aarch64/macros: Build gnulib with -mbranch-protection=standard

Resolves: #RHEL-58821
Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>

grub.macros

@@ -15,7 +15,12 @@
 %endif
 
 # gnulib actively ignores CFLAGS because it's terrible
-%global cc_equals "CC=%{ccpath} -fPIE -Wl,-z,noexecstack -Wl,--no-warn-rwx-segments"
+# build aarch64 gnulib with branch protection
+%ifarch aarch64
+%global cc_equals "CC=%{ccpath} -fPIE -Wl,-z,noexecstack -mbranch-protection=standard"
+%else
+%global cc_equals "CC=%{ccpath} -fPIE -Wl,-z,noexecstack"
+%endif
 
 %global cflags_sed						\\\
 	sed							\\\

grub2.spec

@@ -17,7 +17,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.06
-Release:	128%{?dist}
+Release:	129%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPL-3.0-or-later
 URL:		http://www.gnu.org/software/grub/
@@ -582,6 +582,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
+* Thu Sep 12 2024 Nicolas Frayer <nfrayer@redhat.com> - 2.06-129
+- aarch64/macros: Build gnulib with -mbranch-protection=standard
+- Resolves: #RHEL-58821
+
 * Mon Sep 2 2024 Leo Sandoval <lsandova@redhat.com> - 2.06-128
 - grub.cfg: Fix rpm grub.cfg verification issues
 - Resolves: #RHEL-56918