitea.com"] = {
+      archiveext  = "tar.gz",
+      archivename = "%{fileref"      .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}.%{archiveext" .. suffix .. "}",
+      topdir      = "%{repo}" },
+    github = {
+      archiveext  = "tar.gz",
+      archivename = "%{repo"         .. suffix .. "}-%{fileref"       .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    ["code.googlesource.com"] = {
+      archiveext  = "tar.gz",
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://.+/([^/?#]+)"))}',
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/+archive/%{ref"  .. suffix .. "}.%{archiveext"  .. suffix .. "}",
+      topdir      = "" },
+    ["bitbucket.org"] = {
+      shortcommit = '%{lua:print(string.sub(rpm.expand("%{commit'     .. suffix .. '}"), 1, 12))}',
+      owner       = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/([^/?#]+)"))}',
+      archivename = "%{owner"        .. suffix .. "}-%{repo"          .. suffix .. "}-%{shortcommit" .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/get/%{ref"       .. suffix .. "}.%{archiveext"  .. suffix .. "}" }, 
+    sourcehut = {
+      archiveext  = "tar.gz",
+      archivename = "%{repo"         .. suffix .. "}-%{fileref"       .. suffix .. "}",
+      archiveurl = "%{forgeurl"      .. suffix .. "}/archive/%{ref"   .. suffix .. "}.%{archiveext"  .. suffix .. "}",
+      topdir     = "%{repo"          .. suffix .. "}-%{ref"           .. suffix .. "}" } }
+  -- Packaging a moving branch is quite a bad idea, but since at least Gitlab
+  -- will treat branches and tags the same way better support branches explicitly
+  -- than have packagers hijack %{tag} to download branch states
+  local spec = {}
+  for _, v in ipairs({'forgeurl','tag','commit','branch','version'}) do
+    spec[v] = rpm.expand("%{?" .. v .. suffix .. "}")
+  end
+  -- Compute the reference of the object to fetch
+  local isrelease = false
+  if     (spec["tag"]     ~= "") then       ref = "%{?tag"     .. suffix .. "}"
+  elseif (spec["commit"]  ~= "") then       ref = "%{?commit"  .. suffix .. "}"
+  elseif (spec["branch"]  ~= "") then       ref = "%{?branch"  .. suffix .. "}"
+  else                                      ref = "%{?version" .. suffix .. "}"
+                                      isrelease = true
+  end
+  if (rpm.expand(ref) == "") then
+    if (suffix == "") then
+      rpm.expand("%{error:You need to define Version:, %{commit} or %{tag} before the macro invocation !}")
+    else
+      rpm.expand("%{error:You need to define %{version" .. suffix .. "}, %{commit" .. suffix .. "} or %{tag" .. suffix .. "} before the macro invocation !}")
+    end
+  end
+  local    forgeurl = spec["forgeurl"]
+  -- For backwards compatibility only
+  local expliciturl = rpm.expand("%{?-u*}")
+  if   (expliciturl ~= "") then
+    rpm.expand("%{warn:-u use in %%forgemeta is deprecated, use -z instead to select a separate set of rpm variables!}")
+           forgeurl = expliciturl
+  end
+  local forge
+  forgeurl,   forge = idforge(forgeurl, silent)
+  if (forge ~= nil) then
+    fedora.explicitset("forgeurl" .. suffix, forgeurl, verbose)
+    -- Custom processing of quirky forges that can not be handled with simple variables
+    if (forge == "github") then
+      -- Workaround the way GitHub injects "v"s before some version strings (but not all!)
+      -- To package one of the minority of sane GitHub projects that do not munge their version
+      -- strings set tag to %{version} in your spec
+      local fileref = ref
+      if (ref == "%{?version"  .. suffix .. "}") then
+        ref = "v" .. ref
+      elseif (fileref ~= "%{?commit" .. suffix .. "}") and
+             string.match(rpm.expand(fileref), "^v[%d]") then
+        fileref = string.gsub(rpm.expand(fileref), "^v", "")
+      elseif (string.match(rpm.expand(fileref), "/")) then
+        fileref = string.gsub(rpm.expand(fileref), "/", "-")
+      end
+      fedora.safeset("fileref" .. suffix, fileref, verbose)
+    elseif (forge == "gitea.com") then
+      -- Workaround the way gitea mangles /s in ref names
+      local fileref = ref
+      fileref = string.gsub(rpm.expand(fileref), "/", "-")
+      fedora.safeset("fileref" .. suffix, fileref, verbose)
+    elseif (forge == "code.googlesource.com") then
+      if (ref == "%{?version"  .. suffix .. "}") then
+        ref = "v" .. ref
+      end
+    elseif (forge == "bitbucket.org") then
+      if (spec["commit"] == "") then
+        rpm.expand("%{error:All BitBucket URLs require commit value knowledge: you need to define %{commit}!}")
+      end
+    elseif (forge == "sourcehut") then
+      local fileref = ref
+      if (fileref ~= "%{?commit" .. suffix .. "}") and
+             string.match(rpm.expand(fileref), "^v[%d]") then
