From 4de750ce90d6ab72a91edf0c2059f70a7d5debce Mon Sep 17 00:00:00 2001
From: Daan De Meyer <daan.j.demeyer@gmail.com>
Date: Mon, 22 Apr 2024 09:32:35 +0200
Subject: [PATCH 1/3] mkosi: Add environment variable to set the optimization
 level

---
 mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot     | 2 +-
 .../system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot     | 2 +-
 .../system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot     | 2 +-
 mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
index 5abeea5493..04eeaf1e37 100755
--- a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
@@ -25,7 +25,7 @@ mount --mkdir --rbind "$PWD/pkg/$ID" "pkg/$ID/src/"
 # on the makepkg command line so we append to /etc/makepkg.conf instead. The rootfs is overlaid with a
 # writable tmpfs during the build script so these changes don't end up in the image itself.
 tee --append /etc/makepkg.conf >/dev/null <<EOF
-CFLAGS="$CFLAGS -O0 -Wp,-U_FORTIFY_SOURCE"
+CFLAGS="$CFLAGS -O${OPTIMIZATION:-0} -Wp,-U_FORTIFY_SOURCE"
 OPTIONS=(
     docs
     !libtool
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
index 8c4c2469ae..79770c0d4f 100755
--- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
@@ -32,7 +32,7 @@ ARCH="$(rpm --eval %_arch)"
 SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH"
 
 # TODO: Drop -U_FORTIFY_SOURCE when we switch to CentOS Stream 10.
-CFLAGS="$(rpm --define "_fortify_level 0" --undefine _lto_cflags --eval %build_cflags) -O0 -Wp,-U_FORTIFY_SOURCE"
+CFLAGS="$(rpm --define "_fortify_level 0" --undefine _lto_cflags --eval %build_cflags) -O${OPTIMIZATION:-0} -Wp,-U_FORTIFY_SOURCE"
 if ((WITH_DEBUG)); then
     CFLAGS="$CFLAGS -ffile-prefix-map=../src=$SRCDEST"
 fi
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
index a8775d05f1..a67fda1cf4 100755
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
@@ -48,13 +48,13 @@ build() {
         $( ((WITH_DEBUG)) || echo nostrip) \
         terse \
         optimize=-lto \
-        noopt \
     " \
     DEB_BUILD_PROFILES="\
         $( ((WITH_TESTS)) || echo nocheck) \
         $( ((WITH_DOCS)) || echo nodoc) \
         pkg.systemd.upstream \
     " \
+    DEB_CFLAGS_APPEND="-O${OPTIMIZATION:-0}" \
     DPKG_FORCE="unsafe-io" \
     DPKG_DEB_COMPRESSOR_TYPE="none" \
     DH_MISSING="--fail-missing" \
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
index be27099791..6d09779164 100755
--- a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
@@ -37,7 +37,7 @@ ARCH="$(rpm --eval %_arch)"
 SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH"
 
 # TODO: Enable this when the opensuse spec stops unconditionally setting FORTIFY_SOURCE=2.
-# EXTRA_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE"
+# EXTRA_CFLAGS="-O${OPTIMIZATION:-0} -Wp,-U_FORTIFY_SOURCE"
 EXTRA_CFLAGS=""
 if ((WITH_DEBUG)); then
     EXTRA_CFLAGS="$EXTRA_CFLAGS -ffile-prefix-map=../src=$SRCDEST"

From 4ccc28b8a829d3f73b2a1c38378e15375447300a Mon Sep 17 00:00:00 2001
From: Daan De Meyer <daan.j.demeyer@gmail.com>
Date: Mon, 22 Apr 2024 10:48:52 +0200
Subject: [PATCH 2/3] mkosi: Use awk to avoid dpkg-buildpackage warning

Let's strip unnecessary whitespace to avoid a dpkg-buildpackage
warning.
---
 .../mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot      | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
index a67fda1cf4..3059ce8476 100755
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
@@ -42,18 +42,18 @@ cat debian/changelog >>debian/changelog.new
 mv debian/changelog.new debian/changelog
 
 build() {
-    DEB_BUILD_OPTIONS="\
+    DEB_BUILD_OPTIONS=$(awk '$1=$1' <<<"\
         $( ((WITH_TESTS)) || echo nocheck) \
         $( ((WITH_DOCS)) || echo nodoc) \
         $( ((WITH_DEBUG)) || echo nostrip) \
         terse \
         optimize=-lto \
-    " \
-    DEB_BUILD_PROFILES="\
+    ") \
+    DEB_BUILD_PROFILES=$(awk '$1=$1' <<<"\
         $( ((WITH_TESTS)) || echo nocheck) \
         $( ((WITH_DOCS)) || echo nodoc) \
         pkg.systemd.upstream \
-    " \
+    ") \
     DEB_CFLAGS_APPEND="-O${OPTIMIZATION:-0}" \
     DPKG_FORCE="unsafe-io" \
     DPKG_DEB_COMPRESSOR_TYPE="none" \

From 8308fcfec3153e0f48a8c1ab41a8304c14af27fb Mon Sep 17 00:00:00 2001
From: Daan De Meyer <daan.j.demeyer@gmail.com>
Date: Mon, 22 Apr 2024 10:49:32 +0200
Subject: [PATCH 3/3] mkosi: Explicitly disable fortify for debian/ubuntu

We do the same for the other distributions, so let's do so for
debian/ubuntu as well.
---
 .../system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
index 3059ce8476..061ed5b5a7 100755
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
@@ -48,6 +48,7 @@ build() {
         $( ((WITH_DEBUG)) || echo nostrip) \
         terse \
         optimize=-lto \
+        hardening=-fortify \
     ") \
     DEB_BUILD_PROFILES=$(awk '$1=$1' <<<"\
         $( ((WITH_TESTS)) || echo nocheck) \