Fix macros.build-constraints' %limit_build

number of CPUs will never be set to less than 1
  this now outputs build flag overrides to be used with %make_build etc.
  add documentation

Signed-off-by: Michel Alexandre Salim <salimma@fedoraproject.org>

brp-fix-pyc-reproducibility

@@ -0,0 +1,18 @@
+#!/bin/bash -e
+
+# If using normal root, avoid changing anything.
+if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
+  exit 0
+fi
+
+# Defined as %py_reproducible_pyc_path macro and passed here as
+# the first command-line argument
+path_to_fix=$1
+
+# First, check that the parser is available:
+if [ ! -x /usr/bin/marshalparser ]; then
+  echo "ERROR: If %py_reproducible_pyc_path is defined, you have to also BuildRequire: /usr/bin/marshalparser !"
+  exit 1
+fi
+
+find "$path_to_fix" -type f -name "*.pyc" | xargs /usr/bin/marshalparser --fix --overwrite

brp-python-bytecompile

@@ -1,6 +1,15 @@
 #!/bin/bash
 errors_terminate=$2
+
+# Usage of %_python_bytecompile_extra is not allowed anymore
+# See: https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation_phase_3
+# Therefore $1 ($default_python) is not needed and is invoked with "" by default.
+# $default_python stays in the arguments for backward compatibility and $extra for the following check:
 extra=$3
+if [ 0$extra -eq 1 ]; then
+    echo -e "%_python_bytecompile_extra is discontinued, use %py_byte_compile instead.\nSee: https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation_phase_3" >/dev/stderr
+    exit 1
+fi
 
 # If using normal root, avoid changing anything.
 if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
@@ -15,14 +24,15 @@ if [ -z "$depth" -o "$depth" -le "1" ]; then
 	exit 0
 fi
 
-# This function now implements Python byte-compilation in two different ways:
+# This function now implements Python byte-compilation in three different ways:
-# Python >= 3.4 uses a new module compileall2 - https://github.com/fedora-python/compileall2
+# Python >= 3.4 and < 3.9 uses a new module compileall2 - https://github.com/fedora-python/compileall2
 # Python < 3.4 (inc. Python 2) uses compileall module from stdlib with some hacks
 # When we drop support for Python 2, we'd be able to use all compileall2 features like:
 # - -s and -p options to manipulate with a path baked into pyc files instead of $real_libdir
 # - -o 0 -o 1 to produce multiple files in one run - each with a different optimization level - instead of $options
 # - removed useless $depth - both compileall and compileall2 are limited by sys.getrecursionlimit()
 # These changes will make this script much simpler
+# In Python >= 3.9, compileall2 was merged back to standard library (compileall) so we can use it directly again.
 function python_bytecompile()
 {
     local options=$1
@@ -34,10 +44,25 @@ function python_bytecompile()
 
 	python_version=$($python_binary -c "import sys; sys.stdout.write('{0.major}{0.minor}'.format(sys.version_info))")
 
+	#
+	# Python 3.9 and higher
+	#
+	if [ "$python_version" -ge 39 ]; then
+
+		[ ! -z $exclude ] && exclude="-x '$exclude'"
+		# -q disables verbose output
+		# -f forces the process to overwrite existing compiled files
+		# -x excludes paths defined by regex
+		# -e excludes symbolic links pointing outside the build root
+		# -x and -e together implements the same functionality as the Filter class below
+		# -s strips $RPM_BUILD_ROOT from the path
+		# -p prepends the leading slash to the path to make it absolute
+		$python_binary -B $options -m compileall -q -f $exclude -s $RPM_BUILD_ROOT -p / -e $RPM_BUILD_ROOT $python_libdir
+
 	#
 	# Python 3.4 and higher
 	#
-	if [ "$python_version" -ge 34 ]; then
+	elif [ "$python_version" -ge 34 ]; then
 
 		[ ! -z $exclude ] && exclude="-x '$exclude'"
 		# /usr/lib/rpm/redhat/ contains compileall2 Python module
@@ -85,14 +110,18 @@ fi
 #
 # Support this by assuming that below each /usr/lib/python$VERSION/, all
 # .pyc/.pyo files are to be compiled for /usr/bin/python$VERSION.
-# 
+#
 # For example, below /usr/lib/python2.6/, we're targeting /usr/bin/python2.6
 # and below /usr/lib/python3.1/, we're targeting /usr/bin/python3.1
 
+# Disable Python hash seed randomization
+# This should help with byte-compilation reproducibility: https://bugzilla.redhat.com/show_bug.cgi?id=1686078
+export PYTHONHASHSEED=0
+
 shopt -s nullglob
-for python_libdir in `find "$RPM_BUILD_ROOT" -type d|grep -E "/usr/lib(64)?/python[0-9]\.[0-9]+$"`;
+for python_libdir in `find "$RPM_BUILD_ROOT" -type d|grep -E "/(usr|app)/lib(64)?/python[0-9]\.[0-9]+$"`;
 do
-	python_binary=/usr/bin/$(basename $python_libdir)
+	python_binary=$(basename $python_libdir)
 	real_libdir=${python_libdir/$RPM_BUILD_ROOT/}
 	echo "Bytecompiling .py files below $python_libdir using $python_binary"
 
@@ -110,35 +139,3 @@ do
 		exit 1
 	fi
 done
-
-
-# Handle other locations in the filesystem using the default python implementation
-# if extra is set to 0, don't do this
-if [ 0$extra -eq 0 ]; then
-	exit 0
-fi
-
-# If we don't have a default python interpreter, we cannot proceed
-default_python=${1:-/usr/bin/python}
-if [ ! -x "$default_python" ]; then
-	exit 0
-fi
-
-# Figure out if there are files to be bytecompiled with the default_python at all
-# this prevents unnecessary default_python invocation
-find "$RPM_BUILD_ROOT" -type f -name "*.py" | grep -Ev "/bin/|/sbin/|/usr/lib(64)?/python[0-9]\.[0-9]|/usr/share/doc" || exit 0
-
-# Generate normal (.pyc) byte-compiled files.
-python_bytecompile "" $default_python "/bin/|/sbin/|/usr/lib(64)?/python[0-9]\.[0-9]|/usr/share/doc" "$RPM_BUILD_ROOT" "$depth" "/"
-if [ $? -ne 0 -a 0$errors_terminate -ne 0 ]; then
-	# One or more of the files had a syntax error
-	exit 1
-fi
-
-# Generate optimized (.pyo) byte-compiled files.
-python_bytecompile "-O" $default_python "/bin/|/sbin/|/usr/lib(64)?/python[0-9]\.[0-9]|/usr/share/doc" "$RPM_BUILD_ROOT" "$depth" "/"
-if [ $? -ne 0 -a 0$errors_terminate -ne 0 ]; then
-	# One or more of the files had a syntax error
-	exit 1
-fi
-exit 0

common.lua

@@ -1,7 +1,46 @@
 -- Convenience Lua functions that can be used within rpm macros
 