+        fileref = string.gsub(rpm.expand(fileref), "^v", "")
+      elseif (string.match(rpm.expand(fileref), "/")) then
+        fileref = string.gsub(rpm.expand(fileref), "/", "-")
+      end
+      fedora.safeset("fileref" .. suffix, fileref, verbose)
+    end
+    fedora.safeset("ref" .. suffix, ref, verbose)
+    -- Mass setting of the remaining variables
+    for k,v in pairs(variables[forge]) do
+      fedora.safeset(k .. suffix, variables[forge][k], verbose)
+    end
+    for k,v in pairs(variables["default"]) do
+      if (variables[forge][k] == nil) then
+        fedora.safeset(k .. suffix, variables["default"][k], verbose)
+      end
+    end
+  end
+  -- Generic rules
+  for _, v in ipairs({'archiveurl','archivename','archiveext','topdir'}) do
+    spec[v] = rpm.expand("%{?" .. v .. suffix .. "}")
+  end
+  -- Source URL processing (computing the forgesource spec variable)
+  local forgesource = "%{archiveurl" .. suffix .. "}"
+  if (string.match(spec["archiveurl"], "/([^/]+)$") ~= spec["archivename"] .. "." .. spec["archiveext"]) then
+    forgesource     = "%{?archiveurl" .. suffix .. "}#/%{?archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}"
+  end
+  fedora.safeset("forgesource" .. suffix, forgesource, verbose)
+  -- Setup processing      (computing the forgesetup and extractdir variables)
+  local forgesetupargs = "-n %{extractdir" .. suffix .. "}"
+  local extractdir     = "%{topdir"        .. suffix .. "}"
+  if (spec["topdir"] == "") then
+    forgesetupargs     = "-c " .. forgesetupargs
+    extractdir         = "%{archivename"   .. suffix .. "}"
+  end
+  if not ismain then
+    if (spec["topdir"] ~= "") then
+      forgesetupargs = "-T -D -b " .. suffix .. " " .. forgesetupargs
+    else
+      forgesetupargs = "-T -D -a " .. suffix .. " " .. forgesetupargs
+    end
+  end
+  fedora.safeset("forgesetupargs" .. suffix, forgesetupargs, verbose)
+  fedora.safeset("extractdir"     .. suffix, extractdir, verbose)
+  -- dist processing       (computing the correct prefix for snapshots)
+  local distprefix = ""
+  if not isrelease then
+    distprefix = string.lower(rpm.expand(ref))
+    if     (ref == "%{?commit" .. suffix .. "}") then
+      distprefix = string.sub(distprefix, 1, 7)
+    elseif (ref ~= "%{?branch" .. suffix .. "}") then
+      distprefix = string.gsub(distprefix,      "[%p%s]+", ".")
+      distprefix = string.gsub(distprefix, "^" .. string.lower(rpm.expand("%{?repo}")) .. "%.?", "")
+      local    v = string.gsub(rpm.expand("%{version}"), "[%p%s]+", ".")
+      for _, p in ipairs({'','v','v.','version','version.','tags.v', 'tags.v.'}) do
+        distprefix = getversionsuffix(distprefix, p .. v)
+      end
+      distprefix = string.gsub(distprefix, "^%.", "")
+    end
+    if (distprefix ~= "") then
+      distprefix = "%{scm"     .. suffix .. "}" .. distprefix
+      date = rpm.expand("%{?date" .. suffix .. "}")
+      if (date ~= "") then
+        distprefix = date .. distprefix
+      else
+        distprefix = "%([ -r %{_sourcedir}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "} ] && date +%Y%m%d -u -r %{_sourcedir}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "})" .. distprefix
+      end
+      distprefix = "." .. distprefix
+    end
+  end
+  if (spec["version"] ~= "") and
+     (spec["version"] ~= "0") and
+     (spec["version"] ~= rpm.expand("%{?version}")) then
+    distprefix = ".%{version" .. suffix .. "}" .. distprefix
+  end
+  if (rpm.expand(distprefix) ~= "") then
+    if not ismain then
+      distprefix = string.gsub(distprefix, "^%.", ".s")
+    end
+    fedora.safeset ("distprefix"    .. suffix, distprefix, verbose)
+  end
+  if ismain then
+    fedora.zalias({"forgeurl", "forgesource", "forgesetupargs",
+                      "archivename", "archiveext", "archiveurl",
+                      "topdir", "extractdir", "repo", "owner", "namespace",
+                      "scm", "shortcommit", "distprefix"}, verbose)
+  end
+  -- Final spec variable summary if the macro was called with -i
+  if informative then
+    rpm.expand("%{echo:Packaging variables read or set by %%forgemeta}")
+    fedora.echovars({"forgeurl", "forgesource", "forgesetupargs",
+                        "archivename", "archiveext", "archiveurl",
+                        "topdir", "extractdir", "repo", "owner", "namespace",
+                        "scm", "tag", "commit", "shortcommit", "branch", "version",
+                        "date", "distprefix"}, suffix)
+    fedora.echovars({"dist"},"")
+    rpm.expand("%{echo:  (snapshot date is either manually supplied or computed once %%{_sourcedir}/%%{archivename" .. suffix .. "}.%%{archiveext" .. suffix .. "} is available)}")
+  end
+end
+
+return {
+  meta = meta,
+}
+

