Fix warnings that appear during the build of the llvm package

The package redefines %optflags on i686 and s390x, so the
%__build_for_lang_* macros are no longer expanded, triggering
a warning from RPM (“%__build_for_lang_any defined but not
used within scope”).  Clang warns about -Wno-complain-wrong-lang
with -Wall, so the warning option is suppressed for
"%toolchain" != "gcc".

Reported-by: Tulio Magno Quites Machado Filho <tuliom@ascii.art.br>

.fmf/version

@@ -0,0 +1 @@
+1

brp-llvm-compile-lto-elf

@@ -0,0 +1,52 @@
+#!/usr/bin/bash -eu
+
+
+if [ -z "$RPM_BUILD_ROOT" ] || [ "$RPM_BUILD_ROOT" = "/" ]; then
+	exit 0
+fi
+
+CLANG_FLAGS=$@
+NCPUS=${RPM_BUILD_NCPUS:-1}
+
+check_convert_bitcode () {
+  local file_name=$(realpath ${1})
+  local file_type=$(file ${file_name})
+
+  shift
+  CLANG_FLAGS="$@"
+
+  if [[ "${file_type}" == *"LLVM IR bitcode"* ]]; then
+    # Check the output of llvm-strings for the command line, which is in the LLVM bitcode because
+    # we pass -frecord-gcc-switches.
+    # Check for a line that has "-flto" after (or without) "-fno-lto".
+    llvm-strings ${file_name} | while read line ; do
+      flto=$(echo $line   | grep -o -b -e -flto     | tail -n 1 | cut -d : -f 1)
+      fnolto=$(echo $line | grep -o -b -e -fno-lto  | tail -n 1 | cut -d : -f 1)
+
+      if test -n "$flto" && { test -z "$fnolto" || test "$flto" -gt "$fnolto"; } ; then
+        echo "Compiling LLVM bitcode file ${file_name}."
+        clang ${CLANG_FLAGS} -fno-lto -Wno-unused-command-line-argument \
+          -x ir ${file_name} -c -o ${file_name}
+        break
+      fi
+      done
+  elif [[ "${file_type}" == *"current ar archive"* ]]; then
+    echo "Unpacking ar archive ${file_name} to check for LLVM bitcode components."
+    # create archive stage for objects
+    local archive_stage=$(mktemp -d)
+    local archive=${file_name}
+    pushd ${archive_stage}
+    ar x ${archive}
+    for archived_file in $(find -not -type d); do
+      check_convert_bitcode ${archived_file} ${CLANG_FLAGS}
+      echo "Repacking ${archived_file} into ${archive}."
+      ar r ${archive} ${archived_file}
+    done
+    popd
+  fi
+}
+
+echo "Checking for LLVM bitcode artifacts"
+export -f check_convert_bitcode
+find "$RPM_BUILD_ROOT" -type f -name "*.[ao]" -print0 | \
+  xargs -0 -r -n1 -P$NCPUS sh -c "check_convert_bitcode \$@ $CLANG_FLAGS" ARG0

brp-mangle-shebangs

@@ -76,7 +76,7 @@ cd "$RPM_BUILD_ROOT"
 # (Take care to exclude filenames which would mangle "file" output).
 find -executable -type f ! -path '*:*' ! -path $'*\n*' \
 | file -N --mime-type -f - \
-| grep -P ".+(?=: text/)" \
+| grep -P ".+(?=: (text/|application/javascript))" \
 | {
 fail=0
 while IFS= read -r line; do
@@ -93,7 +93,14 @@ while IFS= read -r line; do
   fi
 
 
-  read shebang_line < "$f"
+  if ! read shebang_line < "$f"; then
+    echo >&2 "*** WARNING: Cannot read the first line from $f, removing executable bit"
+    ts=$(stat -c %y "$f")
+    chmod -x "$f"
+    touch -d "$ts" "$f"
+    continue
+  fi
+
   orig_shebang="${shebang_line#\#!}"
   if [ "$orig_shebang" = "$shebang_line" ]; then
     echo >&2 "*** WARNING: $f is executable but has no shebang, removing executable bit"

brp-python-bytecompile

@@ -1,144 +0,0 @@
-#!/bin/bash
-errors_terminate=$2
-extra=$3
-
-# If using normal root, avoid changing anything.
-if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
-	exit 0
-fi
-
-# Figure out how deep we need to descend.  We could pick an insanely high
-# number and hope it's enough, but somewhere, somebody's sure to run into it.
-depth=`(find "$RPM_BUILD_ROOT" -type f -name "*.py" -print0 ; echo /) | \
-       xargs -0 -n 1 dirname | sed 's,[^/],,g' | sort -u | tail -n 1 | wc -c`
-if [ -z "$depth" -o "$depth" -le "1" ]; then
-	exit 0
-fi
-
-# This function now implements Python byte-compilation in two different ways:
-# Python >= 3.4 uses a new module compileall2 - https://github.com/fedora-python/compileall2
-# Python < 3.4 (inc. Python 2) uses compileall module from stdlib with some hacks
-# When we drop support for Python 2, we'd be able to use all compileall2 features like:
-# - -s and -p options to manipulate with a path baked into pyc files instead of $real_libdir
-# - -o 0 -o 1 to produce multiple files in one run - each with a different optimization level - instead of $options
-# - removed useless $depth - both compileall and compileall2 are limited by sys.getrecursionlimit()
-# These changes will make this script much simpler
-function python_bytecompile()
-{
-    local options=$1
-    local python_binary=$2
-    local exclude=$3
-    local python_libdir=$4
-    local depth=$5 # Not used for Python >= 3.4
-    local real_libdir=$6 # Not used for Python >= 3.4
-
-	python_version=$($python_binary -c "import sys; sys.stdout.write('{0.major}{0.minor}'.format(sys.version_info))")
-
-	#
-	# Python 3.4 and higher
-	#
-	if [ "$python_version" -ge 34 ]; then
-
-		[ ! -z $exclude ] && exclude="-x '$exclude'"
-		# /usr/lib/rpm/redhat/ contains compileall2 Python module
-		# -q disables verbose output
-		# -f forces the process to overwrite existing compiled files
-		# -x excludes paths defined by regex
-		# -e excludes symbolic links pointing outside the build root
-		# -x and -e together implements the same functionality as the Filter class below
-		# -s strips $RPM_BUILD_ROOT from the path
-		# -p prepends the leading slash to the path to make it absolute
-		PYTHONPATH=/usr/lib/rpm/redhat/ $python_binary -B $options -m compileall2 -q -f $exclude -s $RPM_BUILD_ROOT -p / -e $RPM_BUILD_ROOT $python_libdir
-	else
-#
-# Python 3.3 and lower (incl. Python 2)
-#
-
-cat << EOF | $python_binary $options
-import compileall, sys, os, re
-
-python_libdir = "$python_libdir"
-depth = $depth
-real_libdir = "$real_libdir"
-build_root = "$RPM_BUILD_ROOT"
-exclude = r"$exclude"
-
-class Filter:
-    def search(self, path):
-        ret = not os.path.realpath(path).startswith(build_root)
-        if exclude:
-            ret = ret or re.search(exclude, path)
-        return ret
-
-sys.exit(not compileall.compile_dir(python_libdir, depth, real_libdir, force=1, rx=Filter(), quiet=1))
-EOF
-
-fi
-}
-
-# .pyc/.pyo files embed a "magic" value, identifying the ABI version of Python
-# bytecode that they are for.
-#
-# The files below RPM_BUILD_ROOT could be targeting multiple versions of
-# python (e.g. a single build that emits several subpackages e.g. a
-# python26-foo subpackage, a python31-foo subpackage etc)
-#
-# Support this by assuming that below each /usr/lib/python$VERSION/, all
-# .pyc/.pyo files are to be compiled for /usr/bin/python$VERSION.
-# 
-# For example, below /usr/lib/python2.6/, we're targeting /usr/bin/python2.6
-# and below /usr/lib/python3.1/, we're targeting /usr/bin/python3.1
-
-shopt -s nullglob
-for python_libdir in `find "$RPM_BUILD_ROOT" -type d|grep -E "/usr/lib(64)?/python[0-9]\.[0-9]+$"`;
-do
-	python_binary=/usr/bin/$(basename $python_libdir)
-	real_libdir=${python_libdir/$RPM_BUILD_ROOT/}
-	echo "Bytecompiling .py files below $python_libdir using $python_binary"
-
-	# Generate normal (.pyc) byte-compiled files.
-	python_bytecompile "" "$python_binary" "" "$python_libdir" "$depth" "$real_libdir"
-	if [ $? -ne 0 -a 0$errors_terminate -ne 0 ]; then
-		# One or more of the files had a syntax error
-		exit 1
-	fi
-
-	# Generate optimized (.pyo) byte-compiled files.
-	python_bytecompile "-O" "$python_binary" "" "$python_libdir" "$depth" "$real_libdir"
-	if [ $? -ne 0 -a 0$errors_terminate -ne 0 ]; then
-		# One or more of the files had a syntax error
-		exit 1
-	fi
-done
-
-
-# Handle other locations in the filesystem using the default python implementation
-# if extra is set to 0, don't do this
-if [ 0$extra -eq 0 ]; then
-	exit 0
-fi
-
-# If we don't have a default python interpreter, we cannot proceed
-default_python=${1:-/usr/bin/python}
-if [ ! -x "$default_python" ]; then
-	exit 0
-fi
-
-# Figure out if there are files to be bytecompiled with the default_python at all
-# this prevents unnecessary default_python invocation
-find "$RPM_BUILD_ROOT" -type f -name "*.py" | grep -Ev "/bin/|/sbin/|/usr/lib(64)?/python[0-9]\.[0-9]|/usr/share/doc" || exit 0
-
-# Generate normal (.pyc) byte-compiled files.
-python_bytecompile "" $default_python "/bin/|/sbin/|/usr/lib(64)?/python[0-9]\.[0-9]|/usr/share/doc" "$RPM_BUILD_ROOT" "$depth" "/"
-if [ $? -ne 0 -a 0$errors_terminate -ne 0 ]; then
-	# One or more of the files had a syntax error
-	exit 1
-fi
-
-# Generate optimized (.pyo) byte-compiled files.
-python_bytecompile "-O" $default_python "/bin/|/sbin/|/usr/lib(64)?/python[0-9]\.[0-9]|/usr/share/doc" "$RPM_BUILD_ROOT" "$depth" "/"
-if [ $? -ne 0 -a 0$errors_terminate -ne 0 ]; then
-	# One or more of the files had a syntax error
-	exit 1
-fi
-exit 0

buildflags.md

@@ -5,46 +5,58 @@ and how to use them.
 
 # Using RPM build flags
 
+The %set_build_flags macro sets the environment variables `CFLAGS`,
+`CXXFLAGS`, `FFLAGS`, `FCFLAGS`, `VALAFLAGS`, `LDFLAGS` and `LT_SYS_LIBRARY_PATH` to
+the value of their corresponding rpm macros. `%set_build_flags` is automatically
+called prior to the `%build`, `%check`, and `%install` phases so these flags can be
+used by makefiles and other build tools.
+
+You can opt out of this behavior by doing:
+
+    %undefine _auto_set_build_flags
+
+If you do opt out of this behavior, you can still manually use `%set_build_flags`
+by adding it to the `%build` section of your spec file or by using one of the
+build system helper macros like `%configure`, `%cmake`, and `%meson`.
+
 For packages which use autoconf to set up the build environment, use
 the `%configure` macro to obtain the full complement of flags, like
 this:
 
     %configure
 
-This will invoke the `./configure` with arguments (such as
-`--prefix=/usr`) to adjust the paths to the packaging defaults.
-
-As a side effect, this will set the environment variables `CFLAGS`,
-`CXXFLAGS`, `FFLAGS`, `FCFLAGS`, `LDFLAGS` and `LT_SYS_LIBRARY_PATH`,
-so they can be used by makefiles and other build tools.  (However,
-existing values for these variables are not overwritten.)
-
-If your package does not use autoconf, you can still set the same
-environment variables using
-
-    %set_build_flags
-
-early in the `%build` section.  (Again, existing environment variables
-are not overwritten.)
+This will invoke `./configure` with arguments (such as
+`--prefix=/usr`) to adjust the paths to the packaging defaults. Prior
+to that, some common problems in autotools scripts are automatically
+patched across the source tree.
 
 Individual build flags are also available through RPM macros:
 
+* `%{build_cc}` for the command name of the C compiler.
+* `%{build_cxx}` for the command name of the C++ compiler.
+* `%{build_cpp}` for the command name of the C-compatible preprocessor.
 * `%{build_cflags}` for the C compiler flags (also known as the
-  `CFLAGS` variable).  Also historically available as `%{optflags}`.
-  Furthermore, at the start of the `%build` section, the environment
-  variable `RPM_OPT_FLAGS` is set to this value.
+  `CFLAGS` variable).
 * `%{build_cxxflags}` for the C++ compiler flags (usually assigned to
   the `CXXFLAGS` shell variable).
-* `%{build_fflags} for `FFLAGS` (the Fortran compiler flags, also
+* `%{build_fflags}` for `FFLAGS` (the Fortran compiler flags, also
   known as the `FCFLAGS` variable).
-* `%{build_ldflags}` for the link editor (ld) flags, usually known as
-  `LDFLAGS`.  Note that the contents quotes linker arguments using
+* `%{build_valaflags}` for `VALAFLAGS` (the Vala compiler flags)
+* `%{build_ldflags}` for the linker (`ld`) flags, usually known as
+  `LDFLAGS`. Note that the contents quote linker arguments using
   `-Wl`, so this variable is intended for use with the `gcc` compiler
-  driver.  At the start of the `%build` section, the environment
+  driver. At the start of the `%build` section, the environment
   variable `RPM_LD_FLAGS` is set to this value.
 
+The C and C++ compiler flags are historically available as the
+`%{optflags}` macro.  These flags may not contain flags that work with
+certain languagues or compiler front ends, so the language-specific
+`%build_*` are more precise.  At the start of the `%build` section,
+the environment variable `RPM_OPT_FLAGS` is set to the `%{optflags}`
+value; similar limitations apply.
+
 The variable `LT_SYS_LIBRARY_PATH` is defined here to prevent the `libtool`
-script (v2.4.6+) from hardcoding %_libdir into the binaries' RPATH.
+script (v2.4.6+) from hardcoding `%_libdir` into the binaries' `RPATH`.
 
 These RPM macros do not alter shell environment variables.
 
@@ -69,12 +81,129 @@ For other considerations involving shared objects, see:
 
 * [Fedora Packaging Guidelines: Shared Libraries](https://docs.fedoraproject.org/en-US/packaging-guidelines/#_shared_libraries)
 
-# Customizing compiler flags
+# Customizing compiler and other build flags
 
 It is possible to set RPM macros to change some aspects of the
 compiler flags.  Changing these flags should be used as a last
 recourse if other workarounds are not available.
 
+### Toolchain selection
+
+The default toolchain uses GCC, and the `%toolchain` macro is defined
+as `gcc`.
+
+It is enough to override `toolchain` macro and all relevant macro for C/C++
+compilers will be switched. Either in the spec or in the command-line.
+
+    %global toolchain clang
+
+or:
+
+    rpmbuild -D "toolchain clang" …
+
+Inside a spec file it is also possible to determine which toolchain is in use
+by testing the same macro. For example:
+
+    %if "%{toolchain}" == "gcc"
+    BuildRequires: gcc
+    %endif
+
+or:
+
+    %if "%{toolchain}" == "clang"
+    BuildRequires: clang compiler-rt
+    %endif
+
+### Controlling Type Safety
+
+The macro `%build_type_safety_c` can be set to change the C type
+safety level.  By default (value 0), all C constructs that GCC accepts
+for backwards compatibility with obsolete language standards are
+accepted during package builds.  Packages can set
+`%build_type_safety_c` to higher values to adopt future
+distribution-wide type-safety increases early.
+
+When changing the `%build_type_safety_c` level to increase it, spec
+file should use a construct like this to avoid *lowering* a future
+default:
+
+```
+%if %build_type_safety_c < 2
+%global %build_type_safety_c 2
+%endif
+```
+
+At level 1, the following additional error categories are enabled:
+
+* `-Werror=implicit-int`: Reject declarations and definitions that
+  omit a type name where one is required.  Examples are:
+  `extern int_variable;`, `extern int_returning_function (void);`,
+  and missing separate parameter type declarations in old-style
+  function definitions.
+* `-Werror=implicit-function-declaration`: Reject calls to functions
+  to undeclared functions such as `function_not_defined_anywhere ()`.
+  Previously, such expressions where we compiled as if a declaration
+  `extern int function_not_defined_anywhere ();` (a prototype-less
+  function declaration) were in scope.
+
+At level 2, the following error category is enabled in addition:
+
+* `-Werror=int-conversion`: Reject the use of integer expressions
+  where a pointer type expected, and pointer expressions where an
+  integer type is expected.  Without this option, GCC may produce an
+  executable, but often, there are failures at run time because not
+  the full 64 bits of pointers are preserved.
+
+The additional level 3 error category is:
+
+* `-Werror=incompatible-pointer-types`: An expression of one pointer
+  type is used where different pointer type is expected.  (This does
+  not cover signed/unsigned mismatches in the pointer target type.)
+
+Clang errors out on more obsolete and invalid C constructs than C, so
+the type safety is higher by default than with the GCC toolchain.
+
+### Disable autotools compatibility patching
+
+By default, the invocation of the `%configure` macro replaces
+`config.guess` files in the source tree with the system version.  To
+disable that, define this macro:
+
+    %global _configure_gnuconfig_hack 0
+
+`%configure` also patches `ltmain.sh` scripts, so that linker flags
+are set as well during libtool-.  This can be switched off using:
+
+    %global _configure_libtool_hardening_hack 0
+
+Further patching happens in LTO mode, see below.
+
+### Other autotools compatibility settings
+
+During `%configure`, `--runstatedir` is automatically passed to the
+`configure` script if support for this option is detected.  This
+detection can fail if the package has multiple `configure` scripts
+that invoke each other, and only some of them support `--runstatedir`.
+To disable passing `--runstatedir`, use:
+
+    %undefine _configure_use_runstatedir
+
+### Disabling Link-Time Optimization
+
+By default, builds use link-time optimization.  In this build mode,
+object code is generated at the time of the final link, by combining
+information from all available translation units, and taking into
+account which symbols are exported.
+
+To disable this optimization, include this in the spec file:
+
+    %global _lto_cflags %{nil}
+
+If LTO is enabled, `%configure` applies some common required fixes to
+`configure` scripts.  To disable that, define the RPM macro
+`_fix_broken_configure_for_lto` as `true` (sic; it has to be a shell
+command).
+
 ### Lazy binding
 
 If your package depends on the semantics of lazy binding (e.g., it has
@@ -97,6 +226,30 @@ This turns off certain hardening features, as described in detail
 below.  The main difference is that executables will be
 position-dependent (no full ASLR) and use lazy binding.
 
+### Source Fortification
+
+By default, the build flags include `-Wp,-D_FORTIFY_SOURCE=3`: Source
+fortification activates various hardening features in glibc:
+
+* String functions such as `memcpy` attempt to detect buffer lengths
+  and terminate the process if a buffer overflow is detected.
+* `printf` format strings may only contain the `%n` format specifier
+  if the format string resides in read-only memory.
+* `open` and `openat` flags are checked for consistency with the
+  presence of a *mode* argument.
+* Plus other minor hardening changes.
+
+These changes can, on rare occasions, break valid programs. The source
+fortification level can be overridden by adding this in the RPM spec file:
+
+    %define _fortify_level 2
+
+to reduce source fortification level to 2 or:
+
+    %undefine _fortify_level
+
+to disable fortification altogether.
+
 ### Annotated builds/watermarking
 
 By default, the build flags cause a special output section to be
@@ -116,6 +269,28 @@ recognized, so it has to come after the hardening flags on the command
 line (it has to be added at the end of `CFLAGS`, or specified after
 the `CFLAGS` variable contents).
 
+### Keeping dependencies on unused shared objects
+
+By default, ELF shared objects which are listed on the linker command
+line, but which have no referencing symbols in the preceding objects,
+are not added to the output file during the final link.
+
+In order to keep dependencies on shared objects even if none of
+their symbols are used, include this in the RPM spec file:
+
+    %undefine _ld_as_needed
+
+For example, this can be required if shared objects are used for their
+side effects in ELF constructors, or for making them available to
+dynamically loaded plugins.
+
+### Specifying the build-id algorithm
+
+If you want to specify a different build-id algorithm for your builds, you
+can use the `%_build_id_flags` macro:
+
+    %_build_id_flags -Wl,--build-id=sha1
+
 ### Strict symbol checks in the link editor (ld)
 
 Optionally, the link editor will refuse to link shared objects which
@@ -130,7 +305,7 @@ executed before the shared object containing them is fully relocated.
 
 To switch on these checks, define this macro in the RPM spec file:
 
-    %define _strict_symbol_defs_build 1
+    %global _strict_symbol_defs_build 1
 
 If this RPM spec option is active, link failures will occur if the
 linker command line does not list all shared objects which are needed.
@@ -156,10 +331,111 @@ Builds may fail with `multiple definition of ...` errors.
 As a short term workaround for such failure,
 it is possible to add `-fcommon` to the flags by defining `%_legacy_common_support`.
 
-    %define _legacy_common_support 1
+    %global _legacy_common_support 1
 
 Properly fixing the failure is always preferred!
 