--- Set a spec variable
+-- Reads an rpm variable. Unlike a basic rpm.expand("{?foo}"), returns nil if
--- Echo the result if verbose
+-- the variable is unset, which is convenient in lua tests and enables
+-- differentiating unset variables from variables set to ""
+local function read(rpmvar)
+  if not rpmvar or
+    (rpm.expand("%{" .. rpmvar .. "}") == "%{" .. rpmvar .. "}") then
+    return nil
+  else
+    return rpm.expand("%{?" .. rpmvar .. "}")
+  end
+end
+
+-- Returns true if the macro that called this function had flag set
+--   – for example, hasflag("z") would give the following results:
+--     %foo -z bar → true
+--     %foo -z     → true
+--     %foo        → false
+local function hasflag(flag)
+  return (rpm.expand("%{-" .. flag .. "}") ~= "")
+end
+
+-- Returns the argument passed to flag in the macro that called this function
+--  – for example, readflag("z") would give the following results:
+--      %foo -z bar → bar
+--      %foo        → nil
+--      %foo -z ""  → empty string
+--      %foo -z ''  → empty string
+local function readflag(flag)
+  if not hasflag(flag) then
+    return nil
+  else
+    local a = rpm.expand("%{-" .. flag .. "*}")
+    -- Handle "" and '' as empty strings
+    if (a == '""') or (a == "''") then
+      a = ''
+    end
+    return a
+  end
+end
+
+-- Sets a spec variable; echoes the result if verbose
 local function explicitset(rpmvar, value, verbose)
   local value = value
   if (value == nil) or (value == "") then
@@ -9,31 +48,29 @@ local function explicitset(rpmvar, value, verbose)
   end
   rpm.define(rpmvar .. " " .. value)
   if verbose then
-    rpm.expand("%{echo:Setting %%{" .. rpmvar .. "} = " .. value .. "}")
+    rpm.expand("%{warn:Setting %%{" .. rpmvar .. "} = " .. value .. "}")
   end
 end
 
--- Unset a spec variable if it is defined
+-- Unsets a spec variable if it is defined; echoes the result if verbose
--- Echo the result if verbose
 local function explicitunset(rpmvar, verbose)
   if (rpm.expand("%{" .. rpmvar .. "}") ~= "%{" .. rpmvar .. "}") then
     rpm.define(rpmvar .. " %{nil}")
     if verbose then
-      rpm.expand("%{echo:Unsetting %%{" .. rpmvar .. "}}")
+      rpm.expand("%{warn:Unsetting %%{" .. rpmvar .. "}}")
     end
   end
 end
 
--- Set a spec variable, if not already set
+-- Sets a spec variable, if not already set; echoes the result if verbose
--- Echo the result if verbose
 local function safeset(rpmvar, value, verbose)
   if (rpm.expand("%{" .. rpmvar .. "}") == "%{" .. rpmvar .. "}") then
     explicitset(rpmvar,value,verbose)
   end
 end
 
--- Alias a list of rpm variables to the same variables suffixed with 0 (and vice versa)
+-- Aliases a list of rpm variables to the same variables suffixed with 0 (and
--- Echo the result if verbose
+-- vice versa); echoes the result if verbose
 local function zalias(rpmvars, verbose)
   for _, sfx in ipairs({{"","0"},{"0",""}}) do
     for _, rpmvar in ipairs(rpmvars) do
@@ -113,13 +150,7 @@ local function getbestsuffix(rpmvar, value)
   return best
 end
 
--- https://github.com/rpm-software-management/rpm/issues/581
+-- %writevars core
--- Writes the content of a list of rpm variables to a macro spec file.
--- The target file must contain the corresponding anchors.
--- For example writevars("myfile", {"foo","bar"}) will replace:
---   @@FOO@@ with the rpm evaluation of %{foo} and
---   @@BAR@@ with the rpm evaluation of %{bar}
--- in myfile
 local function writevars(macrofile, rpmvars)
   for _, rpmvar in ipairs(rpmvars) do
     print("sed -i 's\029" .. string.upper("@@" .. rpmvar .. "@@") ..
@@ -150,8 +181,9 @@ local function wordwrap(text)
     for word in string.gmatch(line, "%s*[^%s]*\n?") do
       local wl, bad = utf8.len(word)
       if not wl then
-        print("%{warn: Invalid UTF-8 sequence detected in:\n" ..
+        print("%{warn:Invalid UTF-8 sequence detected in:}" ..
-               word .. "\nIt may produce unexpected results.\n}")
+              "%{warn:" .. word .. "}" ..
+              "%{warn:It may produce unexpected results.}")
         wl = bad
       end
       if (pos == 0) then
@@ -182,7 +214,71 @@ local function wordwrap(text)
   return output
 end
 
+-- Because rpmbuild will fail if a subpackage is declared before the source
+-- package itself, provide a source package declaration shell as fallback.
+local function srcpkg(verbose)
+  if verbose then
+    rpm.expand([[
+%{echo:Creating a header for the SRPM from %%{source_name}, %%{source_summary} and}
+%{echo:%%{source_description}. If that is not the intended result, please declare the}
+%{echo:SRPM header and set %%{source_name} in your spec file before calling a macro}
+%{echo:that creates other package headers.}
+]])
+  end
+  print(rpm.expand([[
+Name:           %{source_name}
+Summary:        %{source_summary}
+%description
+%wordwrap -v source_description
+]]))
+  explicitset("currentname", "%{source_name}", verbose)
+end
+
+-- %new_package core
+local function new_package(source_name, pkg_name, name_suffix, first, verbose)
+  -- Safety net when the wrapper is used in conjunction with traditional syntax
+  if (not first) and (not source_name) then
+    rpm.expand([[
+%{warn:Something already set a package name. However, %%{source_name} is not set.}
+%{warn:Please set %%{source_name} to the SRPM name to ensure reliable processing.}
+]])
+    if name_suffix then
+      print(rpm.expand("%package        " .. name_suffix))
+    else
+      print(rpm.expand("%package     -n " .. pkg_name))
+    end
+    return
+  end
+  -- New processing
+  if not (pkg_name or name_suffix or source_name) then
+    rpm.expand([[
+%{error:You need to set %%{source_name} or provide explicit package naming!}
+]])
+  end
+  if name_suffix then
+    print(rpm.expand("%package        "  .. name_suffix))
+    explicitset("currentname", "%{source_name}-" .. name_suffix, verbose)
+  else
+    if not source_name then
+      source_name = pkg_name
+    end
+    if (pkg_name == source_name) then
+      safeset("source_name", source_name, verbose)
+      print(rpm.expand("Name:           %{source_name}"))
+    else
+      if source_name and first then
+        srcpkg(verbose)
+      end
+      print(rpm.expand("%package     -n " .. pkg_name))
+    end
+    explicitset("currentname", pkg_name, verbose)
+  end
+end
+
 return {
+  read          = read,
+  hasflag       = hasflag,
+  readflag      = readflag,
   explicitset   = explicitset,
   explicitunset = explicitunset,
   safeset       = safeset,
@@ -194,4 +290,5 @@ return {
   getbestsuffix = getbestsuffix,
   writevars     = writevars,
   wordwrap      = wordwrap,
+  new_package   = new_package,
 }