gpgverify

@@ -5,7 +5,7 @@
 # This material is provided as is, with absolutely no warranty expressed
 # or implied. Any use is at your own risk.
 #
-# Permission is hereby granted to use or copy this program
+# Permission is hereby granted to use or copy this shellscript
 # for any purpose, provided the above notices are retained on all copies.
 # Permission to modify the code and to distribute modified code is granted,
 # provided the above notices are retained, and a notice that the code was

macros

@@ -113,19 +113,13 @@
 # Internal-only.  Do not use.  Expand a variable and strip the flags
 # not suitable to extension builders.
 %__extension_strip_flags() %{lua:
---the only argument to this macro is the "name" of the flags we strip (e.g. cflags, ldflags, etc.)
 local name = rpm.expand("%{1}")
---store all the individual flags in a variable as a continuous string
+local value = " " .. rpm.expand("%{build_" .. name .. "}")
-local flags = rpm.expand("%{build_" .. name .. "}")
+local specs_pattern = "%s+-specs=[^%s]+"
---create an empty table for the minimal set of flags we wanna preserve
+local lto_flags_pattern = rpm.expand("%{?_lto_cflags}"):gsub("[%-%.]", "%%%1")
-local stripped_flags = { }
+local package_note_flags_pattern = "%-Wl,%S*package_note%S*"
---iterate over the individual flags and store the ones we want in the table as unique keys
+local result = value:gsub(specs_pattern, " "):gsub(lto_flags_pattern, ""):gsub(package_note_flags_pattern, "")
-for flag in flags:gmatch("%S+") do
+print(result)
-  if flag:find("^%-fexceptions") or flag:find("^%-fcf%-protection") then
-    stripped_flags[flag] = true end
-  end
---print out the finalized set of flags for use by the extension builders
-for k,_ in pairs(stripped_flags) do print(k .. " ") end
 }
 