+### Package note on ELF objects
+
+A note that describes the package name, version, and architecture is
+inserted via a linker script (`%_package_note_file`). The script is
+generated when `%set_build_flags` is called. The linker option that
+injects the linker script is added to `%{build_ldflags}` via the
+`%{_package_note_flags}` macro.
+
+To opt out of the use of this feature completely, the best way is to
+undefine the first macro. Include this in the spec file:
+
+    %undefine _package_note_file
+
+The other macros can be undefined too to replace parts of the functionality.
+If `%_generate_package_note_file` is undefined, the linker script will not
+be generated, but the link flags may still refer to it. This may be useful
+if the default generation method is insufficient and a different mechanism
+will be used to generate `%_package_note_file`. If `%_package_note_flags`
+is undefined, the linker argument that injects the script will not be added
+to `%build_ldfags`, but the linker script would still be generated.
+
+### Frame pointers
+
+Frame pointers will be included by default via the `%_include_frame_pointers`
+macro. To opt out, the best way is to undefine the macro. Include this in the
+spec file:
+
+    %undefine _include_frame_pointers
+
+Note that opting out might still result in frame pointers being included on
+architectures where they are part of the ABI (e.g. aarch64) depending on
+compiler defaults.
+
+### Post-build ELF object processing
+
+By default, DWARF debugging information is separated from installed
+ELF objects and put into `-debuginfo` subpackages.  To disable most
+debuginfo processing (and thus the generation of these subpackages),
+define `_enable_debug_packages` as `0`.
+
+Processing of debugging information is controlled using the
+`find-debuginfo` tool from the `debugedit` package.  Several aspects
+of its operation can be controlled at the RPM level.
+
+* Creation of `-debuginfo` subpackages is enabled by default.
+  To disable, undefine `_debuginfo_subpackages`.
+* Likewise, `-debugsource` subpackages are automatically created.
+  To disable, undefine `_debugsource_subpackages`.
+  See [Separate Subpackage and Source Debuginfo](https://fedoraproject.org/wiki/Changes/SubpackageAndSourceDebuginfo)
+  for background information.
+* `_build_id_links`, `_unique_build_ids`, `_unique_debug_names`,
+  `_unique_debug_srcs` control how debugging information and
+  corresponding source files are represented on disk.
+  See `/usr/lib/rpm/macros` for details.  The defaults
+  enable parallel installation of `-debuginfo` packages for
+  different package versions, as described in
+  [Parallel Installable Debuginfo](https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo).
+* By default, a compressed symbol table is preserved in the
+  `.gnu_debugdata` section.  To disable that, undefine
+  `_include_minidebuginfo`.
+* To speed up debuggers, a `.gdb_index` section is created.  It can be
+  disabled by undefining `_include_gdb_index`.
+* Missing build IDs result in a build failure.  To ignore such
+  problems, undefine `_missing_build_ids_terminate_build`.
+* During processing, build IDs are recomputed to match the binary
+  content.  To skip this step, define `_no_recompute_build_ids` as `1`.
+* By default, the options in `_find_debuginfo_dwz_opts` turn on `dwz`
+  (DWARF compression) processing.  Undefine this macro to disable this
+  step.
+* Additional options can be passed by defining the
+  `_find_debuginfo_opts` macro.
+
+After separation of debugging information, additional transformations
+are applied, most of them also related to debugging information.
+These steps can be skipped by undefining the corresponding macros:
+
+* `__brp_strip`: Removal of leftover debugging information.  The tool
+  specified by the `__strip` macro is invoked with the `-g` option on
+  ELF object (`.o`) files.
+* `__brp_strip_static_archive`: This is similar to `__brp_strip`, but
+  processes static `.a` archives instead.
+* `__brp_strip_comment_note`: This step removes unallocated `.note`
+  sections, and `.comment` sections from ELF files.
+* `__brp_strip_lto`: This step removes GCC LTO intermediate representation
+  in ELF sections starting with `.gnu.lto_` and `.gnu.debuglto_`.  Skipping
+  this step is strongly discouraged because the tight coupling of LTO
+  data with the GCC version.  The underlying tool is again determined by the
+  `__strip` macro.
+* `__brp_llvm_compile_lto_elf`: This step replaces LLVM bitcode files
+  with object files, thereby removing LLVM bitcode from the installed
+  files.  This transformation is applied to object files in static `.a`
+  archives, too.
+* `__brp_ldconfig`: For each shared object on the library search path
+  whose soname does not match its file name, a symbolic link from the
+  soname to the file name is created.  This way, these shared objects
+  are loadable immediately after installation, even if they are not yet
+  listed in the `/etc/ld.so.cache` file (because `ldconfig` has not been
+  invoked yet).
+* `__brp_remove_la_files`: This step removes libtool-generated `.la`
+  files from the installed files.
+
 # Individual compiler flags
 
 Compiler flags end up in the environment variables `CFLAGS`,
@@ -167,10 +443,11 @@ Compiler flags end up in the environment variables `CFLAGS`,
 
 The general (architecture-independent) build flags are:
 
-* `-O2`: Turn on various GCC optimizations.  See the [GCC manual](https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-O2).
+* `-O2`: Turn on various GCC optimizations. See the
+  [GCC manual](https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-O2).
   Optimization improves performance, the accuracy of warnings, and the
   reach of toolchain-based hardening, but it makes debugging harder.
-* `-g`: Generate debugging information (DWARF).  In Fedora, this data
+* `-g`: Generate debugging information (DWARF). In Fedora, this data
   is separated into `-debuginfo` RPM packages whose installation is
   optional, so debuging information does not increase the size of
   installed binaries by default.
@@ -179,22 +456,19 @@ The general (architecture-independent) build flags are:
   compilation performance.  (This does not affect code generation.)
 * `-Wall`: Turn on various GCC warnings.
   See the [GCC manual](https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wall).
+* `-Wno-complain-wrong-lang`: Do not warn about front end mismatches
+  (e.g, using `-Werror=format-security` with Fortran).  Only included
+  in `%optflags`, and not the front-end-specific `%build_*` macros.
 * `-Werror=format-security`: Turn on format string warnings and treat
   them as errors.
   See the [GCC manual](https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wformat-security).
-  This can occasionally result in compilation errors.  In this case,
+  This can occasionally result in compilation errors. In that case,
   the best option is to rewrite the source code so that only constant
   format strings (string literals) are used.
-* `-Wp,-D_FORTIFY_SOURCE=2`: Source fortification activates various
-  hardening features in glibc:
-    * String functions such as `memcpy` attempt to detect buffer lengths
-      and terminate the process if a buffer overflow is detected.
-    * `printf` format strings may only contain the `%n` format specifier
-      if the format string resides in read-only memory.
-    * `open` and `openat` flags are checked for consistency with the
-      presence of a *mode* argument.
-    * Plus other minor hardening changes.
-  (These changes can occasionally break valid programs.)
+* Other `-Werror=` options.  See **Controlling C Type Safety**.
+* `-U_FORTIFY_SOURCE, -Wp,-U_FORTIFY_SOURCE -Wp,-D_FORTIFY_SOURCE=3`:
+  See the Source Fortification section above and the `%_fortify_level`
+  override.
 * `-fexceptions`: Provide exception unwinding support for C programs.
   See the [`-fexceptions` option in the GCC
   manual](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html#index-fexceptions)
@@ -206,6 +480,13 @@ The general (architecture-independent) build flags are:
   it possible to unwind the stack (using C++ `throw` or Rust panics)
   from C callback functions if a C library supports non-local exits
   from them (e.g., via `longjmp`).
+* `-fasynchronous-unwind-tables`: Generate full unwind information
+  covering all program points.  This is required for support of
+  asynchronous cancellation and proper unwinding from signal
+  handlers.  It also makes performance and debugging tools more
+  useful because unwind information is available without having to
+  install (and load) debugging information.  (Not enabled on armhfp
+  due to architectural differences in stack management.)
 * `-Wp,-D_GLIBCXX_ASSERTIONS`: Enable lightweight assertions in the
   C++ standard library, such as bounds checking for the subscription
   operator on vectors.  (This flag is added to both `CFLAGS` and
@@ -217,99 +498,110 @@ The general (architecture-independent) build flags are:
   variables.  (If the address of a variable is never taken, it is not
   possible that a buffer overflow is caused by incorrect pointer
   arithmetic involving a pointer to that variable.)
+* `-fstack-clash-protection`: Turn on instrumentation to avoid
+  skipping the guard page in large stack frames.  (Without this flag,
+  vulnerabilities can result where the stack overlaps with the heap,
+  or thread stacks spill into other regions of memory.)  This flag is
+  fully ABI-compatible and has adds very little run-time overhead.
+  This flag is currently not available on armhfp (both `gcc` and `clang`
+  toolchains) and on aarch64 with the `clang` toolchain.
+* `-flto=auto`: Enable link-time optimization (LTO), using `make` job server
+  integration for parallel processing.  (`gcc` toolchain only)
+* `-ffat-lto-objects`: Generate EFL object files which contain both
+  object code and LTO intermediate representation.  (`gcc` toolchain only)
+* `-flto`: Enable link-time optimization. (`clang` toolchain only)
 * `-grecord-gcc-switches`: Include select GCC command line switches in
   the DWARF debugging information.  This is useful for detecting the
   presence of certain build flags and general hardening coverage.
+* `-fcommon`: This optional flag is used to build legacy software
+  which relies on C tentative definitions.  It is disabled by default.
 
 For hardened builds (which are enabled by default, see above for how
 to disable them), the flag
 `-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1` is added to the
 command line.  It adds the following flag to the command line:
 
-*   `-fPIE`: Compile for a position-independent executable (PIE),
-    enabling full address space layout randomization (ASLR).  This is
-    similar to `-fPIC`, but avoids run-time indirections on certain
-    architectures, resulting in improved performance and slightly
-    smaller executables.  However, compared to position-dependent code
-    (the default generated by GCC), there is still a measurable
-    performance impact.
+* `-fPIE`: Compile for a position-independent executable (PIE),
+  enabling full address space layout randomization (ASLR).  This is
+  similar to `-fPIC`, but avoids run-time indirections on certain
+  architectures, resulting in improved performance and slightly
+  smaller executables.  However, compared to position-dependent code
+  (the default generated by GCC), there is still a measurable
+  performance impact.
 
-    If the command line also contains `-r` (producing a relocatable
-    object file), `-fpic` or `-fPIC`, this flag is automatically
-    dropped.  (`-fPIE` can only be used for code which is linked into
-    the main program.) Code which goes into static libraries should be
-    compiled with `-fPIE`, except when this code is expected to be
-    linked into DSOs, when `-fPIC` must be used.
+  If the command line also contains `-r` (producing a relocatable
+  object file), `-fpic` or `-fPIC`, this flag is automatically
+  dropped.  (`-fPIE` can only be used for code which is linked into
+  the main program.) Code which goes into static libraries should be
+  compiled with `-fPIE`, except when this code is expected to be
+  linked into DSOs, when `-fPIC` must be used.
 
-    To be effective, `-fPIE` must be used with the `-pie` linker flag
-    when producing an executable, see below.
+  To be effective, `-fPIE` must be used with the `-pie` linker flag
+  when producing an executable, see below.
 
 To support [binary watermarks for ELF
 objects](https://fedoraproject.org/wiki/Toolchain/Watermark) using
 annobin, the `-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1` flag is
-added by default.  This can be switched off by undefining the
-`%_annotated_build` RPM macro (see above).
+added by default (with the `gcc` toolchain).  This can be switched off
+by undefining the `%_annotated_build` RPM macro (see above).  Binary
+watermarks are currently disabled on armhpf, and with the `clang`
+toolchain.
+
+If frame pointers are enabled by default (via `%_include_frame_pointers`),
+the `-fno-omit-frame-pointer` will be added on all architectures except i686
+and s390x. Additional flags will be added on specific architectures:
+
+* `-mno-omit-leaf-frame-pointer` on x86_64 and aarch64
 
 ### Architecture-specific compiler flags
 
 These compiler flags are enabled for all builds (hardened/annotated or
 not), but their selection depends on the architecture:
 
-*   `-fstack-clash-protection`: Turn on instrumentation to avoid
-    skipping the guard page in large stack frames.  (Without this flag,
-    vulnerabilities can result where the stack overlaps with the heap,
-    or thread stacks spill into other regions of memory.)  This flag is
-    fully ABI-compatible and has adds very little run-time overhead, but
-    is only available on certain architectures (currently aarch64, i386,
-    ppc64, ppc64le, s390x, x86_64).
-*   `-fcf-protection`: Instrument binaries to guard against
-    ROP/JOP attacks.  Used on i686 and x86_64.
-*   `-m64` and `-m32`: Some GCC builds support both 32-bit and 64-bit in
-    the same compilation.  For such architectures, the RPM build process
-    explicitly selects the architecture variant by passing this compiler
-    flag.
-*   `-fasynchronous-unwind-tables`: Generate full unwind information
-    covering all program points.  This is required for support of
-    asynchronous cancellation and proper unwinding from signal
-    handlers.  It also makes performance and debugging tools more
-    useful because unwind information is available without having to
-    install (and load) debugging ienformation.
-    Asynchronous unwind tables are enabled for aarch64, i686, ppc64,
-    ppc64le, s390x, and x86_64.  They are not needed on armhfp due to
-    architectural differences in stack management.  On these
-    architectures, `-fexceptions` (see above) still enables regular
-    unwind tables (or they are enabled by default even without this
-    option).
+* `-fcf-protection`: Instrument binaries to guard against
+  ROP/JOP attacks.  Used on i686 and x86_64.
+* `-mbranch-protection=standard`: Instrument binaries to guard against
+   ROP/JOP attacks.  Used on aarch64.
+* `-m64` and `-m32`: Some GCC builds support both 32-bit and 64-bit in
+  the same compilation.  For such architectures, the RPM build process
+  explicitly selects the architecture variant by passing this compiler
+  flag.
 
 In addition, `redhat-rpm-config` re-selects the built-in default
 tuning in the `gcc` package.  These settings are:
 
-*   **armhfp**: `-march=armv7-a -mfpu=vfpv3-d16  -mfloat-abi=hard`
-    selects an Arm subarchitecture based on the ARMv7-A architecture
-    with 16 64-bit floating point registers.  `-mtune=cortex-8a` selects
-    tuning for the Cortex-A8 implementation (while preserving compatibility
-    with other ARMv7-A implementations).  `-mabi=aapcs-linux` switches to
-    the AAPCS ABI for GNU/Linux.
-*   **i686**: `-march=i686` is used to select a minmum support CPU level
-    of i686 (corresponding to the Pentium Pro).  SSE2 support is
-    enabled with `-msse2` (so only CPUs with SSE2 support can run the
-    compiled code; SSE2 was introduced first with the Pentium 4).
-    `-mtune=generic` activates tuning for a current blend of CPUs
-    (under the assumption that most users of i686 packages obtain them
-    through an x86_64 installation on current hardware).
-    `-mfpmath=sse` instructs GCC to use the SSE2 unit for floating
-    point math to avoid excess precision issues.  `-mstackrealign`
-    avoids relying on the stack alignment guaranteed by the current
-    version of the i386 ABI.
-*   **ppc64le**: `-mcpu=power8 -mtune=power8` selects a minimum supported
-    CPU level of POWER8 (the first CPU with ppc64le support) and tunes
-    for POWER8.
-*   **s390x**: `-march=zEC12 -mtune=z13` specifies a minimum supported CPU
-    level of zEC12, while optimizing for a subsequent CPU generation
-    (z13).
-*   **x86_64**: `-mtune=generic` selects tuning which is expected to
-     beneficial for a broad range of current CPUs.
-*   **ppc64** and **aarch64** do not have any architecture-specific tuning.
+* **armhfp**: `-march=armv7-a -mfpu=vfpv3-d16 -mfloat-abi=hard`
+  selects an Arm subarchitecture based on the ARMv7-A architecture
+  with 16 64-bit floating point registers.  `-mtune=cortex-8a` selects
+  tuning for the Cortex-A8 implementation (while preserving
+  compatibility with other ARMv7-A implementations).
+  `-mabi=aapcs-linux` switches to the AAPCS ABI for GNU/Linux.
+* **i686**: `-march=i686` is used to select a minmum support CPU level
+  of i686 (corresponding to the Pentium Pro).  SSE2 support is enabled
+  with `-msse2` (so only CPUs with SSE2 support can run the compiled
+  code; SSE2 was introduced first with the Pentium 4).
+  `-mtune=generic` activates tuning for a current blend of CPUs (under
+  the assumption that most users of i686 packages obtain them through
+  an x86_64 installation on current hardware).  `-mfpmath=sse`
+  instructs GCC to use the SSE2 unit for floating point math to avoid
+  excess precision issues.  `-mstackrealign` avoids relying on the
+  stack alignment guaranteed by the current version of the i386 ABI.
+* **ppc64le**: `-mcpu=power8 -mtune=power8` selects a minimum
+  supported CPU level of POWER8 (the first CPU with ppc64le support)
+  and tunes for POWER8.
+* **s390x**: `-march=zEC12 -mtune=z13` specifies a minimum supported
+  CPU level of zEC12, while optimizing for a subsequent CPU generation
+  (z13).
+* **x86_64**: `-mtune=generic` selects tuning which is expected to
+   beneficial for a broad range of current CPUs.
+* **aarch64** does not have any architecture-specific tuning.
+
+### Vala-specific compiler flags
+
+ * `-g`: causes valac to emit `#line` directives in the generated C
+   source code. This improves backtrace generation by causing gdb to
+   point to Vala source file and line number instead of the generated C
+   source when possible.
 
 # Individual linker flags
 
@@ -325,6 +617,10 @@ to the compiler driver `gcc`, and not directly to the link editor
   dynamic linker is instructed to revoke write permissions after
   dynamic linking.  Full protection of relocation data requires the
   `-z now` flag (see below).
+* `--as-needed`: In the final link, only generate ELF dependencies
+  for shared objects that actually provide symbols required by the link.
+  Shared objects which are not needed to fulfill symbol dependencies
+  are essentially ignored due to this flag.
 * `-z defs`: Refuse to link shared objects (DSOs) with undefined symbols
   (optional, see above).
 

common.lua

@@ -1,7 +1,46 @@
 -- Convenience Lua functions that can be used within rpm macros
 
--- Set a spec variable
--- Echo the result if verbose
+-- Reads an rpm variable. Unlike a basic rpm.expand("{?foo}"), returns nil if
+-- the variable is unset, which is convenient in lua tests and enables
+-- differentiating unset variables from variables set to ""
+local function read(rpmvar)
+  if not rpmvar or
+    (rpm.expand("%{" .. rpmvar .. "}") == "%{" .. rpmvar .. "}") then
+    return nil
+  else
+    return rpm.expand("%{?" .. rpmvar .. "}")
+  end
+end
+
+-- Returns true if the macro that called this function had flag set
+--   – for example, hasflag("z") would give the following results:
+--     %foo -z bar → true
+--     %foo -z     → true
+--     %foo        → false
+local function hasflag(flag)
+  return (rpm.expand("%{-" .. flag .. "}") ~= "")
+end
+
+-- Returns the argument passed to flag in the macro that called this function
+--  – for example, readflag("z") would give the following results:
+--      %foo -z bar → bar
+--      %foo        → nil
+--      %foo -z ""  → empty string
+--      %foo -z ''  → empty string
+local function readflag(flag)
+  if not hasflag(flag) then
+    return nil
+  else
+    local a = rpm.expand("%{-" .. flag .. "*}")
+    -- Handle "" and '' as empty strings
+    if (a == '""') or (a == "''") then
+      a = ''
+    end
+    return a
+  end
+end
+
+-- Sets a spec variable; echoes the result if verbose
 local function explicitset(rpmvar, value, verbose)
   local value = value
   if (value == nil) or (value == "") then
@@ -9,31 +48,29 @@ local function explicitset(rpmvar, value, verbose)
   end
   rpm.define(rpmvar .. " " .. value)
   if verbose then
-    rpm.expand("%{echo:Setting %%{" .. rpmvar .. "} = " .. value .. "}")
+    rpm.expand("%{warn:Setting %%{" .. rpmvar .. "} = " .. value .. "}")
   end
 end
 
--- Unset a spec variable if it is defined
--- Echo the result if verbose
+-- Unsets a spec variable if it is defined; echoes the result if verbose
 local function explicitunset(rpmvar, verbose)
   if (rpm.expand("%{" .. rpmvar .. "}") ~= "%{" .. rpmvar .. "}") then
     rpm.define(rpmvar .. " %{nil}")
     if verbose then
-      rpm.expand("%{echo:Unsetting %%{" .. rpmvar .. "}}")
+      rpm.expand("%{warn:Unsetting %%{" .. rpmvar .. "}}")
     end
   end
 end
 
--- Set a spec variable, if not already set
--- Echo the result if verbose
+-- Sets a spec variable, if not already set; echoes the result if verbose
 local function safeset(rpmvar, value, verbose)
   if (rpm.expand("%{" .. rpmvar .. "}") == "%{" .. rpmvar .. "}") then
     explicitset(rpmvar,value,verbose)
   end
 end
 
--- Alias a list of rpm variables to the same variables suffixed with 0 (and vice versa)
--- Echo the result if verbose
+-- Aliases a list of rpm variables to the same variables suffixed with 0 (and
+-- vice versa); echoes the result if verbose
 local function zalias(rpmvars, verbose)
   for _, sfx in ipairs({{"","0"},{"0",""}}) do
     for _, rpmvar in ipairs(rpmvars) do
@@ -113,13 +150,7 @@ local function getbestsuffix(rpmvar, value)
   return best
 end
 