dist.sh

@@ -25,7 +25,7 @@ function check_rhl {
 }
 
 function check_rhel {
-    egrep -q "(Enterprise|Advanced)" $RELEASEFILE && echo $DISTNUM
+    egrep -q "(Enterprise|Advanced|CentOS)" $RELEASEFILE && echo $DISTNUM
 }
 
 function check_fedora {

forge.lua

@@ -31,6 +31,9 @@ local function checkforgeurl(url, id, silent)
     pagure_ns_fork = {
       pattern     = 'https://[^/]+/fork/[^/]+/[^/]+/[^/#?]+',
       description = 'https://pagure.io/fork/owner/namespace/repo'},
+    ["gitea.com"] = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://gitea.com/owner/repo'},
     github = {
       pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
       description = 'https://(…[-.])github[-.]…/owner/repo'},
@@ -129,6 +132,11 @@ local function meta(suffix, verbose, informative, silent)
       repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/[^/]+/[^/]+/([^/?#]+)")}',
       archivename = "%{owner"        .. suffix .. "}-%{namespace"     .. suffix .. "}-%{repo"        .. suffix .. "}-%{ref"        .. suffix .. "}",
       archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    ["gitea.com"] = {
+      archiveext  = "tar.gz",
+      archivename = "%{fileref"      .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}.%{archiveext" .. suffix .. "}",
+      topdir      = "%{repo}" },
     github = {
       archiveext  = "tar.gz",
       archivename = "%{repo"         .. suffix .. "}-%{fileref"       .. suffix .. "}",
@@ -191,6 +199,11 @@ local function meta(suffix, verbose, informative, silent)
         fileref = string.gsub(rpm.expand(fileref), "/", "-")
       end
       fedora.safeset("fileref" .. suffix, fileref, verbose)
+    elseif (forge == "gitea.com") then
+      -- Workaround the way gitea mangles /s in ref names
+      local fileref = ref
+      fileref = string.gsub(rpm.expand(fileref), "/", "-")
+      fedora.safeset("fileref" .. suffix, fileref, verbose)
     elseif (forge == "code.googlesource.com") then
       if (ref == "%{?version"  .. suffix .. "}") then
         ref = "v" .. ref

kmod.attr

@@ -1,2 +1,21 @@
-%__kmod_provides       %{_rpmconfigdir}/kmod.prov
+%__kmod_path           ^/lib/modules/.*/(modules.builtin|.*ko)
-%__kmod_path           ^/lib/modules/.*$
+%__kmod_provides() %{lua:
+  function basename(fn)
+      return string.gsub(fn, "(.*/)(.*)", "%2")
+  end
+  function printdep(mod)
+      print("kmod("..mod..")")
+  end
+  local fn = rpm.expand("%{1}")
+  local bn = basename(fn)
+  if bn == "modules.builtin" then
+      for l in io.lines(fn) do
+          printdep(basename(l))
+      end
+  else
+      local mod = string.match(bn, "%g+.ko")
+      if mod then
+         printdep(mod)
+      end
+  end
+}

kmod.prov

@@ -1,28 +0,0 @@
-#!/bin/sh +x
-# Kernel build can have many thousands of modules.
-# kmod.prov is run for every one of them.
-# Try to make this script run as fast as we can.
-# For example, use shell string ops instead of external programs
-# where possible.
-
-IFS=$'\n'
-
-read -r fname || exit
-
-# Only process files from .../lib/modules/... subtree
-[ "${fname#*/lib/modules/*}" != "$fname" ] || exit 0
-
-kmod=${fname##*/}  # like basename, but faster
-
-if [ "$kmod" = "modules.builtin" ]; then
-        for j in $(cat -- "$fname"); do
-                echo "kmod(${j##*/})"
-        done
-        exit 0
-fi
-
-kmod=${kmod%.gz}
-kmod=${kmod%.xz}
-if [ "${kmod%.ko}" != "$kmod" ]; then
-        echo "kmod($kmod)"
-fi

macros

@@ -26,6 +26,46 @@
 %_debugsource_packages  1
 %_debuginfo_subpackages 1
 
+# GCC toolchain
+%__cc_gcc gcc
+%__cxx_gcc g++
+%__cpp_gcc gcc -E
+
+# Clang toolchain
+%__cc_clang clang
+%__cxx_clang clang++
+%__cpp_clang clang-cpp
+
+# Default to the GCC toolchain
+#
+# It is enough to override `toolchain` macro and all relevant macro for C/C++
+# compilers will be switched. Either in the spec or in the command-line.
+#
+#     %global toolchain clang
+#
+# or:
+#
+#     rpmbuild -D "toolchain clang" …
+#
+# Inside a spec file it is also possible to determine which toolchain is in use
+# by testing the same macro. For example:
+#
+#     %if "%{toolchain}" == "gcc"
+#     BuildRequires: gcc
+#     %endif
+#
+# or:
+#
+#     %if "%{toolchain}" == "clang"
+#     BuildRequires: clang compiler-rt
+#     %endif
+#
+%toolchain gcc
+
+%__cc %{expand:%%{__cc_%{toolchain}}}
+%__cxx %{expand:%%{__cxx_%{toolchain}}}
+%__cpp %{expand:%%{__cpp_%{toolchain}}}
+
 #==============================================================================
 # ---- compiler flags.
 