 # Variants of CFLAGS, CXXFLAGS, FFLAGS, LDFLAGS for use within
@@ -147,7 +141,6 @@ for k,_ in pairs(stripped_flags) do print(k .. " ") end
 %__cflags_arch_x86_64_v2 %[0%{?rhel} == 9 ? "-march=x86-64-v2" : ""]
 %__cflags_arch_x86_64_v3 %[0%{?rhel} > 9 ? "-march=x86-64-v3" : ""]
 %__cflags_arch_x86_64 %{__cflags_arch_x86_64_v2} %{__cflags_arch_x86_64_v3}
-%__cflags_arch_x86_64_common -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection %{_frame_pointers_cflags} %{_frame_pointers_cflags_x86_64}
 
 # Also used for s390.
 %__cflags_arch_s390x %[0%{?rhel} >= 9 ? "-march=z14 -mtune=z15" : "-march=z13 -mtune=z14"]
@@ -394,7 +387,7 @@ for k,_ in pairs(stripped_flags) do print(k .. " ") end
 
 # This can be set to a positive integer to obtain increasing type
 # safety levels for C.  See buildflags.md.
-%build_type_safety_c 1
+%build_type_safety_c 0
 
 # Some linkers default to a build-id algorithm that is not supported by rpmbuild,
 # so we need to specify the right algorithm to use.

macros.forge

@@ -0,0 +1,70 @@
+# Computes forge-related variables for use in the rest of the spec file
+# Control variables, flags and arguments:
+#   %{forgeurl<number>}  the project url on the target forge
+#   %{tag<number>}       the packaged tag, OR
+#   %{commit<number>}    the packaged commit, OR
+#   %{version<number>}   the packaged version
+#                          – %{version}/%{version0} are set via:
+#                              Version:
+#                          – because git is lacking a built-in version
+#                            reference, %{version<number>} will be translated
+#                            into %{tag<number>} using unreliable heuristics;
+#                            set %{tag<number>} directly if those fail
+#   %{date<number>}      the packaged timestamp
+#   …                    %forgemeta will compute a huge number of variables:
+#                          — the packager can override it by setting some of
+#                            those before the %forgemeta call
+#                          – use the -i flag to list those variables
+#   -z <number>          only process the zth block of definitions
+#                        "" for the no-suffix block
+#   -i                   list the resulting variable values
+#   -s                   silently ignore problems in %{forgeurl<number>}
+#   -v                   be verbose
+#   -a                   process all sources in one go, instead of using
+#                        separate -z calls
+%forgemeta(z:isva) %{lua:
+local      fedora = require "fedora.common"
+local       forge = require "fedora.srpm.forge"
+local     verbose =  rpm.expand("%{-v}") ~= ""
+local informative =  rpm.expand("%{-i}") ~= ""
+local      silent =  rpm.expand("%{-s}") ~= ""
+local  processall = (rpm.expand("%{-a}") ~= "") and (rpm.expand("%{-z}") == "")
+if processall then
+  for _,s in pairs(fedora.getsuffixes("forgeurl")) do
+    forge.meta(s,verbose,informative,silent)
+  end
+else
+  forge.meta(rpm.expand("%{-z*}"),verbose,informative,silent)
+end
+}
+
+# Unpacks sources computed by %forgemeta
+# Control variables, flags and arguments:
+#   %{forgesource<number>}       the source archive that will be processed
+#   %{forgesetupargs<number>}    %setup arguments
+
+#   -z <number>                  only process the zth block of definitions
+#                                "" for the no-suffix block
+#   -v                           be verbose
+#   -a                   process all sources in one go, instead of using
+#                        separate -z calls
+%forgesetup(z:va) %{lua:
+local fedora = require "fedora.common"
+if (rpm.expand("%{-z}") == "") and (rpm.expand("%{-a}") ~= "") then
+  for _,s in pairs(fedora.getsuffixes("forgesetupargs")) do
+    print(rpm.expand("%setup %{!-v:-q} %{?forgesetupargs" .. s                     .. "}\\n"))
+  end
+else
+  print(  rpm.expand("%setup %{!-v:-q} %{?forgesetupargs" .. rpm.expand("%{-z*}") .. "}\\n"))
+end
+}
+
+# Calls %autosetup using %forgemeta results
+#   – this will probably be removed since it is unsafe in presence of multiple
+#     sources
+# Control variables, flags and arguments:
+#   -z <number>  process the zth block of definitions
+#   -v -N -S -p  relayed to %autosetup
+%forgeautosetup(z:vNS:p:q) %{lua:
+print(rpm.expand("%autosetup %{-v} %{-N} %{?-S} %{?-p} %{?forgesetupargs" .. rpm.expand("%{-z*}") .. "}\\n"))
+}