--- https://github.com/rpm-software-management/rpm/issues/581
--- Writes the content of a list of rpm variables to a macro spec file.
--- The target file must contain the corresponding anchors.
--- For example writevars("myfile", {"foo","bar"}) will replace:
---   @@FOO@@ with the rpm evaluation of %{foo} and
---   @@BAR@@ with the rpm evaluation of %{bar}
--- in myfile
+-- %writevars core
 local function writevars(macrofile, rpmvars)
   for _, rpmvar in ipairs(rpmvars) do
     print("sed -i 's\029" .. string.upper("@@" .. rpmvar .. "@@") ..
@@ -150,8 +181,9 @@ local function wordwrap(text)
     for word in string.gmatch(line, "%s*[^%s]*\n?") do
       local wl, bad = utf8.len(word)
       if not wl then
-        print("%{warn: Invalid UTF-8 sequence detected in:\n" ..
-               word .. "\nIt may produce unexpected results.\n}")
+        print("%{warn:Invalid UTF-8 sequence detected in:}" ..
+              "%{warn:" .. word .. "}" ..
+              "%{warn:It may produce unexpected results.}")
         wl = bad
       end
       if (pos == 0) then
@@ -182,7 +214,71 @@ local function wordwrap(text)
   return output
 end
 
+-- Because rpmbuild will fail if a subpackage is declared before the source
+-- package itself, provide a source package declaration shell as fallback.
+local function srcpkg(verbose)
+  if verbose then
+    rpm.expand([[
+%{echo:Creating a header for the SRPM from %%{source_name}, %%{source_summary} and}
+%{echo:%%{source_description}. If that is not the intended result, please declare the}
+%{echo:SRPM header and set %%{source_name} in your spec file before calling a macro}
+%{echo:that creates other package headers.}
+]])
+  end
+  print(rpm.expand([[
+Name:           %{source_name}
+Summary:        %{source_summary}
+%description
+%wordwrap -v source_description
+]]))
+  explicitset("currentname", "%{source_name}", verbose)
+end
+
+-- %new_package core
+local function new_package(source_name, pkg_name, name_suffix, first, verbose)
+  -- Safety net when the wrapper is used in conjunction with traditional syntax
+  if (not first) and (not source_name) then
+    rpm.expand([[
+%{warn:Something already set a package name. However, %%{source_name} is not set.}
+%{warn:Please set %%{source_name} to the SRPM name to ensure reliable processing.}
+]])
+    if name_suffix then
+      print(rpm.expand("%package        " .. name_suffix))
+    else
+      print(rpm.expand("%package     -n " .. pkg_name))
+    end
+    return
+  end
+  -- New processing
+  if not (pkg_name or name_suffix or source_name) then
+    rpm.expand([[
+%{error:You need to set %%{source_name} or provide explicit package naming!}
+]])
+  end
+  if name_suffix then
+    print(rpm.expand("%package        "  .. name_suffix))
+    explicitset("currentname", "%{source_name}-" .. name_suffix, verbose)
+  else
+    if not source_name then
+      source_name = pkg_name
+    end
+    if (pkg_name == source_name) then
+      safeset("source_name", source_name, verbose)
+      print(rpm.expand("Name:           %{source_name}"))
+    else
+      if source_name and first then
+        srcpkg(verbose)
+      end
+      print(rpm.expand("%package     -n " .. pkg_name))
+    end
+    explicitset("currentname", pkg_name, verbose)
+  end
+end
+
 return {
+  read          = read,
+  hasflag       = hasflag,
+  readflag      = readflag,
   explicitset   = explicitset,
   explicitunset = explicitunset,
   safeset       = safeset,
@@ -194,4 +290,5 @@ return {
   getbestsuffix = getbestsuffix,
   writevars     = writevars,
   wordwrap      = wordwrap,
+  new_package   = new_package,
 }

dist.sh

@@ -25,7 +25,7 @@ function check_rhl {
 }
 
 function check_rhel {
-    egrep -q "(Enterprise|Advanced)" $RELEASEFILE && echo $DISTNUM
+    grep -Eq "(Enterprise|Advanced|CentOS)" $RELEASEFILE && echo $DISTNUM
 }
 
 function check_fedora {

find-provides.ksyms

@@ -1,24 +0,0 @@
-#! /bin/bash
-
-IFS=$'\n'
-
-for module in $(grep -E '/lib/modules/.+\.ko$'); do
-    if [[ -n $(nm $module | sed -r -ne 's:^0*([0-9a-f]+) A __crc_(.+):0x\1 \2:p') ]]; then
-        nm $module \
-        | sed -r -ne 's:^0*([0-9a-f]+) A __crc_(.+):0x\1 \2:p' \
-        | awk --non-decimal-data '{printf("ksym(%s) = 0x%08x\n", $2, $1)}' \
-        | LC_ALL=C sort -u
-    else
-        ELFRODATA=$(readelf -R .rodata $module | awk '/0x/{printf $2$3$4$5}')
-        if [[ -n $(readelf -h $module | grep "little endian") ]]; then
-            RODATA=$(echo $ELFRODATA | sed 's/\(..\)\(..\)\(..\)\(..\)/\4\3\2\1/g')
-        else
-            RODATA=$ELFRODATA
-        fi
-        for sym in $(nm $module | sed -r -ne 's:^0*([0-9a-f]+) R __crc_(.+):0x\1 \2:p'); do
-            echo $sym $RODATA
-        done \
-        | awk --non-decimal-data '{printf("ksym(%s) = 0x%08s\n", $2, substr($3,($1*2)+1,8))}' \
-        | LC_ALL=C sort -u
-    fi
-done

find-requires.ksyms

@@ -1,74 +0,0 @@
-#! /bin/bash
-
-IFS=$'\n'
-
-# Extract all of the symbols provided by this module.
-all_provides() {
-    if [[ -n $(nm "$@" | sed -r -ne 's:^0*([0-9a-f]+) A __crc_(.+):0x\1 \2:p') ]]; then
-        nm "$@" \
-        | sed -r -ne 's:^0*([0-9a-f]+) A __crc_(.+):0x\1 \2:p' \
-        | awk --non-decimal-data '{printf("0x%08x\t%s\n", $1, $2)}' \
-        | LC_ALL=C sort -k2,2 -u
-    else
-        ELFRODATA=$(readelf -R .rodata "$@" | awk '/0x/{printf $2$3$4$5}')
-        if [[ -n $(readelf -h "$@" | grep "little endian") ]]; then
-            RODATA=$(echo $ELFRODATA | sed 's/\(..\)\(..\)\(..\)\(..\)/\4\3\2\1/g')
-        else
-            RODATA=$ELFRODATA
-        fi
-        for sym in $(nm "$@" | sed -r -ne 's:^0*([0-9a-f]+) R __crc_(.+):0x\1 \2:p'); do
-            echo $sym $RODATA
-        done \
-        | awk --non-decimal-data '{printf("0x%08s\t%s\n", substr($3,($1*2)+1,8), $2)}' \
-        | LC_ALL=C sort -k2,2 -u
-    fi
-}
-
-# Extract all of the requirements of this module.
-all_requires() {
-    for module in "$@"; do
-        set -- $(/sbin/modinfo -F vermagic "$module" | sed -e 's: .*::' -e q)
-        /sbin/modprobe --dump-modversions "$module" \
-        | awk --non-decimal-data '
-            BEGIN { FS = "\t" ; OFS = "\t" }
-            {printf("0x%08x\t%s\n", $1, $2)}' \
-        | sed -r -e 's:$:\t'"$1"':'
-    done \
-    | LC_ALL=C sort -k2,2 -u
-}
-
-# Filter out requirements fulfilled by the module itself.
-mod_requires() {
-    LC_ALL=C join -t $'\t' -j 2 -v 1 \
-        <(all_requires "$@") \
-        <(all_provides "$@") \
-    | LC_ALL=C sort -k1,1 -u
-}
-
-if ! [ -e /sbin/modinfo -a -e /sbin/modprobe ]; then
-    cat > /dev/null
-    exit 0
-fi
-
-modules=($(grep -E '/lib/modules/.+\.ko$'))
-if [ ${#modules[@]} -gt 0 ]; then
-    kernel=$(/sbin/modinfo -F vermagic "${modules[0]}" | sed -e 's: .*::' -e q)
-
-    # get all that kernel provides
-    symvers=$(mktemp -t ${0##*/}.XXXXX)
-
-    cat /usr/src/kernels/$kernel/Module.symvers | awk '
-        BEGIN { FS = "\t" ; OFS = "\t" }
-        { print $2 "\t" $1 }
-    ' \
-    | sed -r -e 's:$:\t'"$kernel"':' \
-    | LC_ALL=C sort -k1,1 -u > $symvers
-
-    # Symbols matching with the kernel get a "kernel" dependency
-    LC_ALL=C join -t $'\t' -j 1 $symvers <(mod_requires "${modules[@]}") | LC_ALL=C sort -u \
-    | awk '{ FS = "\t" ; OFS = "\t" } { print "kernel(" $1 ") = " $2 }'
-
-    # Symbols from elsewhere get a "ksym" dependency
-    LC_ALL=C join -t $'\t' -j 1 -v 2 $symvers <(mod_requires "${modules[@]}") | LC_ALL=C sort -u \
-    | awk '{ FS = "\t" ; OFS = "\t" } { print "ksym(" $1 ") = " $2 }'
-fi

firmware.prov

@@ -1,14 +0,0 @@
-#!/bin/sh
-#
-# firmware.prov - Automatically extract any and all firmware dependencies from
-#                 kernel object (.ko) files and add to RPM deps.
-
-IFS=$'\n'
-
-for module in $(grep -E '/lib/modules/.+\.ko$') $*;
-do
-    for firmware in `/sbin/modinfo -F firmware $module`;
-    do
-        echo "firmware($firmware)"
-    done
-done

forge.lua

@@ -31,6 +31,9 @@ local function checkforgeurl(url, id, silent)
     pagure_ns_fork = {
       pattern     = 'https://[^/]+/fork/[^/]+/[^/]+/[^/#?]+',
       description = 'https://pagure.io/fork/owner/namespace/repo'},
+    ["gitea.com"] = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://gitea.com/owner/repo'},
     github = {
       pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
       description = 'https://(…[-.])github[-.]…/owner/repo'},
@@ -39,7 +42,10 @@ local function checkforgeurl(url, id, silent)
       description = 'https://code.googlesource.com/…/repo'},
     ["bitbucket.org"] = {
       pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
-      description = 'https://bitbucket.org/owner/repo'}}
+      description = 'https://bitbucket.org/owner/repo'},
+    sourcehut = {
+      pattern     = 'https://[^/]+/~[^/]+/[^/#?]+',
+      description = 'https://git.sr.ht/~owner/repo'}}
   if (urlpatterns[id] ~= nil) then
     checkedurl = string.match(url,urlpatterns[id]["pattern"])
     if (checkedurl == nil) then
@@ -78,6 +84,8 @@ local function idforge(url, silent)
         forge = "gitlab"
       elseif (string.match(forge, "^github[%.-]") or string.match(forge, "[%.-]github[%.]")) then
         forge = "github"
+        elseif  string.match(url, "[^:]+://git.sr.ht/") then
+        forge = "sourcehut"
       end
       forgeurl, forge = checkforgeurl(url, forge, silent)
     end
@@ -129,6 +137,11 @@ local function meta(suffix, verbose, informative, silent)
       repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/[^/]+/[^/]+/([^/?#]+)")}',
       archivename = "%{owner"        .. suffix .. "}-%{namespace"     .. suffix .. "}-%{repo"        .. suffix .. "}-%{ref"        .. suffix .. "}",
       archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    ["gitea.com"] = {
+      archiveext  = "tar.gz",
+      archivename = "%{fileref"      .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}.%{archiveext" .. suffix .. "}",
+      topdir      = "%{repo}" },
     github = {
       archiveext  = "tar.gz",
       archivename = "%{repo"         .. suffix .. "}-%{fileref"       .. suffix .. "}",
@@ -142,7 +155,12 @@ local function meta(suffix, verbose, informative, silent)
       shortcommit = '%{lua:print(string.sub(rpm.expand("%{commit'     .. suffix .. '}"), 1, 12))}',
       owner       = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/([^/?#]+)"))}',
       archivename = "%{owner"        .. suffix .. "}-%{repo"          .. suffix .. "}-%{shortcommit" .. suffix .. "}",
-      archiveurl  = "%{forgeurl"     .. suffix .. "}/get/%{ref"       .. suffix .. "}.%{archiveext"  .. suffix .. "}" } }
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/get/%{ref"       .. suffix .. "}.%{archiveext"  .. suffix .. "}" }, 
+    sourcehut = {
+      archiveext  = "tar.gz",
+      archivename = "%{repo"         .. suffix .. "}-%{fileref"       .. suffix .. "}",
+      archiveurl = "%{forgeurl"      .. suffix .. "}/archive/%{ref"   .. suffix .. "}.%{archiveext"  .. suffix .. "}",
+      topdir     = "%{repo"          .. suffix .. "}-%{ref"           .. suffix .. "}" } }
   -- Packaging a moving branch is quite a bad idea, but since at least Gitlab
   -- will treat branches and tags the same way better support branches explicitly
   -- than have packagers hijack %{tag} to download branch states
@@ -191,6 +209,11 @@ local function meta(suffix, verbose, informative, silent)
         fileref = string.gsub(rpm.expand(fileref), "/", "-")
       end
       fedora.safeset("fileref" .. suffix, fileref, verbose)
+    elseif (forge == "gitea.com") then
+      -- Workaround the way gitea mangles /s in ref names
+      local fileref = ref
+      fileref = string.gsub(rpm.expand(fileref), "/", "-")
+      fedora.safeset("fileref" .. suffix, fileref, verbose)
     elseif (forge == "code.googlesource.com") then
       if (ref == "%{?version"  .. suffix .. "}") then
         ref = "v" .. ref
@@ -199,6 +222,15 @@ local function meta(suffix, verbose, informative, silent)
       if (spec["commit"] == "") then
         rpm.expand("%{error:All BitBucket URLs require commit value knowledge: you need to define %{commit}!}")
       end
+    elseif (forge == "sourcehut") then
+      local fileref = ref
+      if (fileref ~= "%{?commit" .. suffix .. "}") and
+             string.match(rpm.expand(fileref), "^v[%d]") then
+        fileref = string.gsub(rpm.expand(fileref), "^v", "")
+      elseif (string.match(rpm.expand(fileref), "/")) then
+        fileref = string.gsub(rpm.expand(fileref), "/", "-")
+      end
+      fedora.safeset("fileref" .. suffix, fileref, verbose)
     end
     fedora.safeset("ref" .. suffix, ref, verbose)
     -- Mass setting of the remaining variables

gating.yaml

@@ -0,0 +1,12 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_testing
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

kmod.attr

@@ -1,2 +0,0 @@
-%__kmod_provides       %{_rpmconfigdir}/kmod.prov
-%__kmod_path           ^/lib/modules/.*$

kmod.prov

@@ -1,28 +0,0 @@
-#!/bin/sh +x
-# Kernel build can have many thousands of modules.
-# kmod.prov is run for every one of them.
-# Try to make this script run as fast as we can.
-# For example, use shell string ops instead of external programs
-# where possible.
-
-IFS=$'\n'
-
-read -r fname || exit
-
-# Only process files from .../lib/modules/... subtree
-[ "${fname#*/lib/modules/*}" != "$fname" ] || exit 0
-
-kmod=${fname##*/}  # like basename, but faster
-
-if [ "$kmod" = "modules.builtin" ]; then
-        for j in $(cat -- "$fname"); do
-                echo "kmod(${j##*/})"
-        done
-        exit 0
-fi
-
-kmod=${kmod%.gz}
-kmod=${kmod%.xz}
-if [ "${kmod%.ko}" != "$kmod" ]; then
-        echo "kmod($kmod)"
-fi

kmodtool

@@ -1,267 +0,0 @@
-#!/bin/bash
-
-# kmodtool - Helper script for building kernel module RPMs
-# Copyright (c) 2003-2006 Ville Skyttä <ville.skytta@iki.fi>,
-#                         Thorsten Leemhuis <fedora@leemhuis.info>
-#                         Jon Masters <jcm@redhat.com>
-#
-# Permission is hereby granted, free of charge, to any person obtaining
-# a copy of this software and associated documentation files (the
-# "Software"), to deal in the Software without restriction, including
-# without limitation the rights to use, copy, modify, merge, publish,
-# distribute, sublicense, and/or sell copies of the Software, and to
-# permit persons to whom the Software is furnished to do so, subject to
-# the following conditions:
-#
-# The above copyright notice and this permission notice shall be
-# included in all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-shopt -s extglob
-
-myprog="kmodtool"
-myver="0.10.10_kmp2"
-knownvariants=@(BOOT|PAE|@(big|huge)mem|debug|enterprise|kdump|?(large)smp|uml|xen[0U]?(-PAE)|xen)
-kmod_name=
-kver=
-verrel=
-variant=
-kmp=
-
-get_verrel ()
-{
-  verrel=${1:-$(uname -r)}
-  verrel=${verrel%%$knownvariants}
-}
-
-print_verrel ()
-{
-  get_verrel $@
-  echo "${verrel}"
-}
-
-get_variant ()
-{
-  get_verrel $@
-  variant=${1:-$(uname -r)}
-  variant=${variant##$verrel}
-  variant=${variant:-'""'}
-}
-
-print_variant ()
-{
-  get_variant $@
-  echo "${variant}"
-}
-
-get_rpmtemplate ()
-{
-    local variant="${1}"
-    local dashvariant="${variant:+-${variant}}"
-    case "$verrel" in
-        *.el*) kdep="kernel${dashvariant}-%{_target_cpu} = ${verrel}" ;;
-        *.EL*) kdep="kernel${dashvariant}-%{_target_cpu} = ${verrel}" ;;
-        *)     kdep="kernel-%{_target_cpu} = ${verrel}${variant}"     ;;
-    esac
-
-    echo "%package       -n kmod-${kmod_name}${dashvariant}"
-
-    if [ -z "$kmp_provides_summary" ]; then
-        echo "Summary:          ${kmod_name} kernel module(s)"
-    fi
-
-    if [ -z "$kmp_provides_group" ]; then
-        echo "Group:            System Environment/Kernel"
-    fi
-
-    if [ ! -z "$kmp_version" ]; then
-        echo "Version: %{kmp_version}"
-    fi
-
-    if [ ! -z "$kmp_release" ]; then
-        echo "Release: %{kmp_release}"
-    fi
-
-    if [ ! -z "$kmp" ]; then
-        echo "%global _use_internal_dependency_generator 0"
-    fi
-
-    cat <<EOF
-Provides:         kernel-modules = ${verrel}${variant}
-Provides:         ${kmod_name}-kmod = %{?epoch:%{epoch}:}%{version}-%{release}
-EOF
-
-    if [ -z "$kmp" ]; then
-        echo "Requires:         ${kdep}"
-    fi
-
-#
-# RHEL5 - Remove common package requirement on general kmod packages.
-# Requires: ${kmod_name}-kmod-common >= %{?epoch:%{epoch}:}%{version}
-#
-
-    cat <<EOF
-Requires(post):   /sbin/depmod
-Requires(postun): /sbin/depmod
-EOF
-
-if [ "no" != "$kmp_nobuildreqs" ]
-then
-    echo "BuildRequires: kernel${dashvariant}-devel-%{_target_cpu} = ${verrel}"
-fi
-
-if [ "" != "$kmp_override_preamble" ]
-then
-    cat "$kmp_override_preamble"
-fi
-
-cat <<EOF
-%description   -n kmod-${kmod_name}${dashvariant}
-This package provides the ${kmod_name} kernel modules built for the Linux
-kernel ${verrel}${variant} for the %{_target_cpu} family of processors.
-%post          -n kmod-${kmod_name}${dashvariant}
-if [ -e "/boot/System.map-${verrel}${variant}" ]; then
-    /sbin/depmod -aeF "/boot/System.map-${verrel}${variant}" "${verrel}${variant}" > /dev/null || :
-fi
-EOF
-
-    if [ ! -z "$kmp" ]; then
-        cat <<EOF
-
-modules=( \$(find /lib/modules/${verrel}${variant}/extra/${kmod_name}) )
-if [ -x "/sbin/weak-modules" ]; then
-    printf '%s\n' "\${modules[@]}" \
-    | /sbin/weak-modules --add-modules
-fi
-%preun         -n kmod-${kmod_name}${dashvariant}
-rpm -ql kmod-${kmod_name}${dashvariant} | grep '\.ko$' \
-    > /var/run/rpm-kmod-${kmod_name}${dashvariant}-modules
-EOF
-
-    fi
-
-    cat <<EOF
-%postun        -n kmod-${kmod_name}${dashvariant}
-/sbin/depmod -aF /boot/System.map-${verrel}${variant} ${verrel}${variant} &> /dev/null || :
-EOF
-
-    if [ ! -z "$kmp" ]; then
-        cat <<EOF
-modules=( \$(cat /var/run/rpm-kmod-${kmod_name}${dashvariant}-modules) )
-#rm /var/run/rpm-kmod-${kmod_name}${dashvariant}-modules
-if [ -x "/sbin/weak-modules" ]; then
-    printf '%s\n' "\${modules[@]}" \
-    | /sbin/weak-modules --remove-modules
-fi
-EOF
-    fi
-
-echo "%files         -n kmod-${kmod_name}${dashvariant}"
-
-if [ "" == "$kmp_override_filelist" ];
-then
-    echo "%defattr(644,root,root,755)"
-    echo "/lib/modules/${verrel}${variant}/"
-    echo "/lib/firmware/"
-else
-    cat "$kmp_override_filelist"
-fi
-}
-
-print_rpmtemplate ()
-{
-  kmod_name="${1}"
-  shift
-  kver="${1}"
-  get_verrel "${1}"
-  shift
-  if [ -z "${kmod_name}" ] ; then
-    echo "Please provide the kmodule-name as first parameter." >&2
-    exit 2
-  elif [ -z "${kver}" ] ; then
-    echo "Please provide the kver as second parameter." >&2
-    exit 2
-  elif [ -z "${verrel}" ] ; then
-    echo "Couldn't find out the verrel." >&2
-    exit 2
-  fi
-
-  for variant in "$@" ; do
-      if [ "default" == "$variant" ];
-      then
-            get_rpmtemplate ""
-      else
-            get_rpmtemplate "${variant}"
-      fi
-  done
-}
-
-usage ()
-{
-  cat <<EOF
-You called: ${invocation}
-
-Usage: ${myprog} <command> <option>+
- Commands:
-  verrel <uname>
-    - Get "base" version-release.
-  variant <uname>
-    - Get variant from uname.
-  rpmtemplate <mainpgkname> <uname> <variants>
-    - Return a template for use in a source RPM
-  rpmtemplate_kmp <mainpgkname> <uname> <variants>
-    - Return a template for use in a source RPM with KMP dependencies
-  version
-    - Output version number and exit.
-EOF
-}
-
-invocation="$(basename ${0}) $@"
-while [ "${1}" ] ; do
-  case "${1}" in
-    verrel)
-      shift
-      print_verrel $@
-      exit $?
-      ;;
-    variant)
-      shift
-      print_variant $@
-      exit $?
-      ;;
-    rpmtemplate)
-      shift
-      print_rpmtemplate "$@"
-      exit $?
-      ;;
-    rpmtemplate_kmp)
-      shift
-      kmp=1
-      print_rpmtemplate "$@"
-      exit $?
-      ;;
-    version)
-      echo "${myprog} ${myver}"
-      exit 0
-      ;;
-    *)
-      echo "Error: Unknown option '${1}'." >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-# Local variables:
-# mode: sh
-# sh-indentation: 2
-# indent-tabs-mode: nil
-# End:
-# ex: ts=2 sw=2 et

macros

@@ -12,6 +12,7 @@
 #      from the defaults.
 #
 %_localstatedir		/var
+%_runstatedir		/run
 