@@ -46,9 +86,12 @@
 # the flags, while intended for ld, are still passed through the gcc
 # compiler driver.  At the beginning of %%build, the environment
 # variable RPM_LD_FLAGS to this value.
-%build_ldflags -Wl,-z,relro %{_ld_as_needed_flags} %{_ld_symbols_flags} %{_hardened_ldflags}
+# When clang is used as a linker driver, it does not auto-detect the LTO
+# bytecode and neither does bfd, so we need to explicitly pass the -flto
+# flag when linking.
+%build_ldflags -Wl,-z,relro %{_ld_as_needed_flags} %{_ld_symbols_flags} %{_hardened_ldflags} %[ "%{toolchain}" == "clang" ? "%{?_lto_cflags}" : "" ]
 
-# Expands to shell code to seot the compiler/linker environment
+# Expands to shell code to set the compiler/linker environment
 # variables CFLAGS, CXXFLAGS, FFLAGS, FCFLAGS, LDFLAGS if they have
 # not been set already.  RPM_OPT_FLAGS and RPM_LD_FLAGS have already
 # been set implicitly at the start of the %%build section.
@@ -59,14 +102,18 @@
   FFLAGS="${FFLAGS:-%{build_fflags}}" ; export FFLAGS ; \
   FCFLAGS="${FCFLAGS:-%{build_fflags}}" ; export FCFLAGS ; \
   LDFLAGS="${LDFLAGS:-%{build_ldflags}}" ; export LDFLAGS ; \
-  LT_SYS_LIBRARY_PATH="${LT_SYS_LIBRARY_PATH:-%_libdir:}" ; export LT_SYS_LIBRARY_PATH
+  LT_SYS_LIBRARY_PATH="${LT_SYS_LIBRARY_PATH:-%_libdir:}" ; export LT_SYS_LIBRARY_PATH ; \
+  CC="${CC:-%{__cc}}" ; export CC ; \
+  CXX="${CXX:-%{__cxx}}" ; export CXX
 
 # Internal-only.  Do not use.  Expand a variable and strip the flags
 # not suitable to extension builders.
 %__extension_strip_flags() %{lua:
 local name = rpm.expand("%{1}")
 local value = " " .. rpm.expand("%{build_" .. name .. "}")
-local result = string.gsub(value, "%s+-specs=[^%s]+", " ")
+local specs_pattern = "%s+-specs=[^%s]+"
+local lto_flags_pattern = rpm.expand("%{?_lto_cflags}"):gsub("[%-%.]", "%%%1")
+local result = value:gsub(specs_pattern, " "):gsub(lto_flags_pattern, "")
 print(result)
 }
 
@@ -94,8 +141,49 @@ print(result)
 # Eventually we'll want to turn this on by default, but this gives packagers a
 # way to turn it back off.
 # %_configure_disable_silent_rules 1
+
+# This fixes various easy resolved configure tests that are compromised by LTO.
+#
+# We use this within the standard %configure macro, but also make it available
+# for packages which don't use %configure
+#
+# The first three are common ways to test for the existence of a function, so
+# we ensure the reference to the function is preserved
+#
+# The fourth are constants used to then try to generate NaNs and other key
+# floating point numbers.  We then use those special FP numbers to try and
+# raise a SIGFPE.  By declaring x & y volatile we prevent the optimizers
+# from removing the computation
+#
+# The fifth (and worst) addresses problems with autoconf/libtool's approach
+# to extracting symbols from .o files and generating C code.  In an LTO world
+# types matter much more closely and you can't have an object in one context
+# that is a function definition and a simple scalar variable in another.
+# Thankfully HP-UX has always had that restriction and is supported by
+# autoconf/libtool.  The insane sed script replaces the "generic" code with
+# the HP-UX version.
+#
+# If we do not make changes, we put the original file back.  This avoids
+# unnecessary rebuilds of things that may have dependencies on the configure
+# files.
+#
+%_fix_broken_configure_for_lto \
+  for file in $(find . -type f -name configure -print); do \
+    %{__sed} -r --in-place=.backup 's/^char \\(\\*f\\) \\(\\) = /__attribute__ ((used)) char (*f) () = /g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} -r --in-place=.backup 's/^char \\(\\*f\\) \\(\\);/__attribute__ ((used)) char (*f) ();/g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} -r --in-place=.backup 's/^char \\$2 \\(\\);/__attribute__ ((used)) char \\$2 ();/g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} --in-place=.backup '1{$!N;$!N};$!N;s/int x = 1;\\nint y = 0;\\nint z;\\nint nan;/volatile int x = 1; volatile int y = 0; volatile int z, nan;/;P;D' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} --in-place=.backup 's#^lt_cv_sys_global_symbol_to_cdecl=.*#lt_cv_sys_global_symbol_to_cdecl="sed -n -e '"'"'s/^T .* \\\\(.*\\\\)$/extern int \\\\1();/p'"'"' -e '"'"'s/^$symcode* .* \\\\(.*\\\\)$/extern char \\\\1;/p'"'"'"#' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+  done
+
 %configure \
   %{set_build_flags}; \
+  [ "%{_lto_cflags}"x != x ] && %{_fix_broken_configure_for_lto}; \
   [ "%_configure_gnuconfig_hack" = 1 ] && for i in $(find $(dirname %{_configure}) -name config.guess -o -name config.sub) ; do \
       [ -f /usr/lib/rpm/redhat/$(basename $i) ] && %{__rm} -f $i && %{__cp} -fv /usr/lib/rpm/redhat/$(basename $i) $i ; \
   done ; \
@@ -149,7 +237,8 @@ print(result)
 %__brp_strip_lto /usr/lib/rpm/redhat/brp-strip-lto %{__strip}
 %__brp_strip_comment_note /usr/lib/rpm/brp-strip-comment-note %{__strip} %{__objdump}
 %__brp_strip_static_archive /usr/lib/rpm/brp-strip-static-archive %{__strip}
-%__brp_python_bytecompile /usr/lib/rpm/redhat/brp-python-bytecompile "%{__python}" "%{?_python_bytecompile_errors_terminate_build}" "%{?_python_bytecompile_extra}"
+%__brp_python_bytecompile /usr/lib/rpm/redhat/brp-python-bytecompile "" "%{?_python_bytecompile_errors_terminate_build}" "%{?_python_bytecompile_extra}"
+%__brp_fix_pyc_reproducibility /usr/lib/rpm/redhat/brp-fix-pyc-reproducibility
 %__brp_python_hardlink /usr/lib/rpm/brp-python-hardlink
 # __brp_mangle_shebangs_exclude - shebangs to exclude
 # __brp_mangle_shebangs_exclude_file - file from which to get shebangs to exclude
@@ -167,6 +256,7 @@ print(result)
     %{?__brp_strip_lto} \
     %{?__brp_strip_static_archive} \
     %{?py_auto_byte_compile:%{?__brp_python_bytecompile}} \
+    %{?py_reproducible_pyc_path:%{?__brp_fix_pyc_reproducibility} "%{py_reproducible_pyc_path}"} \
     %{?__brp_python_hardlink} \
     %{?__brp_mangle_shebangs} \
 %{nil}
@@ -202,24 +292,27 @@ print(result)
 # Use Zstandard compression for binary payloads
 %_binary_payload w19.zstdio
 
