Best way to enable -mbranch-protection for package
Hi,
Upgrading NetworkManager-sstp to the latest version, I've noticed that
there is a failed test related to missing branch protection on AArch64
[1]. After reading that and [2], I know what it is all about, however, I
wonder what is the best way to apply it to my package?
Should I check if the build is for AArch64 and for Fedora 33+ (35+?) and
just add "-mbranch-protection=standard"? Or there is some magic macro to
add that (and maybe some other useful security options), similar to
%{?_smp_mflags} (or maybe even included in %make_build on ARM64)?
[1] -
https://sourceware.org/annobin/annobin.html/Test-branch-protection.html
[2] - https://fedoraproject.org/wiki/Changes/Aarch64_PointerAuthentication
Marcin