macros.rpmautospec

@@ -1,16 +0,0 @@
-%autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = tonumber(rpm.expand("%{?_rpmautospec_release_number}%{!?_rpmautospec_release_number:1}"));
-    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
-    print(release_number + base_release_number - 1);
-}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
-%autochangelog %{lua:
-    locale = os.setlocale(nil)
-    os.setlocale("C.utf8")
-    date = os.date("%a %b %d %Y")
-    os.setlocale(locale)
-    packager = rpm.expand("%{?packager}%{!?packager:John Doe <packager@example.com>}")
-    evr = rpm.expand("%{?epoch:%{epoch}:}%{version}-%{release}")
-    print("* " .. date .. " " .. packager .. " - " .. evr .. "\\n")
-    print("- local build")
-}
-

redhat-rpm-config.spec

@@ -4,14 +4,14 @@
 # 2) When making changes, increment the version (in baserelease) by 1.
 #    rpmdev-bumpspec and other tools update the macro below, which is used
 #    in Version: to get the desired effect.
-%global baserelease 270
+%global baserelease 261
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
 Version: %{baserelease}
 Release: 1.0.riscv64%{?dist}
-# config.guess, config.sub are GPL-3.0-or-later WITH Autoconf-exception-generic
+# No version specified.
-License: GPL-1.0-or-later AND GPL-2.0-or-later AND GPL-3.0-or-later WITH Autoconf-exception-generic AND Boehm-GC
+License: GPL+
 URL: https://src.fedoraproject.org/rpms/redhat-rpm-config
 
 # Core rpm settings
@@ -46,10 +46,10 @@ Source107: macros.gap-srpm
 Source150: macros.build-constraints
 Source151: macros.dwz
 Source152: macros.fedora-misc
+Source153: macros.forge
 Source155: macros.ldconfig
 Source156: macros.vpath
 Source157: macros.shell-completions
-Source158: macros.rpmautospec
 
 # Build policy scripts
 # this comes from https://github.com/rpm-software-management/rpm/pull/344
@@ -81,6 +81,7 @@ Source701: brp-strip-lto
 
 # Convenience lua functions
 Source800: common.lua
+Source801: forge.lua
 
 # Documentation
 Source900: buildflags.md
@@ -91,8 +92,6 @@ Requires: coreutils
 
 Requires: efi-srpm-macros
 Requires: fonts-srpm-macros
-# ↓ Provides macros.forge and forge.lua originally shipped by us
-Requires: forge-srpm-macros
 Requires: ghc-srpm-macros
 Requires: go-srpm-macros
 # ↓ Provides kmod.attr originally shipped by us
@@ -107,6 +106,7 @@ Requires: qt5-srpm-macros
 Requires: qt6-srpm-macros
 # rust-srpm-macros v24 contains %%build_rustflags defintion
 Requires: rust-srpm-macros >= 24
+Requires: rpmautospec-rpm-macros
 Requires: package-notes-srpm-macros
 Requires: pyproject-srpm-macros
 
@@ -131,13 +131,10 @@ Requires: %{_bindir}/xargs
 
 # for brp-llvm-compile-lto-elf
 Requires: (llvm if clang)
-Requires: (gawk if clang)
 
 # -fstack-clash-protection and -fcf-protection require GCC 8.
 Conflicts: gcc < 8.0.1-0.22
 
-Obsoletes: rpmautospec-rpm-macros < 0.3.6
-
 Provides: system-rpm-config = %{version}-%{release}
 
 %global rrcdir /usr/lib/rpm/redhat
@@ -174,6 +171,7 @@ install -p -m 644 -t %{buildroot}%{_fileattrsdir} *.attr
 
 mkdir -p %{buildroot}%{_rpmluadir}/fedora/{rpm,srpm}
 install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora common.lua
+install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora/srpm forge.lua
 