-%_hardening_cflags	-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
+%_hardening_gcc_cflags   -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
+%_hardening_clang_cflags --config /usr/lib/rpm/redhat/redhat-hardened-clang.cfg
+%_hardening_cflags	 %{expand:%%{_hardening_%{toolchain}_cflags}} -fstack-protector-strong
 # we don't escape symbols '~', '"', etc. so be careful when changing this
-%_hardening_ldflags	-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
+%_hardening_ldflags	 -Wl,-z,now %[ "%{toolchain}" == "gcc" ? "-specs=/usr/lib/rpm/redhat/redhat-hardened-ld" : "" ]
 
-# Harden packages by default for Fedora 23:
+# Harden packages by default for Fedora 23+:
 # https://fedorahosted.org/fesco/ticket/1384 (accepted on 2014-02-11)
 # Use "%undefine _hardened_build" to disable.
 %_hardened_build	1
 %_hardened_cflags	%{?_hardened_build:%{_hardening_cflags}}
 %_hardened_ldflags	%{?_hardened_build:%{_hardening_ldflags}}
 
-%_annobin_cflags	-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1
+# Add extra information to binary objects created by the compiler:
-
-# Add extra information to binary objects created by gcc for Fedora 28:
 # https://pagure.io/fesco/issue/1780 (accepted on 2017-10-30)
 # Use "%undefine _annotated_build" to disable.
 %_annotated_build	1
-%_annotated_cflags	%{?_annotated_build:%{_annobin_cflags}}
+%_annobin_gcc_plugin	-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1
+# The annobin plugin is not built for clang yet
+%_annobin_clang_plugin	%dnl-fplugin=/usr/lib64/clang/`clang -dumpversion`/lib/annobin.so
+%_annotation_cflags     %{?_annotated_build:%{expand:%%{_annobin_%{toolchain}_plugin}}}
 
 # Fail linking if there are undefined symbols.  Required for proper
 # ELF symbol versioning support.  Disabled by default.
@@ -232,7 +325,27 @@ print(result)
 %_ld_as_needed		1
 %_ld_as_needed_flags	%{?_ld_as_needed:-Wl,--as-needed}
 
-%__global_compiler_flags	-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches %{_hardened_cflags} %{_annotated_cflags}%{?_legacy_common_support: -fcommon}
+# LTO is the default in Fedora.
+#   "%define _lto_cflags %{nil}"  to opt out
+#
+# We currently have -ffat-lto-objects turned on out of an abundance of
+# caution.  To remove it we need to do a check of the installed .o/.a files
+# to verify they have real sections/symbols after LTO stripping.  That
+# way we can detect installing an unusable .o/.a file.  This is on the TODO
+# list for F34.
+%_gcc_lto_cflags	-flto=auto -ffat-lto-objects
+%_clang_lto_cflags	-flto
+%_lto_cflags		%{expand:%%{_%{toolchain}_lto_cflags}}
+
+%_general_options       -O2 %{?_lto_cflags} -fexceptions -g -grecord-gcc-switches -pipe
+%_warning_options       -Wall -Werror=format-security
+%_preprocessor_defines  -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS
+
+# Common variables are no longer generated by default by gcc and clang
+# If they are needed then add "%define _legacy_common_support 1" to the spec file.
+%_legacy_options	%{?_legacy_common_support: -fcommon}
+
+%__global_compiler_flags %{_general_options} %{_warning_options} %{_preprocessor_defines} %{_hardened_cflags} %{_annotation_cflags} %{_legacy_options}
 
 # Automatically trim changelog entries after 2 years
 %_changelog_trimtime	%{lua:print(os.time() - 2 * 365 * 86400)}
@@ -269,6 +382,3 @@ print(result)
 %global __find_provides /bin/sh -c "%{?__filter_prov_cmd} %{__deploop P} %{?__filter_from_prov}" \
 %global __find_requires /bin/sh -c "%{?__filter_req_cmd}  %{__deploop R} %{?__filter_from_req}" \
 }
-
-# Temporary shelter for rpm 4.15 refugees
-%requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")

macros.build-constraints

@@ -0,0 +1,42 @@
+# Macros to constrain resource use during the build process
+
+# outputs build flag overrides to be used in conjunction with
+# %%make_build, %%cmake_build etc.
+#
+# if no override is needed, this macro outputs nothing
+#
+# - m   memory limit in MBs per core; default is 1024
+#
+# Usage:
+# e.g. %make_build %{limit_build -m 2048}
+#   => /usr/bin/make -O -j16 V=1 VERBOSE=1
+#      %make_build %{limit_build -m 40960}
+#   => /usr/bin/make -O -j16 V=1 VERBOSE=1 -j1
+# 
+%limit_build(m:) %{lua:
+  local mem_per_process=rpm.expand("%{-m*}")
+  if mem_per_process == "" then
+    mem_per_process = 1024
+  else
+    mem_per_process = tonumber(mem_per_process)
+  end
+  local mem_total = 0
+  for line in io.lines('/proc/meminfo') do
+    if line:sub(1, 9) == "MemTotal:" then
+      local tokens = {}
+      for token in line:gmatch("%w+") do
+        tokens[#tokens + 1] = token
+      end
+      mem_total = tonumber(tokens[2])
+      break
+    end
+  end
+  local max_jobs = mem_total // (mem_per_process * 1024)
+  if max_jobs < 1 then
+    max_jobs = 1
+  end
+  cur_max_jobs=tonumber(rpm.expand("%{_smp_build_ncpus}"))
+  if cur_max_jobs > max_jobs then
+    print("-j" .. max_jobs)
+  end
+}

macros.fedora-misc

@@ -1,16 +1,16 @@
-# Some miscellaneous Fedora-related macros
+# Fedora macros, safe to use after the SRPM build stage
 