 %_pkgdocdir             %{_docdir}/%{name}
 %_docdir_fmt            %%{NAME}
@@ -19,6 +20,7 @@
 %_fmoddir		%{_libdir}/gfortran/modules
 
 %source_date_epoch_from_changelog 1
+%clamp_mtime_to_source_date_epoch %source_date_epoch_from_changelog
 
 %_enable_debug_packages 1
 %_include_minidebuginfo 1
@@ -26,31 +28,62 @@
 %_debugsource_packages  1
 %_debuginfo_subpackages 1
 
+# GCC toolchain
+%__cc_gcc gcc
+%__cxx_gcc g++
+%__cpp_gcc gcc -E
+
+# Clang toolchain
+%__cc_clang clang
+%__cxx_clang clang++
+%__cpp_clang clang-cpp
+
+# Default to the GCC toolchain
+%toolchain gcc
+
+%__cc %{expand:%%{__cc_%{toolchain}}}
+%__cxx %{expand:%%{__cxx_%{toolchain}}}
+%__cpp %{expand:%%{__cpp_%{toolchain}}}
+
+# Compiler macros to use for invoking compilers in spec files for packages that
+# want to use the default compiler and don't care which compiler that is.
+%build_cc %{__cc}
+%build_cxx %{__cxx}
+%build_cpp %{__cpp}
+
 #==============================================================================
 # ---- compiler flags.
 
 # C compiler flags.  This is traditionally called CFLAGS in makefiles.
 # Historically also available as %%{optflags}, and %%build sets the
 # environment variable RPM_OPT_FLAGS to this value.
-%build_cflags %{optflags}
+%build_cflags %{__build_flags_lang_c} %{?_distro_extra_cflags}
 
 # C++ compiler flags.  This is traditionally called CXXFLAGS in makefiles.
-%build_cxxflags %{optflags}
+%build_cxxflags %{__build_flags_lang_cxx} %{?_distro_extra_cxxflags}
 
 # Fortran compiler flags.  Makefiles use both FFLAGS and FCFLAGS as
 # the corresponding variable names.
-%build_fflags %{optflags} -I%{_fmoddir}
+%build_fflags %{__build_flags_common} -I%{_fmoddir} %{?_distro_extra_fflags}
+
+# Vala compiler flags. This is used to set VALAFLAGS.
+%build_valaflags -g
+
+# When clang is used as a linker driver, it does not auto-detect the LTO
+# bytecode and neither does bfd, so we need to explicitly pass the -flto
+# flag when linking.
+%_clang_extra_ldflags %{?_lto_cflags}
 
 # Link editor flags.  This is usually called LDFLAGS in makefiles.
 # (Some makefiles use LFLAGS instead.)  The default value assumes that
 # the flags, while intended for ld, are still passed through the gcc
 # compiler driver.  At the beginning of %%build, the environment
 # variable RPM_LD_FLAGS to this value.
-%build_ldflags -Wl,-z,relro %{_ld_as_needed_flags} %{_ld_symbols_flags} %{_hardened_ldflags}
+%build_ldflags -Wl,-z,relro %{_ld_as_needed_flags} %{_ld_symbols_flags} %{_hardened_ldflags} %{_annotation_ldflags} %[ "%{toolchain}" == "clang" ? "%{?_clang_extra_ldflags}" : "" ] %{_build_id_flags} %{?_package_note_flags} %{?_distro_extra_ldflags}
 
-# Expands to shell code to seot the compiler/linker environment
-# variables CFLAGS, CXXFLAGS, FFLAGS, FCFLAGS, LDFLAGS if they have
-# not been set already.  RPM_OPT_FLAGS and RPM_LD_FLAGS have already
+# Expands to shell code to set the compiler/linker environment
+# variables CFLAGS, CXXFLAGS, FFLAGS, FCFLAGS, VALAFLAGS, LDFLAGS if they
+# have not been set already.  RPM_OPT_FLAGS and RPM_LD_FLAGS have already
 # been set implicitly at the start of the %%build section.
 # LT_SYS_LIBRARY_PATH is used by libtool script.
 %set_build_flags \
@@ -58,15 +91,34 @@
   CXXFLAGS="${CXXFLAGS:-%{build_cxxflags}}" ; export CXXFLAGS ; \
   FFLAGS="${FFLAGS:-%{build_fflags}}" ; export FFLAGS ; \
   FCFLAGS="${FCFLAGS:-%{build_fflags}}" ; export FCFLAGS ; \
+  VALAFLAGS="${VALAFLAGS:-%{build_valaflags}}" ; export VALAFLAGS ; \
+  RUSTFLAGS="${RUSTFLAGS:-%{build_rustflags}}" ; export RUSTFLAGS ; \
   LDFLAGS="${LDFLAGS:-%{build_ldflags}}" ; export LDFLAGS ; \
-  LT_SYS_LIBRARY_PATH="${LT_SYS_LIBRARY_PATH:-%_libdir:}" ; export LT_SYS_LIBRARY_PATH
+  LT_SYS_LIBRARY_PATH="${LT_SYS_LIBRARY_PATH:-%_libdir:}" ; export LT_SYS_LIBRARY_PATH ; \
+  CC="${CC:-%{__cc}}" ; export CC ; \
+  CXX="${CXX:-%{__cxx}}" ; export CXX
+
+# Automatically use set_build_flags macro for build, check, and
+# install phases.
+# Use "%undefine _auto_set_build_flags" to disable"
+%_auto_set_build_flags 1
+%__spec_build_pre %{___build_pre} \
+  %{?_auto_set_build_flags:%{set_build_flags}} \
+  %{?_generate_package_note_file}
+
+%__spec_check_pre %{___build_pre} \
+  %{?_auto_set_build_flags:%{set_build_flags}} \
+  %{?_generate_package_note_file}
 
 # Internal-only.  Do not use.  Expand a variable and strip the flags
 # not suitable to extension builders.
 %__extension_strip_flags() %{lua:
 local name = rpm.expand("%{1}")
 local value = " " .. rpm.expand("%{build_" .. name .. "}")
-local result = string.gsub(value, "%s+-specs=[^%s]+", " ")
+local specs_pattern = "%s+-specs=[^%s]+"
+local lto_flags_pattern = rpm.expand("%{?_lto_cflags}"):gsub("[%-%.]", "%%%1")
+local package_note_flags_pattern = "%-Wl,%S*package_note%S*"
+local result = value:gsub(specs_pattern, " "):gsub(lto_flags_pattern, ""):gsub(package_note_flags_pattern, "")
 print(result)
 }
 
@@ -84,6 +136,17 @@ print(result)
 %__global_fcflags %{build_fflags}
 %__global_ldflags %{build_ldflags}
 
+# Architecture-specific support.  Internal.  Do not use directly.
+
+%__cflags_arch_x86_64_v2 %[0%{?rhel} == 9 ? "-march=x86-64-v2" : ""]
+%__cflags_arch_x86_64_v3 %[0%{?rhel} > 9 ? "-march=x86-64-v3" : ""]
+%__cflags_arch_x86_64 %{__cflags_arch_x86_64_v2} %{__cflags_arch_x86_64_v3}
+
+# Also used for s390.
+%__cflags_arch_s390x %[0%{?rhel} >= 9 ? "-march=z14 -mtune=z15" : "-march=z13 -mtune=z14"]
+
+%__cflags_arch_ppc64le %[0%{?rhel} >= 9 ? "-mcpu=power9 -mtune=power9" : "-mcpu=power8 -mtune=power8"]
+
 #==============================================================================
 # ---- configure and makeinstall.
 #
@@ -94,8 +157,52 @@ print(result)
 # Eventually we'll want to turn this on by default, but this gives packagers a
 # way to turn it back off.
 # %_configure_disable_silent_rules 1
+
+# Pass --runstatedir to configure.
+%_configure_use_runstatedir 1
+
+# This fixes various easy resolved configure tests that are compromised by LTO.
+#
+# We use this within the standard %configure macro, but also make it available
+# for packages which don't use %configure
+#
+# The first three are common ways to test for the existence of a function, so
+# we ensure the reference to the function is preserved
+#
+# The fourth are constants used to then try to generate NaNs and other key
+# floating point numbers.  We then use those special FP numbers to try and
+# raise a SIGFPE.  By declaring x & y volatile we prevent the optimizers
+# from removing the computation
+#
+# The fifth (and worst) addresses problems with autoconf/libtool's approach
+# to extracting symbols from .o files and generating C code.  In an LTO world
+# types matter much more closely and you can't have an object in one context
+# that is a function definition and a simple scalar variable in another.
+# Thankfully HP-UX has always had that restriction and is supported by
+# autoconf/libtool.  The insane sed script replaces the "generic" code with
+# the HP-UX version.
+#
+# If we do not make changes, we put the original file back.  This avoids
+# unnecessary rebuilds of things that may have dependencies on the configure
+# files.
+#
+%_fix_broken_configure_for_lto \
+  for file in $(find . -type f -name configure -print); do \
+    %{__sed} -r --in-place=.backup 's/^char \\(\\*f\\) \\(\\) = /__attribute__ ((used)) char (*f) () = /g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} -r --in-place=.backup 's/^char \\(\\*f\\) \\(\\);/__attribute__ ((used)) char (*f) ();/g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} -r --in-place=.backup 's/^char \\$2 \\(\\);/__attribute__ ((used)) char \\$2 ();/g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} --in-place=.backup '1{$!N;$!N};$!N;s/int x = 1;\\nint y = 0;\\nint z;\\nint nan;/volatile int x = 1; volatile int y = 0; volatile int z, nan;/;P;D' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} --in-place=.backup 's#^lt_cv_sys_global_symbol_to_cdecl=.*#lt_cv_sys_global_symbol_to_cdecl="sed -n -e '"'"'s/^T .* \\\\(.*\\\\)$/extern int \\\\1();/p'"'"' -e '"'"'s/^$symcode* .* \\\\(.*\\\\)$/extern char \\\\1;/p'"'"'"#' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+  done
+
 %configure \
   %{set_build_flags}; \
+  [ "%{_lto_cflags}"x != x ] && %{_fix_broken_configure_for_lto}; \
   [ "%_configure_gnuconfig_hack" = 1 ] && for i in $(find $(dirname %{_configure}) -name config.guess -o -name config.sub) ; do \
       [ -f /usr/lib/rpm/redhat/$(basename $i) ] && %{__rm} -f $i && %{__cp} -fv /usr/lib/rpm/redhat/$(basename $i) $i ; \
   done ; \
@@ -117,6 +224,7 @@ print(result)
 	--libdir=%{_libdir} \\\
 	--libexecdir=%{_libexecdir} \\\
 	--localstatedir=%{_localstatedir} \\\
+	%{?_configure_use_runstatedir:$(grep -q "runstatedir=DIR" %{_configure} && echo '--runstatedir=%{_runstatedir}')} \\\
 	--sharedstatedir=%{_sharedstatedir} \\\
 	--mandir=%{_mandir} \\\
 	--infodir=%{_infodir}
@@ -131,8 +239,9 @@ print(result)
 
 %__spec_install_pre %{___build_pre}\
     [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf "${RPM_BUILD_ROOT}"\
-    mkdir -p `dirname "$RPM_BUILD_ROOT"`\
+    mkdir -p "`dirname "$RPM_BUILD_ROOT"`"\
     mkdir "$RPM_BUILD_ROOT"\
+    %{?_auto_set_build_flags:%{set_build_flags}}\
 %{nil}
 
 #---------------------------------------------------------------------
@@ -149,14 +258,19 @@ print(result)
 %__brp_strip_lto /usr/lib/rpm/redhat/brp-strip-lto %{__strip}
 %__brp_strip_comment_note /usr/lib/rpm/brp-strip-comment-note %{__strip} %{__objdump}
 %__brp_strip_static_archive /usr/lib/rpm/brp-strip-static-archive %{__strip}
-%__brp_python_bytecompile /usr/lib/rpm/redhat/brp-python-bytecompile "%{__python}" "%{?_python_bytecompile_errors_terminate_build}" "%{?_python_bytecompile_extra}"
-%__brp_python_hardlink /usr/lib/rpm/brp-python-hardlink
+%__brp_check_rpaths /usr/lib/rpm/check-rpaths
 # __brp_mangle_shebangs_exclude - shebangs to exclude
 # __brp_mangle_shebangs_exclude_file - file from which to get shebangs to exclude
 # __brp_mangle_shebangs_exclude_from - files to ignore
 # __brp_mangle_shebangs_exclude_from_file - file from which to get files to ignore
 %__brp_mangle_shebangs /usr/lib/rpm/redhat/brp-mangle-shebangs %{?__brp_mangle_shebangs_exclude:--shebangs "%{?__brp_mangle_shebangs_exclude}"} %{?__brp_mangle_shebangs_exclude_file:--shebangs-from "%{__brp_mangle_shebangs_exclude_file}"} %{?__brp_mangle_shebangs_exclude_from:--files "%{?__brp_mangle_shebangs_exclude_from}"} %{?__brp_mangle_shebangs_exclude_from_file:--files-from "%{__brp_mangle_shebangs_exclude_from_file}"}
 
+%__brp_llvm_compile_lto_elf /usr/lib/rpm/redhat/brp-llvm-compile-lto-elf %{build_cflags} %{build_ldflags}
+
+# note: %%__os_install_post_python is defined in python-srpm-macros and contains several policies
+# redhat-rpm-config maintainers, don't remove it from %%__os_install_post unless coordinating the change with Python maintainers
+# packagers, don't undefine the entire macro, see the individual macros in /usr/lib/rpm/macros.d/macros.python-srpm
+
 %__os_install_post    \
     %{?__brp_ldconfig} \
     %{?__brp_compress} \
@@ -166,12 +280,14 @@ print(result)
     } \
     %{?__brp_strip_lto} \
     %{?__brp_strip_static_archive} \
-    %{?py_auto_byte_compile:%{?__brp_python_bytecompile}} \
-    %{?__brp_python_hardlink} \
+    %{?__brp_check_rpaths} \
     %{?__brp_mangle_shebangs} \
+    %{?__brp_remove_la_files} \
+    %{__os_install_post_python} \
 %{nil}
 
 %__spec_install_post\
+    %[ "%{toolchain}" == "clang" ? "%{?__brp_llvm_compile_lto_elf}" : "%{nil}" ] \
     %{?__debug_package:%{__debug_install_post}}\
     %{__arch_install_post}\
     %{__os_install_post}\
@@ -185,16 +301,6 @@ print(result)
 # Should missing buildids terminate a build?
 %_missing_build_ids_terminate_build    1
 
-#
-## Automatically compile python files
-%py_auto_byte_compile 1
-
-#
-## Should python bytecompilation errors terminate a build?
-%_python_bytecompile_errors_terminate_build 1
-## Should python bytecompilation compile outisde python specific directories?
-%_python_bytecompile_extra 0
-
 # Use SHA-256 for FILEDIGESTS instead of default MD5
 %_source_filedigest_algorithm 8
 %_binary_filedigest_algorithm 8
@@ -202,24 +308,49 @@ print(result)
 # Use Zstandard compression for binary payloads
 %_binary_payload w19.zstdio
 
-%_hardening_cflags	-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
-# we don't escape symbols '~', '"', etc. so be careful when changing this
-%_hardening_ldflags	-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
+#==============================================================================
+# --- Compiler flags control.
+#
+# Please consult buildflags.md for parts that can be configured
+# from RPM spec files.
 
-# Harden packages by default for Fedora 23:
+%_hardening_gcc_cflags   -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
+%_hardening_clang_cflags --config /usr/lib/rpm/redhat/redhat-hardened-clang.cfg
+%_hardening_cflags	 %{expand:%%{_hardening_%{toolchain}_cflags}} -fstack-protector-strong
+# we don't escape symbols '~', '"', etc. so be careful when changing this
+%_hardening_ldflags	 -Wl,-z,now %[ "%{toolchain}" == "gcc" ? "-specs=/usr/lib/rpm/redhat/redhat-hardened-ld" : "" ]
+
+# Harden packages by default for Fedora 23+:
 # https://fedorahosted.org/fesco/ticket/1384 (accepted on 2014-02-11)
 # Use "%undefine _hardened_build" to disable.
 %_hardened_build	1
 %_hardened_cflags	%{?_hardened_build:%{_hardening_cflags}}
 %_hardened_ldflags	%{?_hardened_build:%{_hardening_ldflags}}
 
-%_annobin_cflags	-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1
-
-# Add extra information to binary objects created by gcc for Fedora 28:
+# Add extra information to binary objects created by the compiler:
 # https://pagure.io/fesco/issue/1780 (accepted on 2017-10-30)
+# ...except on armv7hl, which has an issue whose root-cause isn't
+# clear yet: https://bugzilla.redhat.com/show_bug.cgi?id=1951492
 # Use "%undefine _annotated_build" to disable.
 %_annotated_build	1
-%_annotated_cflags	%{?_annotated_build:%{_annobin_cflags}}
+%_annobin_gcc_plugin	-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1
+# The annobin plugin is not built for clang yet
+%_annobin_clang_plugin	%dnl-fplugin=/usr/lib64/clang/`clang -dumpversion`/lib/annobin.so
+%_annotation_plugin     %{?_annotated_build:%{expand:%%{_annobin_%{toolchain}_plugin}}}
+%_annotation_cflags     %[ "%{_target_cpu}" == "armv7hl" ? "" : "%{_annotation_plugin}" ]
+%_annotation_ldflags	%{?_lto_cflags:%{_annotation_cflags}}
+# Use the remove-section option to force the find-debuginfo script
+# to move the annobin notes into the separate debuginfo file.
+%_find_debuginfo_extra_opts %{?_annotated_build:--remove-section .gnu.build.attributes}
+
+# Include frame pointer information by default, except on RHEL
+# https://fedoraproject.org/wiki/Changes/fno-omit-frame-pointer
+# Use "%undefine _include_frame_pointers" to disable.
+%_include_frame_pointers %{undefined rhel}
+%_frame_pointers_cflags %{expr:0%{?_include_frame_pointers} ? "-fno-omit-frame-pointer" : ""}
+%_frame_pointers_cflags_x86_64 %{expr:0%{?_include_frame_pointers} ? "-mno-omit-leaf-frame-pointer" : ""}
+%_frame_pointers_cflags_aarch64 %{expr:0%{?_include_frame_pointers} ? "-mno-omit-leaf-frame-pointer" : ""}
+%_frame_pointers_cflags_s390x %{expr:0%{?_include_frame_pointers} ? "-mbackchain" : ""}
 
 # Fail linking if there are undefined symbols.  Required for proper
 # ELF symbol versioning support.  Disabled by default.
@@ -232,10 +363,63 @@ print(result)
 %_ld_as_needed		1
 %_ld_as_needed_flags	%{?_ld_as_needed:-Wl,--as-needed}
 