 # This trigger is used to decide which version of the annobin plugin for gcc
 # should be used.  See comments in the script for full details.
@@ -238,14 +236,15 @@ install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora common.lua
 %{_rpmconfigdir}/macros.d/macros.build-constraints
 %{_rpmconfigdir}/macros.d/macros.dwz
 %{_rpmconfigdir}/macros.d/macros.fedora-misc
+%{_rpmconfigdir}/macros.d/macros.forge
 %{_rpmconfigdir}/macros.d/macros.ldconfig
-%{_rpmconfigdir}/macros.d/macros.rpmautospec
 %{_rpmconfigdir}/macros.d/macros.shell-completions
 %{_rpmconfigdir}/macros.d/macros.vpath
 %dir %{_rpmluadir}/fedora
 %dir %{_rpmluadir}/fedora/srpm
 %dir %{_rpmluadir}/fedora/rpm
 %{_rpmluadir}/fedora/*.lua
+%{_rpmluadir}/fedora/srpm/*lua
 
 %attr(0755,-,-) %{rrcdir}/redhat-annobin-plugin-select.sh
 %verify(owner group mode) %{rrcdir}/redhat-annobin-cc1
@@ -255,39 +254,11 @@ install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora common.lua
 %doc buildflags.md
 
 %changelog
-* Thu Oct 12 2023 David Abdurachmanov <davidlt@rivosinc.com> - 270-1.0.riscv64
+* Thu Jul 27 2023 David Abdurachmanov <davidlt@rivosinc.com> - 261-1.0.riscv64
 - Add riscv64 to %%gap_arches, %%java_arches, and %%nodejs_arches
 - Set %%_clang_lto_cflags to %%nil as ld.gold is not implemented for riscv64 
   and thus LTO with Clang doesn't work.
 
-* Thu Oct  5 2023 Florian Weimer <fweimer@redhat.com> - 270-1
-- Disable -fstack-clash-protection on riscv64 (#2242327)
-
-* Thu Oct  5 2023 Nikita Popov <npopov@redhat.com> - 269-1
-- Use correct format specifier in brp-llvm-compile-lto-elf
-
-* Fri Sep 29 2023 Nikita Popov <npopov@redhat.com> - 268-1
-- Fix brp-llvm-compile-lto-elf parallelism with hardlinks (#2234024)
-
-* Tue Sep 26 2023 Florian Weimer <fweimer@redhat.com> - 267-1
-- Switch %%build_type_safety_c to 1 (#2142177)
-
-* Thu Sep 07 2023 Maxwell G <maxwell@gtmx.me> - 266-1
-- Split out forge macros to forge-srpm-macros package
-
-* Tue Aug 29 2023 Florian Weimer <fweimer@redhat.com> - 265-1
-- Add support for x86_64_v2, x86_64_v3, x86_64_v4 (#2233093)
-
-* Tue Aug 22 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 264-1
-- Add macros.rpmautospec
-
-* Mon Aug 21 2023 Miroslav Suchy <msuchy@redhat.com> - 263-1
-- Migrate to SPDX
-
-* Wed Aug 02 2023 Charalampos Stratakis <cstratak@redhat.com> - 262-1
-- Strip all extension builder flags except -fexceptions and -fcf-protection
-- https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
-
 * Fri Jul  7 2023 Florian Weimer <fweimer@redhat.com> - 261-1
 - Fix warnings that appear during the build of the llvm package
 

rpmrc

@@ -5,10 +5,7 @@ optflags: i486 %{__global_compiler_flags} -m32 -march=i486 -fasynchronous-unwind
 optflags: i586 %{__global_compiler_flags} -m32 -march=i586 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: i686 %{__global_compiler_flags} -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
 optflags: athlon %{__global_compiler_flags} -m32 -march=athlon -fasynchronous-unwind-tables -fstack-clash-protection
-optflags: x86_64 %{__global_compiler_flags} -m64 %{__cflags_arch_x86_64} %__cflags_arch_x86_64_common
+optflags: x86_64 %{__global_compiler_flags} -m64 %{__cflags_arch_x86_64} -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection %{_frame_pointers_cflags} %{_frame_pointers_cflags_x86_64}
-optflags: x86_64_v2 %{__global_compiler_flags} -m64 -march=x86-64-v2 %__cflags_arch_x86_64_common
-optflags: x86_64_v3 %{__global_compiler_flags} -m64 -march=x86-64-v3 %__cflags_arch_x86_64_common
-optflags: x86_64_v4 %{__global_compiler_flags} -m64 -march=x86-64-v4 %__cflags_arch_x86_64_common
 
 optflags: ppc64le %{__global_compiler_flags} -m64 %{__cflags_arch_ppc64le} -fasynchronous-unwind-tables -fstack-clash-protection
 