-# List files matching inclusion globs, excluding files matching exclusion blogs
+# Lists files matching inclusion globs, excluding files matching exclusion
-# Optional parameters:
+# globs
-#  – -i "<globs>" inclusion globs
+#   – globs are space-separated lists of shell globs. Such lists require
-#  – -x "<globs>" exclusion globs
+#     %{quote:} use when passed as rpm arguments or flags.
-# Globs are space-separated lists of shell globs. Such lists require %{quote:}
+# Control variables, flags and arguments:
-# use for safe rpm argument passing.
+#   %{listfiles_include}  inclusion globs
-# Alternatively, set the following rpm variables before calling the macro:
+#   %{listfiles_exclude}  exclusion globs
-#  – “listfiles_include” inclusion globs
+#   -i <globs>            inclusion globs
-#  — “listfiles_exclude” exclusion globs
+#   -x <globs>            exclusion globs
-# Arguments passed to the macro without flags will be interpreted as inclusion
+#   …                     arguments passed to the macro without flags will be
-# globs.
+#                         interpreted as inclusion globs
 %listfiles(i:x:) %{expand:
 %if %{lua: print(string.len(rpm.expand("%{?-i*}%{?listfiles_include}%*")))}
   listfiles_include=$(realpath -e --relative-base=. %{?-i*} %{?listfiles_include} %* | sort -u)
@@ -26,12 +26,14 @@
 }
 
 # https://github.com/rpm-software-management/rpm/issues/581
-# Write the contents of a list of rpm variables to a macro file.
+# Writes the contents of a list of rpm variables to a macro file
-# The target file must contain the corresponding anchors.
+# Control variables, flags and arguments:
-# For example %writevars -f myfile foo bar will replace:
+#   -f <filename>  the macro file to process:
-#  @@FOO@@ with the rpm evaluation of %{foo} and
+#                    – it must contain corresponding anchors
-#  @@BAR@@ with the rpm evaluation of %{bar}
+#                    – for example %writevars -f myfile foo bar will replace:
-# in myfile
+#                        @@FOO@@ with the rpm evaluation of %{foo} and
+#                        @@BAR@@ with the rpm evaluation of %{bar}
+#                      in myfile
 %writevars(f:) %{lua:
 local    fedora = require "fedora.common"
 local macrofile = rpm.expand("%{-f*}")

macros.fedora-misc-srpm

@@ -1,4 +1,4 @@
-# Some miscellaneous Fedora-related macros
+# Fedora macros, safe to use at SRPM build stage
 
 # A directory for rpm macros
 %rpmmacrodir /usr/lib/rpm/macros.d
@@ -10,13 +10,34 @@
 # A directory for SWID tag files describing the installation
 %_swidtagdir %{_prefix}/lib/swidtag/fedoraproject.org
 
-# A helper to apply the fedora.wordwrap filter to the content of an rpm
+# Applies the fedora.wordwrap filter to the content of an rpm variable, and
-# variable, and print the result. Optional parameter:
+# prints the result.
-#  – -v <variable_name> (default value: _description)
+#   – putting multiple lines of UTF-8 text inside a variable is usually
-# Putting multiple lines of UTF-8 text inside a variable is usually
+#     accomplished with %{expand:some_text}
-# accomplished with a %%{expand: some_text}.
+# Control variables, flags and arguments:
+#   -v <variable_name>  (default value: _description)
 %wordwrap(v:) %{lua:
 local   fedora = require "fedora.common"
-local variable = "%{" .. rpm.expand("%{-v*}%{!-v:_description}") .. "}"
+local variable = "%{?" .. rpm.expand("%{-v*}%{!-v:_description}") .. "}"
 print(fedora.wordwrap(variable))
 }
+
+# A single Name: and %package substitute
+# Control variables, flags and arguments:
+#   %{source_name}         the SRPM name
+#   %{source_summary}      the SRPM summary
+#   %{source_description}  the SRPM description
+#   -n <name>              declare a package named <name>
+#                          (%package-like behavior)
+#   -v                     be verbose
+#   %1                     declare a package named %{source_name}-%{%1}
+#                          (%package-like behavior)
+%new_package(n:v) %{lua:
+local      fedora = require "fedora.common"
+local    pkg_name = fedora.readflag("n")
+local     verbose = fedora.hasflag("v")
+local name_suffix = fedora.read("1")
+local source_name = fedora.read("source_name")
+local       first = not ( fedora.read("name") or fedora.read("currentname") )
+fedora.new_package(source_name, pkg_name, name_suffix, first, verbose)
+}

macros.forge

@@ -1,50 +1,28 @@
-# Map forge information to rpm metadata. This macro will compute default spec
+# Computes forge-related variables for use in the rest of the spec file
-# variable values.
+# Control variables, flags and arguments:
-#
+#   %{forgeurl<number>}  the project url on the target forge
-# The following spec variables SHOULD be set before calling the macro:
+#   %{tag<number>}       the packaged tag, OR
-#
+#   %{commit<number>}    the packaged commit, OR
-#   forgeurl  the project url on the forge, strongly recommended;
+#   %{version<number>}   the packaged version
-#   Version   if applicable, set it with Version: <version>
+#                          – %{version}/%{version0} are set via:
-#   tag       if applicable
+#                              Version:
-#   commit    if applicable
+#                          – because git is lacking a built-in version
-#   date      if applicable (to override the mtime of the Source archive)
+#                            reference, %{version<number>} will be translated
-#
+#                            into %{tag<number>} using unreliable heuristics;
-#  Use -z for multiple calls to the macro
+#                            set %{tag<number>} directly if those fail
-#
+#   %{date<number>}      the packaged timestamp
-# The macro will attempt to compute and set the following variables if they are
+#   …                    %forgemeta will compute a huge number of variables:
-# not already set by the packager:
+#                          — the packager can override it by setting some of
-#
+#                            those before the %forgemeta call
-#   forgesource    an URL that can be used as SourceX: value
+#                          – use the -i flag to list those variables
-#   forgesetupargs the correct arguments to pass to %setup for this source
+#   -z <number>          only process the zth block of definitions
-#                  used by %forgesetup and %forgeautosetup
+#                        "" for the no-suffix block
-#   archivename    the source archive filename, without extentions
+#   -i                   list the resulting variable values
-#   archiveext     the source archive filename extensions, without leading dot
+#   -s                   silently ignore problems in %{forgeurl<number>}
-#   archiveurl     the url that can be used to download the source archive,
+#   -v                   be verbose
-#                  without renaming
+#   -a                   process all sources in one go, instead of using
-#   topdir         the source archive top directory (can be empty)
+#                        separate -z calls
-#   extractdir     the source directory created inside %{_builddir} after using
+%forgemeta(z:isva) %{lua:
-#                  %%forgesetup, %forgeautosetup or %{forgesetupargs}
-#   repo           the repository name
-#   owner          the repository owner (if used by another computed variable)
-#   shortcommit    the commit hash clamping used by the forge, if any
-#   scm            the scm type, when packaging code snapshots: commits or tags
-#   distprefix     the prefix that needs adding to dist to trace non-release packaging
-#
-# Most of the computed variables are both overridable and optional.
-#
-# Optional parameters:
-#   -a          process all sources in one go, instead of using separate -z calls
-#   -z <number> suffix all the read and written variable names with <number>
-#               for example read     forgeurl<number>, version<number>…
-#                       and generate forgesetupargs<number>, archiveurl<number>…
-#               The macro assumes that null or nil suffix is used for the primary
-#               package source.
-#   -s  Silently ignore problems in forgeurl, use it if it can be parsed,
-#       ignore it otherwise.
-#   -v  Be verbose and print every spec variable the macro sets.
-#   -i  Print some info about the state of spec variables the macro may use or
-#       set at the end of the processing.
-%forgemeta(az:sviu:) %{lua:
 local      fedora = require "fedora.common"
 local       forge = require "fedora.srpm.forge"
 local     verbose =  rpm.expand("%{-v}") ~= ""
@@ -60,12 +38,17 @@ else
 end
 }
 