-%__global_compiler_flags	-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches %{_hardened_cflags} %{_annotated_cflags}%{?_legacy_common_support: -fcommon}
+# LTO is the default in Fedora.
+#   "%define _lto_cflags %{nil}"  to opt out
+#
+# We currently have -ffat-lto-objects turned on out of an abundance of
+# caution.  To remove it we need to do a check of the installed .o/.a files
+# to verify they have real sections/symbols after LTO stripping.  That
+# way we can detect installing an unusable .o/.a file.  This is on the TODO
+# list for F34.
+%_gcc_lto_cflags	-flto=auto -ffat-lto-objects
+%_clang_lto_cflags	-flto=thin
+%_lto_cflags		%{expand:%%{_%{toolchain}_lto_cflags}}
+
+# Default fortification level.
+#   "%define _fortify_level 2" to downgrade and
+#   "%define _fortify_level 0" or "%undefine _fortify_level" to disable
+#
+# We use a single -Wp here to enforce order so that ccache does not ever
+# reorder them.
+%_fortify_level		3
+%_fortify_level_flags	%[ 0%{?_fortify_level} > 0 ? "-Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=%{_fortify_level}" : "" ]
+
+# This can be set to a positive integer to obtain increasing type
+# safety levels for C.  See buildflags.md.
+%build_type_safety_c 0
+
+# Some linkers default to a build-id algorithm that is not supported by rpmbuild,
+# so we need to specify the right algorithm to use.
+%_build_id_flags	-Wl,--build-id=sha1
+
+%_general_options       -O2 %{?_lto_cflags} -fexceptions -g -grecord-gcc-switches -pipe
+%_warning_options       -Wall%[%__build_for_lang_any && "%toolchain" == "gcc" ? " -Wno-complain-wrong-lang" : ""]%[%__build_for_lang_c + %__build_for_lang_cxx ? " -Werror=format-security" : ""]%[%__build_for_lang_c && (%build_type_safety_c >= 1) ? " -Werror=implicit-function-declaration -Werror=implicit-int" : ""]%[%__build_for_lang_c && (%build_type_safety_c >= 2) ? " -Werror=int-conversion" : ""]%[%__build_for_lang_c && (%build_type_safety_c >= 3) ? " -Werror=incompatible-pointer-types" : ""]
+%_preprocessor_defines  %{_fortify_level_flags} -Wp,-D_GLIBCXX_ASSERTIONS
+
+# Common variables are no longer generated by default by gcc and clang
+# If they are needed then add "%define _legacy_common_support 1" to the spec file.
+%_legacy_options	%{?_legacy_common_support: -fcommon}
+
+%__global_compiler_flags %{_general_options} %{_warning_options} %{_preprocessor_defines} %{_hardened_cflags} %{_annotation_cflags} %{_legacy_options}
+
+# Internal macros. Do not use directly.  These variables can be rebound
+# to suppress certain frontend-specific compiler flags (or in the case
+# of __build_for_lang_any, frontend-agnostic flags).  Dynamic scoping
+# and shadowing redefinitions are used for the __build_for_* variables
+# to remain largely compatible with existing spec files that have
+# hard-coded assumptions which macros assume which other macros.
+# The __build_flags_no_macro_warning construct suppresses a warning
+# about unused RPM macros.
+%__build_for_lang_c 1
+%__build_for_lang_cxx 1
+%__build_for_lang_any 1
+%__build_flags_no_macro_warning %[%__build_for_lang_c + %__build_for_lang_cxx + %__build_for_lang_any ? "" : ""]
+%__build_flags_common() %{expand:%define __build_for_lang_c 0}%{expand:%define __build_for_lang_cxx 0}%{expand:%define __build_for_lang_any 0}%{__build_flags_no_macro_warning}%{optflags}
+%__build_flags_lang_c() %{expand:%define __build_for_lang_cxx 0}%{expand:%define __build_for_lang_any 0}%{__build_flags_no_macro_warning}%{optflags}
+%__build_flags_lang_cxx() %{expand:%define __build_for_lang_c 0}%{expand:%define __build_for_lang_any 0}%{__build_flags_no_macro_warning}%{optflags}
 
 # Automatically trim changelog entries after 2 years
-%_changelog_trimtime	%{lua:print(os.time() - 2 * 365 * 86400)}
+%_changelog_trimage	%{expr:2*365*24*60*60}
 
 #==============================================================================
 # ---- Generic auto req/prov filtering macros
@@ -269,6 +453,3 @@ print(result)
 %global __find_provides /bin/sh -c "%{?__filter_prov_cmd} %{__deploop P} %{?__filter_from_prov}" \
 %global __find_requires /bin/sh -c "%{?__filter_req_cmd}  %{__deploop R} %{?__filter_from_req}" \
 }
-
-# Temporary shelter for rpm 4.15 refugees
-%requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")

macros.build-constraints

@@ -0,0 +1,103 @@
+# Macros to constrain resource use during the build process
+
+# Changes _smp_build_ncpus depending on various factors
+#
+# -c cpus  constrains the CPU count to "cpus"
+# -m mem   constrains the CPU count to the total amount of memory in the system
+#          (in megabytes) divided by "mem", rounded down
+#
+# If no options are passed, sets _smp_build_ncpus to 1.
+# _smp_build_ncpus will never be raised, only lowered.
+%constrain_build(c:m:) %{lua:
+
+  -- Check a value and clamp it to at least 1
+  local function check_and_clamp(v, string)
+    if v == nil then return nil end
+
+    i = math.tointeger(v)
+    if i == nil then
+      macros.error({"%%%0: invalid "..string.." value "..v})
+      return nil
+    end
+
+    local clamp = math.max(1, math.floor(i))
+    if i ~= clamp then
+      macros.error({"%%%0: invalid "..string.." value "..v})
+      return nil
+    end
+    return clamp
+  end
+
+  -- Parse meminfo to find the total amount of memory in the system
+  local function getmem()
+    local mem = 0
+    for l in io.lines('/proc/meminfo') do
+      if l:sub(1, 9) == "MemTotal:" then
+        mem = math.tointeger(string.match(l, "MemTotal:%s+(%d+)"))
+        break
+      end
+    end
+    return mem
+  end
+
+  local mem_limit = check_and_clamp(opt.m, "mem limit")
+  local cpu_limit = check_and_clamp(opt.c, "cpu limit")
+  local current_cpus = math.tointeger(macros._smp_build_ncpus)
+  local constrained_cpus = current_cpus
+
+  if (not cpu_limit and not mem_limit) then
+    cpu_limit = 1
+  end
+
+  if cpu_limit ~= nil then
+    constrained_cpus = math.min(cpu_limit, constrained_cpus)
+  end
+  if mem_limit ~= nil then
+    local mem_total = getmem(verbose)
+    local limit = math.max(1, mem_total // (mem_limit * 1024))
+    constrained_cpus = math.min(constrained_cpus, limit)
+  end
+
+  macros._smp_build_ncpus = constrained_cpus
+}
+
+# outputs build flag overrides to be used in conjunction with
+# %%make_build, %%cmake_build etc.
+#
+# if no override is needed, this macro outputs nothing
+#
+# - m   memory limit in MBs per core; default is 1024
+#
+# Usage:
+# e.g. %make_build %{limit_build -m 2048}
+#   => /usr/bin/make -O -j16 V=1 VERBOSE=1
+#      %make_build %{limit_build -m 40960}
+#   => /usr/bin/make -O -j16 V=1 VERBOSE=1 -j1
+# 
+%limit_build(m:) %{lua:
+  local mem_per_process=rpm.expand("%{-m*}")
+  if mem_per_process == "" then
+    mem_per_process = 1024
+  else
+    mem_per_process = tonumber(mem_per_process)
+  end
+  local mem_total = 0
+  for line in io.lines('/proc/meminfo') do
+    if line:sub(1, 9) == "MemTotal:" then
+      local tokens = {}
+      for token in line:gmatch("%w+") do
+        tokens[#tokens + 1] = token
+      end
+      mem_total = tonumber(tokens[2])
+      break
+    end
+  end
+  local max_jobs = mem_total // (mem_per_process * 1024)
+  if max_jobs < 1 then
+    max_jobs = 1
+  end
+  cur_max_jobs=tonumber(rpm.expand("%{_smp_build_ncpus}"))
+  if cur_max_jobs > max_jobs then
+    print("-j" .. max_jobs)
+  end
+}

macros.fedora-misc

@@ -1,16 +1,16 @@
-# Some miscellaneous Fedora-related macros
+# Fedora macros, safe to use after the SRPM build stage
 
-# List files matching inclusion globs, excluding files matching exclusion blogs
-# Optional parameters:
-#  – -i "<globs>" inclusion globs
-#  – -x "<globs>" exclusion globs
-# Globs are space-separated lists of shell globs. Such lists require %{quote:}
-# use for safe rpm argument passing.
-# Alternatively, set the following rpm variables before calling the macro:
-#  – “listfiles_include” inclusion globs
-#  — “listfiles_exclude” exclusion globs
-# Arguments passed to the macro without flags will be interpreted as inclusion
-# globs.
+# Lists files matching inclusion globs, excluding files matching exclusion
+# globs
+#   – globs are space-separated lists of shell globs. Such lists require
+#     %{quote:} use when passed as rpm arguments or flags.
+# Control variables, flags and arguments:
+#   %{listfiles_include}  inclusion globs
+#   %{listfiles_exclude}  exclusion globs
+#   -i <globs>            inclusion globs
+#   -x <globs>            exclusion globs
+#   …                     arguments passed to the macro without flags will be
+#                         interpreted as inclusion globs
 %listfiles(i:x:) %{expand:
 %if %{lua: print(string.len(rpm.expand("%{?-i*}%{?listfiles_include}%*")))}
   listfiles_include=$(realpath -e --relative-base=. %{?-i*} %{?listfiles_include} %* | sort -u)
@@ -26,12 +26,14 @@
 }
 
 # https://github.com/rpm-software-management/rpm/issues/581
-# Write the contents of a list of rpm variables to a macro file.
-# The target file must contain the corresponding anchors.
-# For example %writevars -f myfile foo bar will replace:
-#  @@FOO@@ with the rpm evaluation of %{foo} and
-#  @@BAR@@ with the rpm evaluation of %{bar}
-# in myfile
+# Writes the contents of a list of rpm variables to a macro file
+# Control variables, flags and arguments:
+#   -f <filename>  the macro file to process:
+#                    – it must contain corresponding anchors
+#                    – for example %writevars -f myfile foo bar will replace:
+#                        @@FOO@@ with the rpm evaluation of %{foo} and
+#                        @@BAR@@ with the rpm evaluation of %{bar}
+#                      in myfile
 %writevars(f:) %{lua:
 local    fedora = require "fedora.common"
 local macrofile = rpm.expand("%{-f*}")

macros.fedora-misc-srpm

@@ -1,4 +1,4 @@
-# Some miscellaneous Fedora-related macros
+# Fedora macros, safe to use at SRPM build stage
 
 # A directory for rpm macros
 %rpmmacrodir /usr/lib/rpm/macros.d
@@ -10,13 +10,34 @@
 # A directory for SWID tag files describing the installation
 %_swidtagdir %{_prefix}/lib/swidtag/fedoraproject.org
 
-# A helper to apply the fedora.wordwrap filter to the content of an rpm
-# variable, and print the result. Optional parameter:
-#  – -v <variable_name> (default value: _description)
-# Putting multiple lines of UTF-8 text inside a variable is usually
-# accomplished with a %%{expand: some_text}.
+# Applies the fedora.wordwrap filter to the content of an rpm variable, and
+# prints the result.
+#   – putting multiple lines of UTF-8 text inside a variable is usually
+#     accomplished with %{expand:some_text}
+# Control variables, flags and arguments:
+#   -v <variable_name>  (default value: _description)
 %wordwrap(v:) %{lua:
 local   fedora = require "fedora.common"
-local variable = "%{" .. rpm.expand("%{-v*}%{!-v:_description}") .. "}"
+local variable = "%{?" .. rpm.expand("%{-v*}%{!-v:_description}") .. "}"
 print(fedora.wordwrap(variable))
 }
+
+# A single Name: and %package substitute
+# Control variables, flags and arguments:
+#   %{source_name}         the SRPM name
+#   %{source_summary}      the SRPM summary
+#   %{source_description}  the SRPM description
+#   -n <name>              declare a package named <name>
+#                          (%package-like behavior)
+#   -v                     be verbose
+#   %1                     declare a package named %{source_name}-%{%1}
+#                          (%package-like behavior)
+%new_package(n:v) %{lua:
+local      fedora = require "fedora.common"
+local    pkg_name = fedora.readflag("n")
+local     verbose = fedora.hasflag("v")
+local name_suffix = fedora.read("1")
+local source_name = fedora.read("source_name")
+local       first = not ( fedora.read("name") or fedora.read("currentname") )
+fedora.new_package(source_name, pkg_name, name_suffix, first, verbose)
+}

macros.forge

@@ -1,50 +1,28 @@
-# Map forge information to rpm metadata. This macro will compute default spec
-# variable values.
-#
-# The following spec variables SHOULD be set before calling the macro:
-#
-#   forgeurl  the project url on the forge, strongly recommended;
-#   Version   if applicable, set it with Version: <version>
-#   tag       if applicable
-#   commit    if applicable
-#   date      if applicable (to override the mtime of the Source archive)
-#
-#  Use -z for multiple calls to the macro
-#
-# The macro will attempt to compute and set the following variables if they are
-# not already set by the packager:
-#
-#   forgesource    an URL that can be used as SourceX: value
-#   forgesetupargs the correct arguments to pass to %setup for this source
-#                  used by %forgesetup and %forgeautosetup
-#   archivename    the source archive filename, without extentions
-#   archiveext     the source archive filename extensions, without leading dot
-#   archiveurl     the url that can be used to download the source archive,
-#                  without renaming
-#   topdir         the source archive top directory (can be empty)
-#   extractdir     the source directory created inside %{_builddir} after using
-#                  %%forgesetup, %forgeautosetup or %{forgesetupargs}
-#   repo           the repository name
-#   owner          the repository owner (if used by another computed variable)
-#   shortcommit    the commit hash clamping used by the forge, if any
-#   scm            the scm type, when packaging code snapshots: commits or tags
-#   distprefix     the prefix that needs adding to dist to trace non-release packaging
-#
-# Most of the computed variables are both overridable and optional.
-#
-# Optional parameters:
-#   -a          process all sources in one go, instead of using separate -z calls
-#   -z <number> suffix all the read and written variable names with <number>
-#               for example read     forgeurl<number>, version<number>…
-#                       and generate forgesetupargs<number>, archiveurl<number>…
-#               The macro assumes that null or nil suffix is used for the primary
-#               package source.
-#   -s  Silently ignore problems in forgeurl, use it if it can be parsed,
-#       ignore it otherwise.
-#   -v  Be verbose and print every spec variable the macro sets.
-#   -i  Print some info about the state of spec variables the macro may use or
-#       set at the end of the processing.
-%forgemeta(az:sviu:) %{lua:
+# Computes forge-related variables for use in the rest of the spec file
+# Control variables, flags and arguments:
+#   %{forgeurl<number>}  the project url on the target forge
+#   %{tag<number>}       the packaged tag, OR
+#   %{commit<number>}    the packaged commit, OR
+#   %{version<number>}   the packaged version
+#                          – %{version}/%{version0} are set via:
+#                              Version:
+#                          – because git is lacking a built-in version
+#                            reference, %{version<number>} will be translated
+#                            into %{tag<number>} using unreliable heuristics;
+#                            set %{tag<number>} directly if those fail
+#   %{date<number>}      the packaged timestamp
+#   …                    %forgemeta will compute a huge number of variables:
+#                          — the packager can override it by setting some of
+#                            those before the %forgemeta call
+#                          – use the -i flag to list those variables
+#   -z <number>          only process the zth block of definitions
+#                        "" for the no-suffix block
+#   -i                   list the resulting variable values
+#   -s                   silently ignore problems in %{forgeurl<number>}
+#   -v                   be verbose
+#   -a                   process all sources in one go, instead of using
+#                        separate -z calls
+%forgemeta(z:isva) %{lua:
 local      fedora = require "fedora.common"
 local       forge = require "fedora.srpm.forge"
 local     verbose =  rpm.expand("%{-v}") ~= ""
@@ -60,12 +38,17 @@ else
 end
 }
 
-# Convenience macro to relay computed arguments to %setup
-# Optional parameters:
-#   -a          process all sources in one go, instead of using separate -z calls
-#   -z <number> read %{?forgesetupargs<number>}
-#   -v          be verbose
-%forgesetup(az:v) %{lua:
+# Unpacks sources computed by %forgemeta
+# Control variables, flags and arguments:
+#   %{forgesource<number>}       the source archive that will be processed
+#   %{forgesetupargs<number>}    %setup arguments
+
+#   -z <number>                  only process the zth block of definitions
+#                                "" for the no-suffix block
+#   -v                           be verbose
+#   -a                   process all sources in one go, instead of using
+#                        separate -z calls
+%forgesetup(z:va) %{lua:
 local fedora = require "fedora.common"
 if (rpm.expand("%{-z}") == "") and (rpm.expand("%{-a}") ~= "") then
   for _,s in pairs(fedora.getsuffixes("forgesetupargs")) do
@@ -76,10 +59,12 @@ else
 end
 }
 
-# Convenience macro to relay computed arguments to %autosetup
-# Parameters relayed to %autosetup: -v -N -S -p
-# Optional parameters:
-#   -z <number> read %{?forgesetupargs<number>}
+# Calls %autosetup using %forgemeta results
+#   – this will probably be removed since it is unsafe in presence of multiple
+#     sources
+# Control variables, flags and arguments:
+#   -z <number>  process the zth block of definitions
+#   -v -N -S -p  relayed to %autosetup
 %forgeautosetup(z:vNS:p:q) %{lua:
 print(rpm.expand("%autosetup %{-v} %{-N} %{?-S} %{?-p} %{?forgesetupargs" .. rpm.expand("%{-z*}") .. "}\\n"))
 }

macros.gap-srpm

@@ -0,0 +1,2 @@
+# Arches that GAP runs on
+%gap_arches aarch64 ppc64le s390x x86_64

macros.java-srpm

@@ -0,0 +1,2 @@
+# Arches that OpenJDK and dependent packages run on
+%java_arches aarch64 ppc64le s390x x86_64

macros.kmp

@@ -1,63 +0,0 @@
-# Use these macros to differentiate between RH and other KMP implementation(s).
-redhat_kernel_module_package	1
-kernel_module_package_release	1
-
-%__find_provides        /usr/lib/rpm/redhat/find-provides
-%__find_requires        /usr/lib/rpm/redhat/find-requires
-
-#kernel_module_package [ -n name ] [ -v version ] [ -r release ] [ -s script ]
-#                      [ -f filelist] [ -x ] [ -p preamble ] flavor flavor ...
-
-%kernel_module_package_buildreqs	%global kmodtool_generate_buildreqs 1 \
-					kernel-devel
-
-%kernel_module_package(n:v:r:s:f:xp:) %{expand:%( \
-	%define kmodtool %{-s*}%{!-s:/usr/lib/rpm/redhat/kmodtool} \
-	%define kmp_version %{-v*}%{!-v:%{version}} \
-	%define kmp_release %{-r*}%{!-r:%{release}} \
-	%define latest_kernel %(rpm -q --qf '%{VERSION}-%{RELEASE}\\\\n' `rpm -q kernel-devel | /usr/lib/rpm/redhat/rpmsort -r | head -n 1` | head -n 1) \
-	%{!?kernel_version:%{expand:%%global kernel_version %{latest_kernel}}} \
-	%global kverrel %(%{kmodtool} verrel %{?kernel_version} 2>/dev/null) \
-	flavors="default" \
-	if [ "i686" == "%{_target_cpu}" ] || [ "x86_64" == "%{_target_cpu}" ] \
-	then \
-		xenver=$(rpm -q kernel-xen-devel-%{kverrel}|head -n 1)\
-		kdver=$(rpm -q kernel-kdump-devel-%{kverrel}|head -n 1)\
-		if [ "kernel-xen-devel-%{kverrel}" == "$xenver" ] \
-		then \
-			flavors="$flavors xen" \
-		fi \
-		if [ "kernel-kdump-devel-%{kverrel}" == "$kdver" ] \
-		then \
-			flavors="$flavors kdump" \
-		fi \
-	fi \
-	if [ -z "%*" ]; then \
-		flavors_to_build=$flavors \
-	elif [ -z "%{-x}" ]; then \
-		flavors_to_build="%*" \
-	else \
-		flavors_to_build=" $flavors "\
-		echo "[$flavors_to_build]" >/tmp/tmp.txt
-		for i in %* \
-		do \
-			flavors_to_build=${flavors_to_build//$i /}
-		done \
-	fi \
-	echo "%%global flavors_to_build ${flavors_to_build:-%%nil}" \
-	echo "%%global kernel_source() /usr/src/kernels/%kverrel.\\\$([ %%%%{1} = default ] || echo "%%%%{1}.")%_target_cpu" \
-	if [ ! -z "%{-f*}" ] \
-	then \
-		filelist="%{-f*}" \
-	fi \
-	if [ ! -z "%{-p*}" ] \
-	then \
-		preamble="%{-p*}" \
-	fi \
-	nobuildreqs="yes" \
-	if [ "x%{kmodtool_generate_buildreqs}" != "x1" ] \
-	then \
-		nobuildreqs="no" \
-	fi \
-	kmp_override_filelist="$filelist" kmp_override_preamble="$preamble" kmp_nobuildreqs="$nobuildreqs" %{kmodtool} rpmtemplate_kmp %{-n*}%{!-n:%name} %{kverrel} $flavors_to_build 2>/dev/null \
-)}

macros.shell-completions

@@ -0,0 +1,3 @@
+%bash_completions_dir   %{_datadir}/bash-completion/completions
+%zsh_completions_dir    %{_datadir}/zsh/site-functions
+%fish_completions_dir   %{_datadir}/fish/vendor_completions.d

macros.vpath

@@ -4,4 +4,4 @@
 %_vpath_srcdir .
 