@@ -16,7 +13,7 @@ optflags: s390x %{__global_compiler_flags} -m64 %{__cflags_arch_s390x} -fasynchr
 
 optflags: aarch64 %{__global_compiler_flags} -mbranch-protection=standard -fasynchronous-unwind-tables %[ "%{toolchain}" == "gcc" ? "-fstack-clash-protection" : "" ] %{_frame_pointers_cflags} %{_frame_pointers_cflags_aarch64}
 
-optflags: riscv64 %{__global_compiler_flags} -fasynchronous-unwind-tables %{_frame_pointers_cflags}
+optflags: riscv64 %{__global_compiler_flags} -fasynchronous-unwind-tables %[ "%{toolchain}" == "gcc" ? "-fstack-clash-protection" : "" ] %{_frame_pointers_cflags}
 
 # set build arch to fedora buildarches on hardware capable of running it
 # saves having to do rpmbuild --target=

tests/brp-llvm-compile-lto-elf/brp-llvm-compile-lto-elf-test-lib/brp-llvm-compile-lto-elf-test-lib.spec

@@ -18,19 +18,17 @@ Source1: %{name}.h
 
 %build
 
-clang ${CFLAGS} -c %{SOURCE0} -o %{name}.o
+clang ${CFLAGS} -c %{SOURCE0} -o lib.o
-ar cr %{name}.a %{name}.o
+ar cr %{name}.a lib.o
 ranlib %{name}.a
 
 %install
 mkdir -p %{buildroot}%{_libdir}
 mkdir -p %{buildroot}%{_includedir}
 
-%{__install} -p -m 644 -t %{buildroot}%{_libdir} %{name}.o
 %{__install} -p -m 644 -t %{buildroot}%{_libdir} %{name}.a
 %{__install} -p -m 644 -t %{buildroot}%{_includedir} %{SOURCE1}
 
 %files
-%{_libdir}/%{name}.o
 %{_libdir}/%{name}.a
 %{_includedir}/%{name}.h

tests/brp-llvm-compile-lto-elf/brp-llvm-compile-lto-elf-test/brp-llvm-compile-lto-elf-test.spec

@@ -18,9 +18,7 @@ Source0: %{name}.c
 
 %build
 gcc ${CFLAGS} -c %{SOURCE0} -o %{name}.o
-gcc ${LDFLAGS} %{name}.o %{_libdir}/%{name}-lib.a -o %{name}-ar
+gcc ${LDFLAGS} %{name}.o %{_libdir}/%{name}-lib.a -o %{name}
-gcc ${LDFLAGS} %{name}.o %{_libdir}/%{name}-lib.o -o %{name}-obj
 
 %check
-./%{name}-ar | grep "Hello, world!"
+./%{name} | grep "Hello, world!"
-./%{name}-obj | grep "Hello, world!"

tests/extension-builder-flags/main.fmf

@@ -1,5 +0,0 @@
-summary: Test that the extension builder flags contain the proper flags
-require:
-  - redhat-rpm-config
-test: ./runtest.sh
-

tests/extension-builder-flags/runtest.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-set -ex
-# Verify that the extension builder flags are stripped of non-required flags.
-# The flags may appear in random order due to being accessed through a lua
-# associative array.
-for f in %{extension_cflags} %{extension_cxxflags} %{extension_fflags}; do
-  [[ $(rpm --eval "$f") =~ ^[[:space:]]*(-fexceptions -fcf-protection|-fcf-protection -fexceptions)[[:space:]]*$ ]]
-done
-# The extension ldflag should always be empty
-[[ -z $(rpm --eval "%extension_ldflags") ]]