-# Convenience macro to relay computed arguments to %setup
+# Unpacks sources computed by %forgemeta
-# Optional parameters:
+# Control variables, flags and arguments:
-#   -a          process all sources in one go, instead of using separate -z calls
+#   %{forgesource<number>}       the source archive that will be processed
-#   -z <number> read %{?forgesetupargs<number>}
+#   %{forgesetupargs<number>}    %setup arguments
-#   -v          be verbose
+
-%forgesetup(az:v) %{lua:
+#   -z <number>                  only process the zth block of definitions
+#                                "" for the no-suffix block
+#   -v                           be verbose
+#   -a                   process all sources in one go, instead of using
+#                        separate -z calls
+%forgesetup(z:va) %{lua:
 local fedora = require "fedora.common"
 if (rpm.expand("%{-z}") == "") and (rpm.expand("%{-a}") ~= "") then
   for _,s in pairs(fedora.getsuffixes("forgesetupargs")) do
@@ -76,10 +59,12 @@ else
 end
 }
 
-# Convenience macro to relay computed arguments to %autosetup
+# Calls %autosetup using %forgemeta results
-# Parameters relayed to %autosetup: -v -N -S -p
+#   – this will probably be removed since it is unsafe in presence of multiple
-# Optional parameters:
+#     sources
-#   -z <number> read %{?forgesetupargs<number>}
+# Control variables, flags and arguments:
+#   -z <number>  process the zth block of definitions
+#   -v -N -S -p  relayed to %autosetup
 %forgeautosetup(z:vNS:p:q) %{lua:
 print(rpm.expand("%autosetup %{-v} %{-N} %{?-S} %{?-p} %{?forgesetupargs" .. rpm.expand("%{-z*}") .. "}\\n"))
 }

redhat-hardened-clang.cfg

@@ -0,0 +1 @@
+-fPIE

redhat-rpm-config.spec

@@ -6,8 +6,8 @@
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
-Version: 153
+Version: 176
-Release: 1%{?dist}
+Release: 3%{?dist}
 # No version specified.
 License: GPL+
 URL: https://src.fedoraproject.org/rpms/redhat-rpm-config
@@ -19,9 +19,10 @@ Source1: rpmrc
 # gcc specs files for hardened builds
 Source50: redhat-hardened-cc1
 Source51: redhat-hardened-ld
+Source52: redhat-hardened-clang.cfg
 
 # gcc specs files for annobin builds
-Source52: redhat-annobin-cc1
+Source60: redhat-annobin-cc1
 
 # The macros defined by these files are for things that need to be defined
 # at srpm creation time when it is not feasible to require the base packages
@@ -35,12 +36,13 @@ Source104: macros.ldc-srpm
 Source105: macros.valgrind-srpm
 
 # Other misc macros
-Source150: macros.dwz
+Source150: macros.build-constraints
-Source151: macros.kmp
+Source151: macros.dwz
-Source152: macros.vpath
+Source152: macros.fedora-misc
 Source153: macros.forge
-Source154: macros.ldconfig
+Source154: macros.kmp
-Source155: macros.fedora-misc
+Source155: macros.ldconfig
+Source156: macros.vpath
 
 # Build policy scripts
 # this comes from https://github.com/rpm-software-management/rpm/pull/344
@@ -52,6 +54,10 @@ Source201: brp-mangle-shebangs
 # however, now we can do Fedora changes within
 Source202: brp-python-bytecompile
 
+# for fixing pyc files reproducibility with marshalparser
+# https://github.com/fedora-python/marshalparser
+Source203: brp-fix-pyc-reproducibility
+
 # Dependency generator scripts (deprecated)
 Source300: find-provides
 Source301: find-provides.ksyms
@@ -73,7 +79,6 @@ Source501: config.sub
 
 # Dependency generators & their rules
 Source600: kmod.attr
-Source601: kmod.prov
 Source602: libsymlink.attr
 
 # BRPs
@@ -97,19 +102,22 @@ Requires: fpc-srpm-macros
 Requires: ghc-srpm-macros
 Requires: gnat-srpm-macros
 Requires: go-srpm-macros
+Requires: kernel-srpm-macros
+Requires: lua-srpm-macros
 Requires: nim-srpm-macros
 Requires: ocaml-srpm-macros
 Requires: openblas-srpm-macros
 Requires: perl-srpm-macros
 # ↓ Provides compileall2 Python module
 Requires: python-srpm-macros >= 3-46
-Requires: rust-srpm-macros
 Requires: qt5-srpm-macros
+Requires: rust-srpm-macros
+Requires: rpmautospec-rpm-macros
 
 Requires: rpm >= 4.11.0
 Requires: dwz >= 0.4
 Requires: zip
-Requires: (annobin if gcc)
+Requires: (annobin if (gcc or clang))
 