 # directory (doesn't need to exist) where all generated build files will be placed
-%_vpath_builddir %_target_platform
+%_vpath_builddir %{_vendor}-%{_target_os}-build

modalias.prov

@@ -1,76 +0,0 @@
-#! /bin/sh
-
-# heavily based upon find-suggests.ksyms by Andreas Gruenbacher <agruen@suse.de>.
-# with modifications by Michael Brown <Michael_E_Brown@dell.com>
-#
-# -- added module versioning info to modalias() symbols
-# -- removed code which inspects spec files.
-
-IFS=$'\n'
-
-#
-# Initially, dont generate modalias() lines for kernel package. This needs
-# additional discussion. Would like to eventually add them for
-# completeness, so that we can determine when drivers are folded into
-# mainline kernel.
-#
-case "$1" in
-kernel-module-*)    ;; # Fedora kernel module package names start with
-		       # kernel-module.
-kernel*)	   is_kernel_package=1 ;;
-esac
-
-if ! [ -z "$is_kernel_package" ]; then
-    cat > /dev/null
-    exit 0
-fi
-
-print_modaliases() {
-    declare class=$1 variants=$2 pos=$3
-    if [ -n "$variants" ]; then
-	echo "${class:0:pos}[$variants]${class:pos+1}"
-    else
-	[ -z "$class" ] || echo "$class"
-    fi
-}
-
-combine_modaliases() {
-    declare tag class variants pos n
-    read class
-    while read tag; do
-	for ((n=0; n<${#class}; n++)); do
-	    if [ "*" != "${class:n:1}" -a \
-		 "${class:0:n}" = "${tag:0:n}" -a \
-		 "${class:n+1}" = "${tag:n+1}" ] &&
-	       ( [ -z "$pos" ] || [ $n = $pos ] ); then
-		variants="${variants:-${class:n:1}}${tag:n:1}"
-		pos=$n
-		break
-	    fi
-	done
-	if [ $n -eq ${#class} ]; then
-	    print_modaliases "$class" "$variants" "$pos"
-	    variants=
-	    pos=
-	    class=$tag
-	fi
-    done
-    print_modaliases "$class" "$variants" "$pos"
-}
-
-for module in $(grep -E '/lib/modules/.+\.ko$') $*; do
-    # | head -n1 because some modules have *two* version tags. *cough*b44*cough*
-    modver=$(/sbin/modinfo -F version "$module"| head -n1)
-    modver=${modver// /_}
-
-    # only add version tag if it has a version
-    if [ -n "$modver" ]; then
-        /sbin/modinfo -F alias "$module" \
-        | sed -nre "s,(.+),modalias(\\1) = $modver,p"
-    else
-        /sbin/modinfo -F alias "$module" \
-        | sed -nre "s,(.+),modalias(\\1),p"
-    fi
-done \
-| sort -u \
-| combine_modaliases

redhat-annobin-cc1

@@ -1,2 +0,0 @@
-*cc1_options:
-+ %{!-fno-use-annobin:%{!iplugindir*:%:find-plugindir()} -fplugin=annobin}

redhat-annobin-cc1

@@ -0,0 +1 @@
+redhat-annobin-select-annobin-built-plugin

redhat-annobin-plugin-select.sh

@@ -0,0 +1,199 @@
+#!/usr/bin/sh
+# This is a script to select which GCC spec file fragment
+# should be the destination of the redhat-annobin-cc1 symlink.
+
+# Author: Nick Clifton  <nickc@redhat.com>
+# Copyright (c) 2021 Red Hat.
+#
+# This is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published
+# by the Free Software Foundation; either version 2, or (at your
+# option) any later version.
+
+# It is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# Usage:
+#   redhat-annobin-plugin-select [script-dir]
+#
+# If script-dir is not provided then /usr/lib/rpm/redhat is used
+# as the location where all of the annobin plugin selection files
+# can be found.
+
+if test "x$1" = "x" ;
+then
+    rrcdir=/usr/lib/rpm/redhat
+else
+    rrcdir=$1
+fi
+
+# Set this variable to non-zero to enable the generation of debugging
+# messages.
+debug=0
+
+# Decide which version of the annobin plugin for gcc should be used.
+# There are two possible versions, one created by the annobin package and one
+# created by the gcc package.  The logic selects the gcc version unless both
+# have been built by the same version of the compiler.  In that case the
+# annobin version is selected instead.
+#
+# The point of all this is that the annobin plugin is very sensitive to
+# mismatches with the version of gcc that built it.  If the plugin is built
+# by version A of gcc, but then run on version B of gcc, it is possible for
+# the plugin to misbehave, which then causes problems if gating tests examine
+# the plugin's output.  (This has happened more than once in RHEL...).
+#
+# So the plugin is built both by gcc and by the annobin package.  This means
+# that whenever gcc is updated a fresh plugin is built, and the logic below
+# will select that version.  But in order to allow annobin development to
+# proceed independtently of gcc, the annobin package can also update its
+# version of the plugin, and the logic will select this new version.
+
+# This is where the annobin package stores the information on the version
+# of gcc that built the annobin plugin.
+aver=`gcc --print-file-name=plugin`/annobin-plugin-version-info
+
+# This is where the gcc package stores its version information.
+gver=`gcc --print-file-name=rpmver`
+
+aplugin=`gcc --print-file-name=plugin`/annobin.so.0.0.0
+gplugin=`gcc --print-file-name=plugin`/gcc-annobin.so.0.0.0
+
+# This is the file that needs to be updated when either of those version
+# files changes.
+rac1=redhat-annobin-cc1
+
+# This is the GCC spec file fragment that selects the gcc-built version of
+# the annobin plugin
+select_gcc=redhat-annobin-select-gcc-built-plugin
+
+# This is the GCC spec file fragment that selects the annobin-built version
+# of the annobin plugin
+select_annobin=redhat-annobin-select-annobin-built-plugin
+
+install_annobin_version=0
+install_gcc_version=0
+
+if [ -f $aplugin ]
+then
+    if [ -f $gplugin ]
+    then
+	if [ $debug -eq 1 ]
+	then
+	    echo "  redhat-rpm-config: Both plugins exist, checking version information"
+	fi
+
+	if [ -f $gver ]
+	then
+	    if [ -f $aver ]
+	    then
+		if [ $debug -eq 1 ]
+		then
+		    echo "  redhat-rpm-config: Both plugin version files exist - comparing..."
+		fi
+
+		# Get the first line from the version info files.  This is just in
+		# vase there are extra lines in the files.
+		avers=`head --lines=1 $aver`
+		gvers=`head --lines=1 $gver`
+
+		if [ $debug -eq 1 ]
+		then
+		    echo "  redhat-rpm-config: Annobin plugin built by gcc $avers"
+		    echo "  redhat-rpm-config: GCC     plugin built by gcc $gvers"
+		fi
+
+		# If both plugins were built by the same version of gcc then select
+		# the one from the annobin package (in case it is built from newer
+		# sources).  If the plugin builder versions differ, select the gcc
+		# built version instead.  This assumes that the gcc built version
+		# always matches the installed gcc, which should be true.
+		if [ $avers = $gvers ]
+		then
+		    if [ $debug -eq 1 ]
+		    then
+			echo "  redhat-rpm-config: Both plugins built by the same compiler - using annobin-built plugin"
+		    fi
+		    install_annobin_version=1
+		else
+		    if [ $debug -eq 1 ]
+		    then
+			echo "  redhat-rpm-config: Versions differ - using gcc-built plugin"
+		    fi
+		    install_gcc_version=1
+		fi
+	    else
+		if [ $debug -eq 1 ]
+		then
+		    echo "  redhat-rpm-config: Annobin version file does not exist, using gcc-built plugin"
+		fi
+		install_gcc_version=1
+	    fi
+	else
+	    if [ -f $aver ]
+	    then
+		# FIXME: This is suspicious.  If the installed GCC does not supports plugins
+		# then enabling the annobin plugin will not work.
+		if [ $debug -eq 1 ]
+		then
+		    echo "  redhat-rpm-config: GCC plugin version file does not exist, using annobin-built plugin"
+		fi
+		install_annobin_version=1
+	    else
+		if [ $debug -eq 1 ]
+		then
+		    echo "  redhat-rpm-config: Neither version file exists - playing safe and using gcc-built plugin"
+		    echo "  redhat-rpm-config: Note: expected to find $aver and/or $gver"
+		fi
+		install_gcc_version=1
+	    fi
+	fi
+    else
+	if [ $debug -eq 1 ]
+	then
+	    echo "  redhat-rpm-config: Only the annobin plugin exists - using that"
+	fi
+	install_annobin_version=1
+    fi
+else
+    if [ -f $gplugin ]
+    then
+	if [ $debug -eq 1 ]
+	then
+	    echo "  redhat-rpm-config: Only the gcc plugin exists - using that"
+	fi
+    else
+	if [ $debug -eq 1 ]
+	then
+	    echo "  redhat-rpm-config: Neither plugin exists - playing safe and using gcc-built plugin"
+	    echo "  redhat-rpm-config: Note: expected to find $aplugin and/or $gplugin"
+	fi
+    fi
+    install_gcc_version=1
+fi
+
+if [ $install_annobin_version -eq 1 ]
+then
+    if [ $debug -eq 1 ]
+    then
+	echo "  redhat-rpm-config: Installing annobin version of $rac1"
+    fi
+    pushd $rrcdir > /dev/null
+    rm -f $rac1
+    ln -s $select_annobin "$rac1"
+    popd > /dev/null
+    
+else if [ $install_gcc_version -eq 1 ]
+     then
+	if [ $debug -eq 1 ]
+	then
+	    echo "  redhat-rpm-config: Installing gcc version of $rac1"
+	fi
+	pushd $rrcdir > /dev/null
+	rm -f $rac1
+	ln -s $select_gcc $rac1
+	popd > /dev/null
+     fi
+fi

redhat-annobin-select-annobin-built-plugin

@@ -0,0 +1,3 @@
+*cc1_options:
++ %{!-fno-use-annobin:%{!iplugindir*:%:find-plugindir()} -fplugin=annobin}
+

redhat-annobin-select-gcc-built-plugin

@@ -0,0 +1,3 @@
+*cc1_options:
++ %{!-fno-use-annobin:%{!iplugindir*:%:find-plugindir()} -fplugin=gcc-annobin}
+

redhat-hardened-cc1

@@ -1,2 +1,5 @@
 *cc1_options:
 + %{!r:%{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}}
+
+*cpp_options:
++ %{!r:%{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}}

redhat-hardened-clang.cfg

@@ -0,0 +1 @@
+-fPIE

redhat-rpm-config.spec

@@ -1,12 +1,14 @@
 #                        TO WHOM IT MAY CONCERN
 #
 # 1) Don't add patches, dist-git is the upstream repository for this package.
-# 2) When making changes, update version by +1, leave release alone.
-#
+# 2) When making changes, increment the version (in baserelease) by 1.
+#    rpmdev-bumpspec and other tools update the macro below, which is used
+#    in Version: to get the desired effect.
+%global baserelease 261
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
-Version: 153
+Version: %{baserelease}
 Release: 1%{?dist}
 # No version specified.
 License: GPL+
@@ -19,9 +21,13 @@ Source1: rpmrc
 # gcc specs files for hardened builds
 Source50: redhat-hardened-cc1
 Source51: redhat-hardened-ld
+Source52: redhat-hardened-clang.cfg
 
 # gcc specs files for annobin builds
-Source52: redhat-annobin-cc1
+Source60: redhat-annobin-cc1
+Source61: redhat-annobin-select-gcc-built-plugin
+Source62: redhat-annobin-select-annobin-built-plugin
+Source63: redhat-annobin-plugin-select.sh
 
 # The macros defined by these files are for things that need to be defined
 # at srpm creation time when it is not feasible to require the base packages
@@ -33,14 +39,17 @@ Source102: macros.mono-srpm
 Source103: macros.nodejs-srpm
 Source104: macros.ldc-srpm
 Source105: macros.valgrind-srpm
+Source106: macros.java-srpm
+Source107: macros.gap-srpm
 
 # Other misc macros
-Source150: macros.dwz
-Source151: macros.kmp
-Source152: macros.vpath
+Source150: macros.build-constraints
+Source151: macros.dwz
+Source152: macros.fedora-misc
 Source153: macros.forge
-Source154: macros.ldconfig
-Source155: macros.fedora-misc
+Source155: macros.ldconfig
+Source156: macros.vpath
+Source157: macros.shell-completions
 
 # Build policy scripts
 # this comes from https://github.com/rpm-software-management/rpm/pull/344
@@ -48,32 +57,22 @@ Source155: macros.fedora-misc
 # and an echo when the mangling happens
 Source201: brp-mangle-shebangs
 
-# this comes from rpm itself
-# however, now we can do Fedora changes within
-Source202: brp-python-bytecompile
+# for converting llvm LTO bitcode objects into ELF
+Source204: brp-llvm-compile-lto-elf
 
 # Dependency generator scripts (deprecated)
 Source300: find-provides
-Source301: find-provides.ksyms
 Source304: find-requires
-Source305: find-requires.ksyms
-Source308: firmware.prov
-Source309: modalias.prov
 
 # Misc helper scripts
 Source400: dist.sh
-Source401: rpmsort
-Source402: symset-table
-Source403: kmodtool
 Source404: gpgverify
 
-# 2016-10-02 snapshots from http://git.savannah.gnu.org/gitweb/?p=config.git
-Source500: config.guess
-Source501: config.sub
+# Snapshots from http://git.savannah.gnu.org/gitweb/?p=config.git
+Source500: https://git.savannah.gnu.org/cgit/config.git/plain/config.guess
+Source501: https://git.savannah.gnu.org/cgit/config.git/plain/config.sub
 
 # Dependency generators & their rules
-Source600: kmod.attr
-Source601: kmod.prov
 Source602: libsymlink.attr
 
 # BRPs
@@ -93,23 +92,35 @@ Requires: coreutils
 
 Requires: efi-srpm-macros
 Requires: fonts-srpm-macros
-Requires: fpc-srpm-macros
 Requires: ghc-srpm-macros
-Requires: gnat-srpm-macros
 Requires: go-srpm-macros
-Requires: nim-srpm-macros
+# ↓ Provides kmod.attr originally shipped by us
+Requires: kernel-srpm-macros >= 1.0-12
+Requires: lua-srpm-macros
 Requires: ocaml-srpm-macros
 Requires: openblas-srpm-macros
 Requires: perl-srpm-macros
-# ↓ Provides compileall2 Python module
-Requires: python-srpm-macros >= 3-46
-Requires: rust-srpm-macros
+# ↓ Has Python BRPs originaly present in redhat-rpm-config
+Requires: python-srpm-macros >= 3.11-7
 Requires: qt5-srpm-macros
+Requires: qt6-srpm-macros
+# rust-srpm-macros v24 contains %%build_rustflags defintion
+Requires: rust-srpm-macros >= 24
+Requires: rpmautospec-rpm-macros
+Requires: package-notes-srpm-macros
+Requires: pyproject-srpm-macros
+
+%if ! 0%{?rhel}
+Requires: fpc-srpm-macros
+Requires: gnat-srpm-macros
+Requires: ansible-srpm-macros
+%endif
 
 Requires: rpm >= 4.11.0
 Requires: dwz >= 0.4
 Requires: zip
-Requires: (annobin if gcc)
+Requires: (annobin-plugin-gcc if gcc)
+Requires: (gcc-plugin-annobin if gcc)
 
 # for brp-mangle-shebangs
 Requires: %{_bindir}/find
@@ -118,6 +129,9 @@ Requires: %{_bindir}/grep
 Requires: %{_bindir}/sed
 Requires: %{_bindir}/xargs
 
+# for brp-llvm-compile-lto-elf
+Requires: (llvm if clang)
+
 # -fstack-clash-protection and -fcf-protection require GCC 8.
 Conflicts: gcc < 8.0.1-0.22
 
@@ -128,13 +142,6 @@ Provides: system-rpm-config = %{version}-%{release}
 %description
 Red Hat specific rpm configuration files.
 
-%package -n kernel-rpm-macros
-Summary: Macros and scripts for building kernel module packages
-Requires: redhat-rpm-config >= 13
-
-%description -n kernel-rpm-macros
-Macros and scripts for building kernel module packages.
-
 %prep
 # Not strictly necessary but allows working on file names instead
 # of source numbers in install section
@@ -147,13 +154,12 @@ install -p -m 644 -t %{buildroot}%{rrcdir} macros rpmrc
 install -p -m 444 -t %{buildroot}%{rrcdir} redhat-hardened-*
 install -p -m 444 -t %{buildroot}%{rrcdir} redhat-annobin-*
 install -p -m 755 -t %{buildroot}%{rrcdir} config.*
-install -p -m 755 -t %{buildroot}%{rrcdir} dist.sh rpmsort symset-table kmodtool
+install -p -m 755 -t %{buildroot}%{rrcdir} dist.sh
 install -p -m 755 -t %{buildroot}%{rrcdir} gpgverify
 install -p -m 755 -t %{buildroot}%{rrcdir} brp-*
 
 install -p -m 755 -t %{buildroot}%{rrcdir} find-*
 mkdir -p %{buildroot}%{rrcdir}/find-provides.d
-install -p -m 644 -t %{buildroot}%{rrcdir}/find-provides.d firmware.prov modalias.prov
 
 install -p -m 755 -t %{buildroot}%{rrcdir} brp-*
 
@@ -162,12 +168,56 @@ install -p -m 644 -t %{buildroot}%{_rpmconfigdir}/macros.d macros.*
 
 mkdir -p %{buildroot}%{_fileattrsdir}
 install -p -m 644 -t %{buildroot}%{_fileattrsdir} *.attr
-install -p -m 755 -t %{buildroot}%{_rpmconfigdir} kmod.prov
 
 mkdir -p %{buildroot}%{_rpmluadir}/fedora/{rpm,srpm}
 install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora common.lua
 install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora/srpm forge.lua
 
+# This trigger is used to decide which version of the annobin plugin for gcc
+# should be used.  See comments in the script for full details.
+#
+# Note - whilst "gcc-plugin-annobin" requires "gcc" and hence in theory we
+# do not need to trigger on "gcc", the redhat-annobin-plugin-select.sh
+# script invokes gcc to determine the version of the gcc plugin, and this
+# can be significant.
+#
+# For example, suppose that version N of gcc is installed and that annobin
+# version A (built by gcc version N) is also installed.  Then a new version
+# of gcc is released.  If the rpms are updated in this order:
+#   gcc-plugin-annobin
+#   gcc
+# then when the trigger for gcc-plugin-annobin is run, the script will see
+# (the not yet updated) gcc is currently version N, which matches the current
+# annobin plugin A, so no changes are necessary.  Then gcc is updated and,
+# if the trigger below did not include "gcc", the script would not run again
+# and so now you would have an out of date version of the annobin plugin.
+#
+# Alternatively imagine installing gcc and annobin for the first time.
+# If the installation order is:
+#    gcc
+#    annobin-plugin-gcc
+#    gcc-plugin-annobin
+# then the installation of gcc will not cause the gcc-plugin-annobin to be
+# selected, since it does not exist yet.  Then annobin-plugin-gcc is installed
+# and since it is the only plugin, it will be selected.  Then
+# gcc-plugin-annobin is installed, and if the trigger below was not set to
+# run on gcc-plugin-annobin, it would pass unnoticed.
+#
+# Hence it is necessary to trigger on both gcc and gcc-plugin-annobin.
+
+%triggerin -- annobin-plugin-gcc gcc-plugin-annobin gcc
+%{rrcdir}/redhat-annobin-plugin-select.sh
+%end
+
+# We also trigger when an annobin plugin is uninstalled.  This allows us to
+# switch over to the other version of the plugin.  Note - we do not bother
+# triggering on the uninstallation of "gcc", since if that is removed, the
+# plugins are rendered useless.
+
+%triggerpostun -- annobin-plugin-gcc gcc-plugin-annobin
+%{rrcdir}/redhat-annobin-plugin-select.sh
+%end
+
 %files
 %dir %{rrcdir}
 %{rrcdir}/macros
@@ -182,33 +232,380 @@ install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora/srpm forge.lua
 %{rrcdir}/find-requires
 %{rrcdir}/brp-ldconfig
 %{_fileattrsdir}/*.attr
-%{_rpmconfigdir}/kmod.prov
 %{_rpmconfigdir}/macros.d/macros.*-srpm
+%{_rpmconfigdir}/macros.d/macros.build-constraints
 %{_rpmconfigdir}/macros.d/macros.dwz
+%{_rpmconfigdir}/macros.d/macros.fedora-misc
 %{_rpmconfigdir}/macros.d/macros.forge
 %{_rpmconfigdir}/macros.d/macros.ldconfig
+%{_rpmconfigdir}/macros.d/macros.shell-completions
 %{_rpmconfigdir}/macros.d/macros.vpath
-%{_rpmconfigdir}/macros.d/macros.fedora-misc
 %dir %{_rpmluadir}/fedora
 %dir %{_rpmluadir}/fedora/srpm
 %dir %{_rpmluadir}/fedora/rpm
 %{_rpmluadir}/fedora/*.lua
 %{_rpmluadir}/fedora/srpm/*lua
 
+%attr(0755,-,-) %{rrcdir}/redhat-annobin-plugin-select.sh
+%verify(owner group mode) %{rrcdir}/redhat-annobin-cc1
+%{rrcdir}/redhat-annobin-select-gcc-built-plugin
+%{rrcdir}/redhat-annobin-select-annobin-built-plugin
+
 %doc buildflags.md
 
