build: use distro CFLAGS

Instead of using the default settings, use the ones used to build the
distros. This should also catch more bugs due to FORTIFY and friends
being enabled.

Signed-off-by: Daniel Wagner <[email protected]>

Author: igaw

.github/workflows/build.yml

@@ -25,6 +25,35 @@ jobs:
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: build
         run: |
+          if [ "${{ matrix.compiler }}" = "gcc" ]; then
+            if [ "${{ matrix.buildtype }}" = "release" ]; then
+              if [ "${{ matrix.distro }}" = "tumbleweed" ]; then
+                export CFLAGS="-O2 -Wall -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 \
+                  -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables \
+                  -fstack-clash-protection -Werror=return-type -flto=auto -g"
+                export CXXFLAGS="$CFLAGS"
+                export LDFLAGS="-flto=auto"
+              # TODO: The RH build depends on environment varibles/settings which prevent
+              # the compiler from working.
+              #
+              # elif [ "${{ matrix.distro }}" = "fedora" ]; then
+              #   export CFLAGS="-O2 -flto=auto -ffat-lto-objects -fexceptions -g \
+              #     -grecord-gcc-switches -pipe -Wall -Werror=format-security \
+              #     -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS \
+              #     -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong \
+              #     -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic \
+              #     -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables \
+              #     -fstack-clash-protection"
+              #   export CXXFLAGS="$CFLAGS"
+              #   export LDFLAGS='-Wl,-z,relro -Wl,--as-needed -Wl,-z,pack-relative-relocs \
+              #     -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld \
+              #     -specs=/usr/lib/rpm/redhat/redhat-hardened-ld-errors \
+              #     -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 \
+              #     -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes'
+              fi
+            fi
+          fi
+
           scripts/build.sh -b ${{ matrix.buildtype }} -c ${{ matrix.compiler }} -x
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         name: upload logs