 # for brp-mangle-shebangs
 Requires: %{_bindir}/find
@@ -162,7 +170,6 @@ install -p -m 644 -t %{buildroot}%{_rpmconfigdir}/macros.d macros.*
 
 mkdir -p %{buildroot}%{_fileattrsdir}
 install -p -m 644 -t %{buildroot}%{_fileattrsdir} *.attr
-install -p -m 755 -t %{buildroot}%{_rpmconfigdir} kmod.prov
 
 mkdir -p %{buildroot}%{_rpmluadir}/fedora/{rpm,srpm}
 install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora common.lua
@@ -182,13 +189,13 @@ install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora/srpm forge.lua
 %{rrcdir}/find-requires
 %{rrcdir}/brp-ldconfig
 %{_fileattrsdir}/*.attr
-%{_rpmconfigdir}/kmod.prov
 %{_rpmconfigdir}/macros.d/macros.*-srpm
+%{_rpmconfigdir}/macros.d/macros.build-constraints
 %{_rpmconfigdir}/macros.d/macros.dwz
+%{_rpmconfigdir}/macros.d/macros.fedora-misc
 %{_rpmconfigdir}/macros.d/macros.forge
 %{_rpmconfigdir}/macros.d/macros.ldconfig
 %{_rpmconfigdir}/macros.d/macros.vpath
-%{_rpmconfigdir}/macros.d/macros.fedora-misc
 %dir %{_rpmluadir}/fedora
 %dir %{_rpmluadir}/fedora/srpm
 %dir %{_rpmluadir}/fedora/rpm
@@ -209,6 +216,91 @@ install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora/srpm forge.lua
 %{_rpmconfigdir}/macros.d/macros.kmp
 
 %changelog
+* Sun Aug 15 2021 Michel Alexandre Salim <salimma@fedoraproject.org> - 176-3
+- Fix macros.build-constraints' %%limit_build
+  - number of CPUs will never be set to less than 1
+  - this now outputs build flag overrides to be used with %%make_build etc.
+  - add documentation
+
+* Sat Jul 24 2021 Michel Alexandre Salim <salimma@fedoraproject.org> - 176-2
+- Add macros.build-constraints
+- Keep the misc macros in alphabetical order
+
+* Thu Apr 29 2021 Stephen Coady <scoady@redhat.com> - 176-1
+- Add Requires: rpmautospec-rpm-macros
+
+* Wed Mar 10 2021 Kalev Lember <klember@redhat.com> - 175-1
+- BRP Python Bytecompile: Avoid hardcoding /usr/bin prefix for python
+
+* Sun Nov 29 2020 Miro Hrončok <mhroncok@redhat.com> - 174-1
+- BRP Python Bytecompile: Also detect Python files in /app/lib/pythonX.Y
+
+* Fri Oct 30 2020 Florian Weimer <fweimer@redhat.com> - 173-1
+- x86_64: Re-add -fcf-protection to build flags (#1891308)
+
+* Fri Sep 11 2020 Miro Hrončok <mhroncok@redhat.com> - 172-1
+- Filter out LTO flags from %%extension flags macros
+- Fixes: rhbz#1877652
+
+* Wed Sep  2 2020 Michel Alexandre Salim <salimma@fedoraproject.org> - 171-1
+- Add Requires: lua-srpm-macros
+
+* Fri Aug 21 2020 Tom Stellard <tstellar@redhat.com> - 170-1
+- Enable -fstack-clash-protection for clang on x86, s390x, and ppc64le
+
+* Thu Aug 20 2020 Tom Stellard <tstellar@redhat.com> - 169-1
+- Add -flto to ldflags for clang toolchain
+
+* Thu Aug 20 2020 Neal Gompa <ngompa13@gmail.com> - 168-1
+- Fix CC/CXX exports so arguments are included in exported variable
+- Allow overrides of CC/CXX like CFLAGS and CXXFLAGS from shell variables
+
+* Mon Aug 03 2020 Troy Dawson <tdawson@redhat.com> - 167-1
+- Add Requires: kernel-srpm-macros
+
+* Thu Jul 30 2020 Jeff Law <law@redhat.com> - 166-1
+- Use -flto=auto for GCC to speed up builds
+
+* Tue Jul 28 2020 Tom Stellard <tstellar@redhat.com> - 165-1
+- Only use supported lto flags for clang toolchain
+
+* Thu Jul 23 2020 Lumír Balhar <lbalhar@redhat.com> - 164-1
+- Disable Python hash seed randomization in brp-python-bytecompile
+
+* Tue Jul 21 2020 Jeff Law <law@redhat.com> - 163-1
+- Enable LTO by default
+
+* Thu Jul 16 2020 Lumír Balhar <lbalhar@redhat.com> - 162-1
+- New script brp-fix-pyc-reproducibility
+
+* Tue Jun 16 2020 Lumír Balhar <lbalhar@redhat.com> - 161-2
+- Use stdlib compileall for Python >= 3.9
+
+* Mon Jun 15 2020 Lumír Balhar <lbalhar@redhat.com> - 161-1
+- No more automagic Python bytecompilation (phase 3)
+  https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation_phase_3
+
+* Thu Jun 04 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 160-1
+- Fix broken %%configure
+
+* Wed Jun 03 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 159-1
+- Fixes for new_package macro
+
+* Wed Jun 03 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 158-1
+- Add option to choose C/C++ toolchain
+
+* Sat May 30 2020 Jeff Law <law@redhat.com> - 157-1
+- When LTO is enabled, fix broken configure files.
+
+* Sat May 30 2020 Nicolas Mailhot <nim@fedoraproject.org> - 156-1
+- Add new_package macro and associated lua framework.
+
+* Sat May 23 2020 Nicolas Mailhot <nim@fedoraproject.org> - 155-1
+- forge: add gitea support
+
+* Thu Apr 09 2020 Panu Matilainen <pmatilai@redhat.com> - 154-1
+- Optimize kernel module provides by using a parametric generator
+
 * Thu Feb 20 2020 Jason L Tibbitts III <tibbs@math.uh.edu> - 153-1
 - Add dependency on fonts-srpm-macros, as those have now been approved by FPC.
 

rpmrc

@@ -74,9 +74,9 @@ optflags: hades %{__global_compiler_flags}
 optflags: s390 %{__global_compiler_flags} -m31 -march=zEC12 -mtune=z13 -fasynchronous-unwind-tables
 optflags: s390x %{__global_compiler_flags} -m64 -march=zEC12 -mtune=z13 -fasynchronous-unwind-tables -fstack-clash-protection
 
-optflags: aarch64 %{__global_compiler_flags} -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: aarch64 %{__global_compiler_flags} -mbranch-protection=standard -fasynchronous-unwind-tables %[ "%{toolchain}" == "gcc" ? "-fstack-clash-protection" : "" ]
 
-optflags: riscv64 %{__global_compiler_flags} -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: riscv64 %{__global_compiler_flags} -fasynchronous-unwind-tables %[ "%{toolchain}" == "gcc" ? "-fstack-clash-protection" : "" ]
 
 # set build arch to fedora buildarches on hardware capable of running it
 # saves having to do rpmbuild --target=