-%files -n kernel-rpm-macros
-%dir %{rrcdir}/find-provides.d
-%{rrcdir}/kmodtool
-%{rrcdir}/rpmsort
-%{rrcdir}/symset-table
-%{rrcdir}/find-provides.ksyms
-%{rrcdir}/find-requires.ksyms
-%{rrcdir}/find-provides.d/firmware.prov
-%{rrcdir}/find-provides.d/modalias.prov
-%{_rpmconfigdir}/macros.d/macros.kmp
-
 %changelog
+* Fri Jul  7 2023 Florian Weimer <fweimer@redhat.com> - 261-1
+- Fix warnings that appear during the build of the llvm package
+
+* Wed Jul  5 2023 Florian Weimer <fweimer@redhat.com> - 260-1
+- Implement the %%build_type_safety_c macro (#2218019)
+
+* Wed Jul  5 2023 Florian Weimer <fweimer@redhat.com> - 259-1
+- Filter out C, C++ build flags from Fortran build flags (#2177253)
+
+* Wed Jul  5 2023 Florian Weimer <fweimer@redhat.com> - 258-1
+- Enable PIC mode for assembler files (#2167430)
+
+* Wed Jul 05 2023 Frederic Berat <fberat@redhat.com> - 257-1
+- update config.{guess,sub} to gnuconfig git HEAD
+
+* Sat Jun 17 2023 Tom Stellard <tstellar@redhat.com> - 256-1
+- Remove -fno-openmp-implicit-rpath from clang ldflags
+
+* Fri Jun 16 2023 Lumír Balhar <lbalhar@redhat.com> - 255-1
+- Add qt6-srpm-macros
+
+* Thu Mar  9 2023 Florian Weimer <fweimer@redhat.com> - 254-1
+- Switch ELN to x86-64-v3
+
+* Tue Feb 28 2023 Maxwell G <gotmax@e.email> - 253-1
+- Include RUSTFLAGS in %%set_build_flags
+- Fixes: rhbz#2167183
+
+* Tue Feb 28 2023 Tom Stellard <tstellar@redhat.com> - 252-1
+- Rename _pkg_extra_* macros to _distro_extra_*
+
+* Thu Feb 23 2023 Miro Hrončok <mhroncok@redhat.com> - 251-1
+- Drop the requirement of orphaned nim-srpm-macros
+- No Fedora package uses the %%nim_arches macro
+
+* Tue Feb 14 2023 Frederic Berat <fberat@redhat.com> - 250-1
+- update config.{guess,sub} to gnuconfig git HEAD
+
+* Thu Feb 09 2023 Jerry James <loganjerry@gmail.com> - 249-1
+- Add macros.gap-srpm
+
+* Tue Feb 07 2023 Tom Stellard <tstellar@redhat.com> - 248-1
+- Add %%pkg_extra_* macros
+
+* Mon Feb 06 2023 Nick Clifton  <nickc@redhat.com> - 247-1
+- Fix triggers for the installation and removal of gcc-plugin-annobin.
+  Fixes: rhbz#2124562
+
+* Tue Jan 17 2023 Miro Hrončok <mhroncok@redhat.com> - 246-1
+- Add pyproject-srpm-macros to the default buildroot
+
+* Tue Jan 17 2023 Davide Cavalca <dcavalca@fedoraproject.org> - 245-1
+- Do not include frame pointers on ppc64le for now
+  Fixes: rhbz#2161595
+
+* Mon Jan 16 2023 Tom Stellard <tstellar@redhat.com> - 244-1
+- Make -flto=thin the default lto flag for clang
+
+* Mon Jan 16 2023 Siddhesh Poyarekar <siddhesh@redhat.com> - 243-1
+- Consolidate the _FORTIFY_SOURCE switches.
+
+* Fri Jan 13 2023 Miro Hrončok <mhroncok@redhat.com> - 242-1
+- Don't use %%[ ] expressions with %%{undefined}
+- Fixes: rhbz#2160716
+
+* Thu Jan 12 2023 Stephen Gallagher <sgallagh@redhat.com> - 241-1
+- Do not include frame pointers on RHEL
+
+* Tue Jan 10 2023 Davide Cavalca <dcavalca@fedoraproject.org> - 240-1
+- Do not include frame pointers on i686 and s390x for now
+
+* Wed Jan  4 2023 Davide Cavalca <dcavalca@fedoraproject.org> - 239-1
+- Enable frame pointers by default
+- Set arch specific flags for frame pointers support
+
+* Tue Jan  3 2023 Miro Hrončok <mhroncok@redhat.com> - 238-1
+- Set %%source_date_epoch_from_changelog to 1
+- https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes
+
+* Tue Jan  3 2023 Siddhesh Poyarekar <siddhesh@redhat.com> - 237-1
+- Make _FORTIFY_SOURCE configurable and bump default to 3.
+
+* Wed Dec 28 2022 Davide Cavalca <dcavalca@fedoraproject.org> - 236-1
+- Add conditional support for always including frame pointers
+
+* Sat Dec 10 2022 Florian Weimer <fweimer@redhat.com> - 235-1
+- Add %%_configure_use_runstatedir to disable --runstatedir configure option
+
+* Fri Nov  4 2022 Tom Stellard <tstellar@redhat.com> - 234-1
+- Remove unsupported arches from rpmrc
+
+* Fri Nov  4 2022 Florian Weimer <fweimer@redhat.com> - 233-1
+- Set -g when building Vala applications
+
+* Fri Sep 23 2022 Timm Bäder <tbaeder@redhat.com> - 232-1
+- Fix brp-compile-lto-elf to not rely on a backtracking regex
+
+* Thu Sep 08 2022 Maxwell G <gotmax@e.email> - 231-1
+- forge macros: Support Sourcehut. Fixes rhbz#2035935.
+
+* Tue Aug 30 2022 Frederic Berat <fberat@redhat.com> - 230-1
+- Add support for runstatedir in %%configure
+
+* Fri Aug 26 2022 Dan Horák <dan[at]danny.cz> - 229-1
+- Move the baseline s390x arch to z13 for F-38+
+
+* Mon Aug 8 2022 Maxwell G <gotmax@e.email> - 228-1
+- Add macros.shell-completions
+
+* Fri Aug 05 2022 Nikita Popov <npopov@redhat.com> - 227-1
+- brp-llvm-compile-lto-elf: Pass -r to xargs
+
+* Wed Jun 22 2022 Timm Bäder <tbaeder@redhat.com> - 226-1
+- Move llvm_compile_lto_to_elf before __debug_install_post
+
+* Fri Jun 17 2022 Nick Clifton  <nickc@redhat.com> - 225-1
+- Add definition of _find_debuginfo_extra_opts which will
+-  move annobin data into a separate debuginfo file.
+
+* Tue Jun 14 2022 Tom Stellard <tstellar@redhat.com> - 224-1
+- Fix passing of CFLAGS to brp-llvm-compile-lto-elf
+
+* Fri May 27 2022 Tom Stellard <tstellar@redhat.com> - 223-1
+- Move -fno-openmp-implicit-rpath option from CFLAGS to LDFLAGS
+
+* Fri May 27 2022 Florian Weimer <fweimer@redhat.com> - 222-1
+- Use %%baserelease to store the version number
+
+* Fri May 27 2022 Frederic Berat <fberat@redhat.com> - 221-1
+- update config.{guess,sub} to gnuconfig git HEAD
+
+* Tue May 17 2022 Maxwell G <gotmax@e.email> - 220-1
+- Add `Requires: ansible-srpm-macros`
+
+* Tue May 17 2022 Miro Hrončok <mhroncok@redhat.com> - 219-2
+- Remove a tab character from the definition of %%__global_compiler_flags
+- Fixes: rhbz#2083296
+
+* Tue May 10 2022 Mikolaj Izdebski <mizdebsk@redhat.com> - 219-1
+- Add java_arches macro
+
+* Wed Apr 20 2022 Timm Bäder <tbaeder@redhat.com> - 218-1
+- Parallelize bpr-llvm-compile-lto-elf
+
+* Tue Apr 19 2022 Tom Stellard <tstellar@redhat.com> - 217-1
+- Add -fno-openmp-implicit-rpath when building with clang
+
+* Wed Apr 13 2022 Nick Clifton  <nickc@redhat.com> - 216-1
+- Add support for comparing gcc-built and annobin-built plugins.
+
+* Mon Feb 21 2022 Timm Bäder <tbaeder@redhat.com> - 215-1
+- Add %%__brp_remove_la_files to %%__os_install_post
+
+* Thu Feb 10 2022 Florian Weimer <fweimer@redhat.com> - 214-1
+- ppc64le: Switch baseline to POWER9 on ELN (ELN issue 78)
+
+* Thu Feb 10 2022 Florian Weimer <fweimer@redhat.com> - 213-1
+- s390x: Switch baseline to z14 on ELN (ELN issue 79)
+
+* Sun Jan 23 2022 Robert-André Mauchin <zebob.m@gmail.com> - 212-1
+- Add package note generation to %%check preamble
+- Fix: rhbz#2043977
+
+* Fri Jan 21 2022 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 211-1
+- Move package note generation to build preamble
+- Do ELF package notes also on ELN
+
+* Thu Jan 20 2022 Miro Hrončok <mhroncok@redhat.com> - 210-1
+- Remove package ELF note from the extension LDFLAGS
+- Related: rhbz#2043092
+- Fix %%set_build_flags when %%_generate_package_note_file is not defined
+- Fixes: rhbz#2043166
+
+* Thu Jan 13 2022 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 209-1
+- Add package ELF note to the default LDFLAGS
+
+* Tue Jan 04 2022 Tom Stellard <tstellar@redhat.com> - 208-1
+- Call %%set_build_flags before %%build, %%check, and %%install stages
+
+* Tue Dec 14 2021 Tom Stellard <tstellar@redhat.com> - 207-1
+- Add -Wl,--build-id=sha1 to the default LDFLAGS
+
+* Tue Dec 07 2021 Miro Hrončok <mhroncok@redhat.com> - 206-1
+- brp-mangle-shebangs: also mangle shebangs of JavaScript executables
+- Fixes: rhbz#1998924
+
+* Thu Nov 18 2021 Michal Domonkos <mdomonko@redhat.com> - 205-1
+- Drop kernel-rpm-macros subpackage & kmod.attr (new home: kernel-srpm-macros)
+
+* Tue Nov 16 2021 Miro Hrončok <mhroncok@redhat.com> - 204-1
+- Don't pull in Python to all buildroots
+- Remove llvm-lto-elf-check script
+
+* Tue Nov 09 2021 Michal Domonkos <mdomonko@redhat.com> - 203-1
+- Drop {fpc,gnat,nim}-srpm-macros dependencies on RHEL
+
+* Wed Nov 03 2021 David Benoit <dbenoit@redhat.com> - 202-1
+- Add llvm-lto-elf-check script
+- Resolves: rhbz#2017193
+
+* Mon Nov 01 2021 Jason L Tibbitts III <j@tib.bs> - 201-1
+- Better error handling for %%constrain_build.
+
+* Mon Oct 18 2021 Jason L Tibbitts III <j@tib.bs> - 200-1
+- Add %%constrain_build macro.
+
+* Tue Sep 21 2021 Tom Stellard <tstellar@redhat.com> - 199-1
+- Drop annobin-plugin-clang dependency
+
+* Mon Aug 30 2021 Florian Weimer <fweimer@redhat.com> - 198-1
+- ELN: Enable -march=x86-64-v2 for Clang as well
+
+* Tue Aug 17 2021 Tom Stellard <tstellar@redhat.com> - 197-1
+- Add build_ preifix to cc, cxx, and cpp macros
+
+* Mon Aug 16 2021 Tom Stellard <tstellar@redhat.com> - 196-1
+- Add cc, cxx, and cpp macros
+
+* Sun Aug 15 2021 Michel Alexandre Salim <salimma@fedoraproject.org> - 195-1
+- Fix macros.build-constraints' %%limit_build
+  - number of CPUs will never be set to less than 1
+  - this now outputs build flag overrides to be used with %%make_build etc.
+  - add documentation
+
+* Mon Aug  2 2021 Florian Weimer <fweimer@redhat.com> - 194-1
+- Active GCC plugin during LTO linking
+
+* Sat Jul 24 2021 Michel Alexandre Salim <salimma@fedoraproject.org> - 193-1
+- Add macros.build-constraints
+- Keep the misc macros in alphabetical order
+
+* Sat Jul 10 2021 Neal Gompa <ngompa13@gmail.com> - 192-1
+- Make vpath builddir not include arch-specific info
+
+* Thu Jul 01 2021 Miro Hrončok <mhroncok@redhat.com> - 191-1
+- Require python-srpm-macros with Python related BuildRoot Policy scripts
+
+* Wed Jun 30 2021 Miro Hrončok <mhroncok@redhat.com> - 190-1
+- Move Python related BuildRoot Policy scripts from redhat-rpm-config to python-srpm-macros
+
+* Mon Jun 28 2021 Ben Burton <bab@debian.org> - 189-1
+- Adapt macros and BRP scripts for %%topdir with spaces
+- Fixes rhbz#1947416
+
+* Tue Jun 22 2021 Panu Matilainen <pmatilai@redhat.com> - 188-1
+- Drop reference to now extinct brp-python-hardlink script
+
+* Tue Jun 8 2021 Stephen Coady <scoady@redhat.com> - 187-1
+- Add Requires: rpmautospec-rpm-macros
+
+* Mon May 31 2021 Charalampos Stratakis <cstratak@redhat.com> - 186-1
+- Enable RPATH check after %%install
+- Part of https://fedoraproject.org/wiki/Changes/Broken_RPATH_will_fail_rpmbuild
+- Resolves: rhbz#1964548
+
+* Wed May 26 2021 Arjun Shankar <arjun@redhat.com> - 185-1
+- Disable annobin on armv7hl
+
+* Mon Apr 12 2021 David Benoit <dbenoit@redhat.com> - 184-1
+- Change 'Requires: annobin' to 'Requires: annobin-plugin-gcc'.
+
+* Tue Apr  6 2021 David Benoit <dbenoit@redhat.com> - 183-1
+- BRP: LLVM Compile LTO Bitcode to ELF
+- Add Requires: (llvm if clang)
+
+* Mon Mar 22 2021 Lumír Balhar <lbalhar@redhat.com> - 182-1
+- Fix handling of files without newlines in brp-mangle-shebang
+
+* Wed Mar 10 2021 Kalev Lember <klember@redhat.com> - 181-1
+- BRP Python Bytecompile: Avoid hardcoding /usr/bin prefix for python
+
+* Tue Jan 19 2021 Florian Weimer <fweimer@redhat.com> - 180-1
+- Use -march=x86-64-v2 only for the gcc toolchain
+
+* Tue Jan 19 2021 Florian Weimer <fweimer@redhat.com> - 179-1
+- x86_64: Enable -march=x86-64-v2 for ELN, following GCC.
+
+* Sun Nov 29 2020 Miro Hrončok <mhroncok@redhat.com> - 178-1
+- BRP Python Bytecompile: Also detect Python files in /app/lib/pythonX.Y
+
+* Tue Oct 27 2020 Tom Stellard <tstellar@redhat.com> - 177-1
+- Add back -fcf-protection flag for x86_64
+
+* Tue Oct 20 2020 Florian Weimer <fweimer@redhat.com> - 176-1
+- s390x: Tune for z14 (as in Red Hat Enterprise Linux 8)
+
+* Mon Oct  5 2020 Florian Weimer <fweimer@redhat.com> - 175-1
+- s390x: Switch Fedora ELN to z13 baseline
+
+* Fri Sep 11 2020 Miro Hrončok <mhroncok@redhat.com> - 172-1
+- Filter out LTO flags from %%extension flags macros
+- Fixes: rhbz#1877652
+
+* Wed Sep  2 2020 Michel Alexandre Salim <salimma@fedoraproject.org> - 171-1
+- Add Requires: lua-srpm-macros
+
+* Fri Aug 21 2020 Tom Stellard <tstellar@redhat.com> - 170-1
+- Enable -fstack-clash-protection for clang on x86, s390x, and ppc64le
+
+* Thu Aug 20 2020 Tom Stellard <tstellar@redhat.com> - 169-1
+- Add -flto to ldflags for clang toolchain
+
+* Thu Aug 20 2020 Neal Gompa <ngompa13@gmail.com> - 168-1
+- Fix CC/CXX exports so arguments are included in exported variable
+- Allow overrides of CC/CXX like CFLAGS and CXXFLAGS from shell variables
+
+* Mon Aug 03 2020 Troy Dawson <tdawson@redhat.com> - 167-1
+- Add Requires: kernel-srpm-macros
+
+* Thu Jul 30 2020 Jeff Law <law@redhat.com> - 166-1
+- Use -flto=auto for GCC to speed up builds
+
+* Tue Jul 28 2020 Tom Stellard <tstellar@redhat.com> - 165-1
+- Only use supported lto flags for clang toolchain
+
+* Thu Jul 23 2020 Lumír Balhar <lbalhar@redhat.com> - 164-1
+- Disable Python hash seed randomization in brp-python-bytecompile
+
+* Tue Jul 21 2020 Jeff Law <law@redhat.com> - 163-1
+- Enable LTO by default
+
+* Thu Jul 16 2020 Lumír Balhar <lbalhar@redhat.com> - 162-1
+- New script brp-fix-pyc-reproducibility
+
+* Tue Jun 16 2020 Lumír Balhar <lbalhar@redhat.com> - 161-2
+- Use stdlib compileall for Python >= 3.9
+
+* Mon Jun 15 2020 Lumír Balhar <lbalhar@redhat.com> - 161-1
+- No more automagic Python bytecompilation (phase 3)
+  https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation_phase_3
+
+* Thu Jun 04 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 160-1
+- Fix broken %%configure
+
+* Wed Jun 03 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 159-1
+- Fixes for new_package macro
+
+* Wed Jun 03 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 158-1
+- Add option to choose C/C++ toolchain
+
+* Sat May 30 2020 Jeff Law <law@redhat.com> - 157-1
+- When LTO is enabled, fix broken configure files.
+
+* Sat May 30 2020 Nicolas Mailhot <nim@fedoraproject.org> - 156-1
+- Add new_package macro and associated lua framework.
+
+* Sat May 23 2020 Nicolas Mailhot <nim@fedoraproject.org> - 155-1
+- forge: add gitea support
+
+* Thu Apr 09 2020 Panu Matilainen <pmatilai@redhat.com> - 154-1
+- Optimize kernel module provides by using a parametric generator
+
 * Thu Feb 20 2020 Jason L Tibbitts III <tibbs@math.uh.edu> - 153-1
 - Add dependency on fonts-srpm-macros, as those have now been approved by FPC.
 

rpmrc

@@ -5,78 +5,15 @@ optflags: i486 %{__global_compiler_flags} -m32 -march=i486 -fasynchronous-unwind
 optflags: i586 %{__global_compiler_flags} -m32 -march=i586 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: i686 %{__global_compiler_flags} -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
 optflags: athlon %{__global_compiler_flags} -m32 -march=athlon -fasynchronous-unwind-tables -fstack-clash-protection
-optflags: ia64 %{__global_compiler_flags}
-optflags: x86_64 %{__global_compiler_flags} -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
+optflags: x86_64 %{__global_compiler_flags} -m64 %{__cflags_arch_x86_64} -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection %{_frame_pointers_cflags} %{_frame_pointers_cflags_x86_64}
 
-optflags: alpha %{__global_compiler_flags} -mieee
-optflags: alphaev5 %{__global_compiler_flags} -mieee -mcpu=ev5
-optflags: alphaev56 %{__global_compiler_flags} -mieee -mcpu=ev56
-optflags: alphapca56 %{__global_compiler_flags} -mieee -mcpu=pca56
-optflags: alphaev6 %{__global_compiler_flags} -mieee -mcpu=ev6
-optflags: alphaev67 %{__global_compiler_flags} -mieee -mcpu=ev67
+optflags: ppc64le %{__global_compiler_flags} -m64 %{__cflags_arch_ppc64le} -fasynchronous-unwind-tables -fstack-clash-protection
 
-optflags: sparc %{__global_compiler_flags} -m32 -mcpu=v7 -mtune=ultrasparc
-optflags: sparcv8 %{__global_compiler_flags} -m32 -mcpu=v8
-optflags: sparcv9 %{__global_compiler_flags} -m32 -mcpu=ultrasparc
-optflags: sparcv9v %{__global_compiler_flags} -m32 -mcpu=niagara
-optflags: sparc64 %{__global_compiler_flags} -m64 -mcpu=ultrasparc
-optflags: sparc64v %{__global_compiler_flags} -m64 -mcpu=niagara
+optflags: s390x %{__global_compiler_flags} -m64 %{__cflags_arch_s390x} -fasynchronous-unwind-tables -fstack-clash-protection
 
-optflags: m68k %{__global_compiler_flags}
+optflags: aarch64 %{__global_compiler_flags} -mbranch-protection=standard -fasynchronous-unwind-tables %[ "%{toolchain}" == "gcc" ? "-fstack-clash-protection" : "" ] %{_frame_pointers_cflags} %{_frame_pointers_cflags_aarch64}
 
