Are build hardening flags intentionally not passed to src/gen_context.c?

[sorenstoutner]

Debian utilized a build hardening flag checker, which analyzes the build logs to make sure the appropriate hardening flags are passed to each command. It flags the following two entries.

CFLAGS missing (-fPIE): gcc -Wdate-time -D_FORTIFY_SOURCE=2 -I. -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/litecoin-0.21.4=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -Wall -Wextra -Wno-unused-function -c src/gen_context.c -o gen_context.o
LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): gcc gen_context.o -o gen_context

Is it intentional that the CFLAGS and LDFLAGS are not passed to this file, or is it an oversight?

[sorenstoutner]

Manuel and I were able to fix this problem by doing two things.

1. Configure with --disable-hardening. Litecoin's built-in hardening was fighting with Debian's build hardening. Making this change resolved the entirety of the CFLAGS warning, and the -fPIE portion of the LDFLAGS warning.
2. Patch secp256k1-zkp to pass on the LDFLAGS. This is the patch Manuel wrote:

--- a/src/secp256k1-zkp/Makefile.am
+++ b/src/secp256k1-zkp/Makefile.am
@@ -159,7 +159,7 @@ gen_%.o: src/gen_%.c
 	$(CC_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(CFLAGS_FOR_BUILD) -c $< -o $@
 
 $(gen_context_BIN): $(gen_context_OBJECTS)
-	$(CC_FOR_BUILD) $^ -o $@
+	$(CC_FOR_BUILD) $^ $(LDFLAGS) -o $@
 
 $(libsecp256k1_la_OBJECTS): src/ecmult_static_context.h
 $(tests_OBJECTS): src/ecmult_static_context.h