-optflags: ppc %{__global_compiler_flags} -m32 -fasynchronous-unwind-tables
-optflags: ppciseries %{__global_compiler_flags} -m32
-optflags: ppcpseries %{__global_compiler_flags} -m32
-optflags: ppc64 %{__global_compiler_flags} -m64 -fasynchronous-unwind-tables -fstack-clash-protection
-optflags: ppc64p7 %{__global_compiler_flags} -m64 -O3 -mcpu=power7 -mtune=power7 -fasynchronous-unwind-tables -fstack-clash-protection
-optflags: ppc64le %{__global_compiler_flags} -m64 -mcpu=power8 -mtune=power8 -fasynchronous-unwind-tables -fstack-clash-protection
-optflags: ppc64iseries %{__global_compiler_flags} -m64
-optflags: ppc64pseries %{__global_compiler_flags} -m64
-optflags: ppc8260 %{__global_compiler_flags} -m32
-optflags: ppc8560 %{__global_compiler_flags} -m32
-
-optflags: parisc %{__global_compiler_flags} -mpa-risc-1-0
-optflags: hppa1.0 %{__global_compiler_flags} -mpa-risc-1-0
-optflags: hppa1.1 %{__global_compiler_flags} -mpa-risc-1-0
-optflags: hppa1.2 %{__global_compiler_flags} -mpa-risc-1-0
-optflags: hppa2.0 %{__global_compiler_flags} -mpa-risc-1-0
-
-optflags: mips %{__global_compiler_flags} -march=mips32r2 -mfpxx
-optflags: mipsel %{__global_compiler_flags} -march=mips32r2 -mfpxx
-optflags: mips64 %{__global_compiler_flags} -march=mips64r2 -mabi=64
-optflags: mips64el %{__global_compiler_flags} -march=mips64r2 -mabi=64
-optflags: mipsr6 %{__global_compiler_flags} -march=mips32r6
-optflags: mipsr6el %{__global_compiler_flags} -march=mips32r6
-optflags: mips64r6 %{__global_compiler_flags} -march=mips64r6
-optflags: mips64r6el %{__global_compiler_flags} -march=mips64r6
-
-optflags: armv3l %{__global_compiler_flags} -fsigned-char -march=armv3
-optflags: armv4b %{__global_compiler_flags} -fsigned-char -march=armv4
-optflags: armv4l %{__global_compiler_flags} -fsigned-char -march=armv4
-optflags: armv4tl %{__global_compiler_flags} -march=armv4t
-optflags: armv5tel %{__global_compiler_flags} -march=armv5te -mfloat-abi=soft
-optflags: armv5tejl %{__global_compiler_flags} -march=armv5te -mfloat-abi=soft
-optflags: armv6l %{__global_compiler_flags} -march=armv6 -mfloat-abi=soft
-optflags: armv6hl %{__global_compiler_flags} -march=armv6 -mfpu=vfp -mfloat-abi=hard
-optflags: armv6hnl %{__global_compiler_flags} -march=armv6 -mfpu=neon -mfloat-abi=hard
-optflags: armv7l %{__global_compiler_flags} -march=armv7-a -mfloat-abi=soft
-optflags: armv7hl %{__global_compiler_flags} -march=armv7-a -mfpu=vfpv3-d16 -mtune=generic-armv7-a -mabi=aapcs-linux -mfloat-abi=hard
-optflags: armv7hnl %{__global_compiler_flags} -march=armv7-a -mfpu=neon  -mfloat-abi=hard
-
-optflags: atarist %{__global_compiler_flags}
-optflags: atariste %{__global_compiler_flags}
-optflags: ataritt %{__global_compiler_flags}
-optflags: falcon %{__global_compiler_flags}
-optflags: atariclone %{__global_compiler_flags}
-optflags: milan %{__global_compiler_flags}
-optflags: hades %{__global_compiler_flags}
-
-optflags: s390 %{__global_compiler_flags} -m31 -march=zEC12 -mtune=z13 -fasynchronous-unwind-tables
-optflags: s390x %{__global_compiler_flags} -m64 -march=zEC12 -mtune=z13 -fasynchronous-unwind-tables -fstack-clash-protection
-
-optflags: aarch64 %{__global_compiler_flags} -fasynchronous-unwind-tables -fstack-clash-protection
-
-optflags: riscv64 %{__global_compiler_flags} -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: riscv64 %{__global_compiler_flags} -fasynchronous-unwind-tables %[ "%{toolchain}" == "gcc" ? "-fstack-clash-protection" : "" ] %{_frame_pointers_cflags}
 
 # set build arch to fedora buildarches on hardware capable of running it
 # saves having to do rpmbuild --target=
@@ -87,11 +24,5 @@ buildarchtranslate: pentium3: i686
 buildarchtranslate: i686: i686
 buildarchtranslate: i586: i586
 
-buildarchtranslate: sparcv9: sparcv9
-buildarchtranslate: sparcv9v: sparcv9
-
-buildarchtranslate: armv5tejl: armv5tel
-buildarchtranslate: armv6l: armv5tel
-buildarchtranslate: armv7l: armv5tel
 buildarchtranslate: armv7hl: armv7hl
 buildarchtranslate: armv7hnl: armv7hl

rpmsort

@@ -1,76 +0,0 @@
-#! /usr/bin/perl -w
-
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License
-# as published by the Free Software Foundation; either version 2
-# of the License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
-# USA.
-
-use Getopt::Long qw(:config gnu_getopt);
-
-sub rpm_cmp_versions {
-    my ($evr1, $evr2) = @_;
-
-    sub _rpm_cmp {
-	my ($s1, $s2) = @_;
-
-	return defined $s1 <=> defined $s2
-	    unless defined $s1 && defined $s2;
-
-	my ($r, $x1, $x2);
-	do {
-	    $s1 =~ s/^[^a-zA-Z0-9]+//;
-	    $s2 =~ s/^[^a-zA-Z0-9]+//;
-	    if ($s1 =~ /^\d/ || $s2 =~ /^\d/) {
-		$s1 =~ s/^0*(\d*)//;  $x1 = $1;
-		$s2 =~ s/^0*(\d*)//;  $x2 = $1;
-		$r = length $x1 <=> length $x2 || $x1 cmp $x2;
-	    } else {
-		$s1 =~ s/^([a-zA-Z]*)//;  $x1 = $1;
-		$s2 =~ s/^([a-zA-Z]*)//;  $x2 = $1;
-		return 0
-		    if $x1 eq '' && $x2 eq '';
-		$r = $x1 cmp $x2;
-	    }
-	} until $r;
-	return $r;
-    }
-
-    my ($e1, $v1, $r1) = $evr1 =~ /^(?:(\d*):)?(.*?)(?:-([^-]*))?$/;
-    my ($e2, $v2, $r2) = $evr2 =~ /^(?:(\d*):)?(.*?)(?:-([^-]*))?$/;
-    my $r = _rpm_cmp($e1 || 0, $e2 || 0);
-    $r = _rpm_cmp($v1, $v2)
-	unless $r;
-    $r = _rpm_cmp($r1, $r2)
-	unless $r;
-    return $r;
-}
-
-my $reorder = sub { return @_ };
-my $key = 0;
-
-GetOptions ("r|reverse"	    => sub { $reorder = sub { return reverse @_ } },
-	    "k|key=i"	    => \$key)
-or do {
-    print STDERR "Usage\n";
-    exit 1;
-};
-
-if ($key == 0) {
-    # Sort by entire lines
-    map { print } &$reorder(sort { rpm_cmp_versions($a, $b) } <>);
-} else {
-    # Sort by field $key
-    my @data = map { [(split)[$key-1], $_] } <>;
-    map { print } &$reorder(map { $_->[1] }
-        sort { rpm_cmp_versions($a->[0], $b->[0]) } @data);
-}

symset-table

@@ -1,40 +0,0 @@
-#! /bin/sh
-
-# Create a table of all symbol sets defined in all /boot/symsets*.tar.gz
-# files.
-#
-# Format:
-#   kernelrelease/modver/symbol <tab> symset <tab> symset_hash
-#
-# This table is needed for computing the appropriate Requires: tags for
-# kernel module packages.
-
-tmpdir=$(mktemp -t -d ${0##*/}.XXXXXX)
-trap "cd / ; rm -rf $tmpdir" EXIT
-cd $tmpdir
-
-shopt -s nullglob
-for symsets in /boot/symsets-*.tar.gz; do
-    zcat $symsets \
-    | tar xf -
-done
-
-for symsets in /usr/src/kernels/*/symsets-*.tar.gz; do
-    zcat $symsets \
-    | tar xf -
-done
-
-for symsets in *; do
-    krel=${symsets#symsets-}
-    for symset in $symsets/*; do
-	class=${symset##*/} ; class=${class%.*}
-	hash=${symset##*.}
-	awk '
-	BEGIN { FS = "\t" ; OFS = "\t" }
-	{ sub(/0x0*/, "", $1)
-	  print krel "/" $1 "/" $2, class, hash }
-	' krel="$krel" class="$class" hash="$hash" $symset
-    done
-done
-
-# vim:shiftwidth=4 softtabstop=4

tests/auto-set-build-flags/Makefile

@@ -0,0 +1,11 @@
+.phony: all
+
+all: hello-c hello-cpp
+
+clean:
+	rm -Rf *.o hello-c hello-cpp
+
+hello-c: main-c.o hello-c.o
+
+hello-cpp: main-cpp.o hello-cpp.o
+	$(CXX) $(LDFLAGS) -o $@ $^

tests/auto-set-build-flags/hello-c.c

@@ -0,0 +1,5 @@
+#include <stdio.h>
+
+void hello(void) {
+    printf("Hello, World!");
+}

tests/auto-set-build-flags/hello-cpp.cpp

@@ -0,0 +1,5 @@
+#include <iostream>
+
+void hello(void) {
+    std::cout << "Hello, World!\n";
+}

tests/auto-set-build-flags/main-c.c

@@ -0,0 +1,5 @@
+void hello(void);
+
+int main(int argc, char **argv) {
+    hello();
+}

tests/auto-set-build-flags/main-cpp.cpp

@@ -0,0 +1,5 @@
+void hello(void);
+
+int main(int argc, char **argv) {
+    hello();
+}

tests/auto-set-build-flags/main.fmf

@@ -0,0 +1,12 @@
+summary: >
+  Check the that the environment variables for build flags are automatically set
+  https://fedoraproject.org/wiki/Changes/SetBuildFlagsBuildCheck
+
+require:
+  - annobin-annocheck
+  - dnf5-plugins
+  - gcc
+  - gcc-c++
+  - make
+
+test: ./runtest.sh

tests/auto-set-build-flags/runtest.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -ex
+
+dnf -y builddep test.spec
+rpmbuild --define '_sourcedir .' --define '_builddir .' -bi test.spec
+rpmbuild --without auto_set_build_flags --define '_sourcedir .' --define '_builddir .' -bi test.spec

tests/auto-set-build-flags/test.spec

@@ -0,0 +1,39 @@
+%bcond_without auto_set_build_flags
+
+%if %{without auto_set_build_flags}
+%undefine _auto_set_build_flags
+%endif
+
+Name: test
+Version: 1
+Release: 1
+Summary: Test package for checking %%set_build_flag usage
+License: MIT
+
+BuildRequires: gcc gcc-c++ make
+BuildRequires: annobin-annocheck
+
+Source0: Makefile
+Source1: main-c.c
+Source2: hello-c.c
+Source3: main-cpp.cpp
+Source4: hello-cpp.cpp
+
+%global build_and_check \
+	make \
+	%{!?with_auto_set_build_flags:!} annocheck hello-c hello-cpp \
+	make clean
+
+%description
+Test package for checking %%set_build_flag usage
+
+%prep
+
+%build
+%build_and_check
+
+%check 
+%build_and_check
+
+%install
+%build_and_check

tests/brp-llvm-compile-lto-elf/brp-llvm-compile-lto-elf-test-lib/brp-llvm-compile-lto-elf-test-lib.c

@@ -0,0 +1,5 @@
+#include <stdio.h>
+
+void hello(void) {
+    printf("Hello, world!\n");
+}

tests/brp-llvm-compile-lto-elf/brp-llvm-compile-lto-elf-test-lib/brp-llvm-compile-lto-elf-test-lib.h

@@ -0,0 +1 @@
+void hello(void);

tests/brp-llvm-compile-lto-elf/brp-llvm-compile-lto-elf-test-lib/brp-llvm-compile-lto-elf-test-lib.spec

@@ -0,0 +1,34 @@
+Name: brp-llvm-compile-lto-elf-test-lib
+Version: 1
+Release: 1
+Summary: Library package for testing brp-llvm-compile-lto-elf
+License: MIT
+
+BuildRequires: clang binutils
+Source0: %{name}.c
+Source1: %{name}.h
+
+# FIXME: I'm not sure why this doesn't work
+%undefine _package_note_file
+
+%global toolchain clang
+
+%description
+%{summary}
+
+%build
+
+clang ${CFLAGS} -c %{SOURCE0} -o lib.o
+ar cr %{name}.a lib.o
+ranlib %{name}.a
+
+%install
+mkdir -p %{buildroot}%{_libdir}
+mkdir -p %{buildroot}%{_includedir}
+
+%{__install} -p -m 644 -t %{buildroot}%{_libdir} %{name}.a
+%{__install} -p -m 644 -t %{buildroot}%{_includedir} %{SOURCE1}
+
+%files
+%{_libdir}/%{name}.a
+%{_includedir}/%{name}.h

tests/brp-llvm-compile-lto-elf/brp-llvm-compile-lto-elf-test/brp-llvm-compile-lto-elf-test.c

@@ -0,0 +1,6 @@
+#include <brp-llvm-compile-lto-elf-test-lib.h>
+
+int main(int argc, char **argv) {
+  hello();
+  return 0;
+}

tests/brp-llvm-compile-lto-elf/brp-llvm-compile-lto-elf-test/brp-llvm-compile-lto-elf-test.spec

@@ -0,0 +1,24 @@
+Name: brp-llvm-compile-lto-elf-test
+Version: 1
+Release: 1
+Summary: Library package for testing brp-llvm-compile-lto-elf
+License: MIT
+
+BuildRequires: gcc
+BuildRequires: brp-llvm-compile-lto-elf-test-lib
+
+Source0: %{name}.c
+
+# FIXME: I'm not sure why this doesn't work
+%undefine _package_note_file
+
+
+%description
+%{summary}
+
+%build
+gcc ${CFLAGS} -c %{SOURCE0} -o %{name}.o
+gcc ${LDFLAGS} %{name}.o %{_libdir}/%{name}-lib.a -o %{name}
+
+%check
+./%{name} | grep "Hello, world!"

tests/brp-llvm-compile-lto-elf/main.fmf

@@ -0,0 +1,9 @@
+Summary: Test that the brp-llvm-compile-lto-elf script is working correctly
+
+require:
+  - dnf-plugins-core
+  - dnf5-plugins
+  - redhat-rpm-config
+  - rpm-build
+
+test: ./runtest.sh

tests/brp-llvm-compile-lto-elf/runtest.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -ex
+
+lib_dir=brp-llvm-compile-lto-elf-test-lib
+lib_spec=$lib_dir/brp-llvm-compile-lto-elf-test-lib.spec
+
+dnf -y builddep $lib_spec 
+rpmbuild --define "_sourcedir ." --define "_builddir ./$lib_dir" --define "_rpmdir ."  -bb $lib_spec
+
+dnf -y install ./`rpm --eval '%{_arch}'`/*.rpm
+
+test_dir=brp-llvm-compile-lto-elf-test
+test_spec=$test_dir/brp-llvm-compile-lto-elf-test.spec
+
+dnf -y builddep $test_spec
+rpmbuild --define "_sourcedir ." --define "_builddir ./$test_dir" -bi $test_spec

tests/build-gating.fmf

@@ -0,0 +1,16 @@
+summary: Tests
+discover:
+  - name: redhat-rpm-config-tests
+    how: fmf
+  - name: gcc-fedora-flags
+    how: fmf
+    url: https://src.fedoraproject.org/rpms/gcc.git
+    ref: rawhide
+    test: fedora-flags
+  - name: clang-fedora-flags
+    how: fmf
+    url: https://src.fedoraproject.org/rpms/clang.git
+    ref: rawhide
+    test: fedora-flags
+execute:
+  how: tmt

tests/build-self/main.fmf

@@ -0,0 +1,7 @@
+summary: self-build test
+
+require:
+  - dnf-plugins-core
+  - dnf5-plugins
+  - rpm-build
+test: ./runtest.sh

tests/build-self/runtest.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -e
+
+spec=$TMT_TREE/redhat-rpm-config.spec
+dnf -y builddep $spec
+rpmbuild --define "_sourcedir $TMT_TREE" -ba $spec

tests/characters-in-flags/main.fmf

@@ -0,0 +1,5 @@
+summary: Test to ensure there aren't extraneous characters in build flags
+require:
+  - redhat-rpm-config
+test: ./runtest.sh
+

tests/characters-in-flags/runtest.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -ex
+
+for f in %{build_cflags} %{build_cxxflags} %{build_fflags} %{build_ldflags}; do
+  rpm --eval "$f" | grep -vP '\t'
+done

tests/distro-extra-flags/main.fmf

@@ -0,0 +1,8 @@
+summary: >
+  Check that the %_distro_extra_* macros allow users to append new flags to the
+  list of default flags.
+
+require:
+  - rpm
+
+test: ./runtest.sh

tests/distro-extra-flags/runtest.sh

@@ -0,0 +1,6 @@
+set -ex
+
+rpm -D '%_distro_extra_cflags -Wall' -E %{build_cflags} | grep -e '\-Wall$'
+rpm -D '%_distro_extra_cxxflags -Wall' -E %{build_cxxflags} | grep -e '\-Wall$'
+rpm -D '%_distro_extra_ldflags -Wall' -E %{build_ldflags} | grep -e '\-Wall$'
+rpm -D '%_distro_extra_fflags -Wall' -E %{build_fflags} | grep -e '\-Wall$'

tests/include-frame-pointers/main.fmf

@@ -0,0 +1,7 @@
+summary: Test that conditional support for frame pointers works
+
+require:
+  - grep
+  - redhat-rpm-config
+  - rpm
+test: ./runtest.sh

tests/include-frame-pointers/runtest.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+
+# Not using set -e on purpose as we manually validate the exit codes to print
+# useful messages.
+set -u
+
+passed=0
+failed=0
+
+rpmeval() {
+  # Note: --eval needs to always be *last* here
+  rpm "$@" --eval='%optflags'
+}
+
+validate() {
+  ret=$?
+  if [ $ret -eq 0 ]; then
+    echo "PASS: $*"
+    passed=$((passed+1))
+  else
+    echo "FAIL: $*"
+    failed=$((failed+1))
+  fi
+}
+
+for arch in aarch64 x86_64 riscv64; do
+  case "$arch" in
+    x86_64|aarch64)
+      flags='-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer'
+      ;;
+    *)
+      flags='-fno-omit-frame-pointer'
+      ;;
+  esac
+
+  rpmeval --target="${arch}-linux" --define='_include_frame_pointers 1' | grep -q -- "$flags"
+  validate "[${arch}] Test that the flags are included if the macro is defined"
+
+  rpmeval --target="${arch}-linux" --undefine='_include_frame_pointers' | grep -qv -- "$flags"
+  validate "[${arch}] Test that the flags are _not_ included if the macro is undefined"
+
+  rpmeval --target="${arch}-linux" --define='fedora 1' | grep -q -- "$flags"
+  validate "[${arch}] Test that the flags are included by default on Fedora"
+
+  rpmeval --target="${arch}-linux" --define='rhel 1' | grep -qv -- "$flags"
+  validate "[${arch}] Test that the flags are _not_ included by default on RHEL"
+done
+
+flags='-fno-omit-frame-pointer'
+for arch in i386 i486 i586 i686 athlon ppc64le s390x; do
+  rpmeval --target="${arch}-linux" --define='_include_frame_pointers 1' | grep -qv -- "$flags"
+  validate "[${arch}] Test that the flags are not included if the macro is defined"
+
+  rpmeval --target="${arch}-linux" | grep -qv -- "$flags"
+  validate "[${arch}] Test that the flags are not included by default"
+done
+
+echo
+echo "${passed} passed, ${failed} failed"
+
+exit "$failed"

tests/no-new-dependency/main.fmf

@@ -0,0 +1,8 @@
+summary: Test that we don't accidently introduce any new dependencies.
+
+require:
+  - diffutils
+  - grep
+  - redhat-rpm-config
+  - rpm
+test: ./runtest.sh

tests/no-new-dependency/requires.txt

@@ -0,0 +1,12 @@
+coreutils
+dwz
+rpm
+zip
+/bin/sh
+/usr/bin/bash
+/usr/bin/file
+/usr/bin/find
+/usr/bin/grep
+/usr/bin/sed
+/usr/bin/sh
+/usr/bin/xargs

tests/no-new-dependency/runtest.sh

@@ -0,0 +1,11 @@
+#!/bin/bash -ex
+
+# we diff most of the dependencies against our list in requires.txt
+# generally, a new dependency is bad, for exceptional cases, we can add it to the list together with the change
+# we intentionally grep out:
+#  -srpm-macros and -rpm-macros
+#  rpmlib(...)
+#  conditional dependencies (they contain if)
+# at the end, we strip the versions with cut
+diff -u <(cat $(dirname $0)/requires.txt | sort | uniq) \
+        <(rpm -q --requires redhat-rpm-config | grep -Ev -- '-s?rpm-macros(\s|$)|^rpmlib\(|\sif\s' | cut -d' ' -f1 | sort | uniq)

tests/rustflags/main.fmf

@@ -0,0 +1,7 @@
+summary: Test that conditional support for RUSTFLAGS works
+
+require:
+  - redhat-rpm-config
+  - rpm
+  - rust-packaging
+test: ./runtest.sh

tests/rustflags/runtest.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/bash
+set -e -u -o pipefail
+
+# Allow for local testing
+rargs=()
+if [ -n "${MACROS_PATH:-}" ]; then
+    default_macros_path="$(rpm --showrc | grep 'Macro path' | awk -F ': ' '{print $2}')"
+    rargs+=("--macros" "${default_macros_path}:${MACROS_PATH}")
+fi
+
+build_rustflags="$(rpm -E '%{build_rustflags}')"
+# For good measure
+[ "${build_rustflags}" != "%{build_rustflags}" ]
+#
+flags="$(rpm "${rargs[@]}" -E '%set_build_flags')"
+
+echo 'Check that RUSTFLAGS is set after evaluating %set_build_flags'
+(
+    eval "${flags}"
+    # set -u will make this fail if $RUSTFLAGS isn't defined
+    [ "${RUSTFLAGS}" = "${build_rustflags}" ]
+)