From ab47d2524d5989d0857a12153335ce80b1a454e6 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 5 Dec 2019 15:52:23 +0000
Subject: [PATCH] Further fixes to CFLAGS and annobin.

---
 ...-Allow-user-defined-C-compiler-flags.patch |  6 ++---
 ...-incorrect-assumption-about-cross-co.patch | 26 +++++++++++++++----
 0012-Add-riscv64-backend.patch                | 10 +++----
 ocaml.spec                                    | 21 ++++++++++++++-
 4 files changed, 49 insertions(+), 14 deletions(-)

diff --git a/0010-configure-Allow-user-defined-C-compiler-flags.patch b/0010-configure-Allow-user-defined-C-compiler-flags.patch
index 7d532d4..34ff372 100644
--- a/0010-configure-Allow-user-defined-C-compiler-flags.patch
+++ b/0010-configure-Allow-user-defined-C-compiler-flags.patch
@@ -1,4 +1,4 @@
-From f1c04c17f5b42a969cbf3119ebbb851e799d664d Mon Sep 17 00:00:00 2001
+From aab08177e52b9951b5e95c949c7b61c690a0efd7 Mon Sep 17 00:00:00 2001
 From: "Richard W.M. Jones" <rjones@redhat.com>
 Date: Tue, 29 May 2012 20:44:18 +0100
 Subject: [PATCH 10/12] configure: Allow user defined C compiler flags.
@@ -8,7 +8,7 @@ Subject: [PATCH 10/12] configure: Allow user defined C compiler flags.
  1 file changed, 4 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index c2f185373..12d9f6cde 100644
+index c2f185373..547640906 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -549,6 +549,10 @@ AS_CASE([$host],
@@ -17,7 +17,7 @@ index c2f185373..12d9f6cde 100644
  
 +# Allow CFLAGS and LDFLAGS to be added.
 +common_cflags="$common_cflags $CFLAGS"
-+oc_ldflags="$oc_ldflags $LDFLAGS"
++cclibs="$cclibs $LDFLAGS"
 +
  internal_cppflags="-DCAML_NAME_SPACE $internal_cppflags"
  
diff --git a/0011-configure-Remove-incorrect-assumption-about-cross-co.patch b/0011-configure-Remove-incorrect-assumption-about-cross-co.patch
index d7ab72d..f2743cf 100644
--- a/0011-configure-Remove-incorrect-assumption-about-cross-co.patch
+++ b/0011-configure-Remove-incorrect-assumption-about-cross-co.patch
@@ -1,4 +1,4 @@
-From 3432e0eb653e670025642b6e40e2d4a2eb4c28ae Mon Sep 17 00:00:00 2001
+From 272b31bbd8c35a613f035465441ac5a34de8450e Mon Sep 17 00:00:00 2001
 From: "Richard W.M. Jones" <rjones@redhat.com>
 Date: Fri, 26 Apr 2019 16:16:29 +0100
 Subject: [PATCH 11/12] configure: Remove incorrect assumption about
@@ -6,14 +6,30 @@ Subject: [PATCH 11/12] configure: Remove incorrect assumption about
 
 See https://github.com/ocaml/ocaml/issues/8647#issuecomment-487094390
 ---
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ configure.ac | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 12d9f6cde..e85cc9ffa 100644
+index 547640906..9ee8dcaae 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -927,7 +927,7 @@ AS_IF([test $arch != "none" && $arch64 ],
+@@ -461,10 +461,11 @@ AS_IF(
+ 
+ # Are we building a cross-compiler
+ 
+-AS_IF(
+-  [test x"$host" = x"$target"],
+-    [cross_compiler=false],
+-    [cross_compiler=true])
++#AS_IF(
++#  [test x"$host" = x"$target"],
++#    [cross_compiler=false],
++#    [cross_compiler=true])
++cross_compiler=false
+ 
+ # Checks for programs
+ 
+@@ -927,7 +928,7 @@ AS_IF([test $arch != "none" && $arch64 ],
  
  # Assembler
  
diff --git a/0012-Add-riscv64-backend.patch b/0012-Add-riscv64-backend.patch
index 5883ba8..7666e22 100644
--- a/0012-Add-riscv64-backend.patch
+++ b/0012-Add-riscv64-backend.patch
@@ -1,4 +1,4 @@
-From a861b131c28af6b313c7e778e2b6712e6b6fa5f2 Mon Sep 17 00:00:00 2001
+From 46230ada6483449154c465243edd80d9e539b73a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nicol=C3=A1s=20Ojeda=20B=C3=A4r?= <n.oje.bar@gmail.com>
 Date: Mon, 18 Nov 2019 01:13:30 +0100
 Subject: [PATCH 12/12] Add riscv64 backend
@@ -1330,10 +1330,10 @@ zcmcaGS+R4HVnYjK3sVbo3(FQ(q4(40y<`>J9{!&7H7_IAbVhe}>Fw|SvOW@@t|-E$
 WI9*SajjjE^C<wD}|1ZjM(HH<?7Z~RN
 
 diff --git a/configure.ac b/configure.ac
-index e85cc9ffa..831cdf077 100644
+index 9ee8dcaae..070944e7a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -799,7 +799,8 @@ AS_IF([test x"$enable_shared" != "xno"],
+@@ -800,7 +800,8 @@ AS_IF([test x"$enable_shared" != "xno"],
      [arm*-*-freebsd*], [natdynlink=true],
      [earm*-*-netbsd*], [natdynlink=true],
      [aarch64-*-linux*], [natdynlink=true],
@@ -1343,7 +1343,7 @@ index e85cc9ffa..831cdf077 100644
  
  # Try to work around the Skylake/Kaby Lake processor bug.
  AS_CASE(["$CC,$host"],
-@@ -890,7 +891,11 @@ AS_CASE([$host],
+@@ -891,7 +892,11 @@ AS_CASE([$host],
    [aarch64-*-freebsd*],
      [arch=arm64; system=freebsd],
    [x86_64-*-cygwin*],
@@ -1356,7 +1356,7 @@ index e85cc9ffa..831cdf077 100644
  )
  
  AS_IF([test x"$enable_native_compiler" = "xno"],
-@@ -976,7 +981,7 @@ AS_CASE(["$arch,$system"],
+@@ -977,7 +982,7 @@ AS_CASE(["$arch,$system"],
    [*,freebsd],
      [default_as="${toolpref}as"
      default_aspp="${toolpref}cc -c"],
diff --git a/ocaml.spec b/ocaml.spec
index 2e4666b..abf8161 100644
--- a/ocaml.spec
+++ b/ocaml.spec
@@ -83,6 +83,7 @@ BuildRequires:  gdbm-devel
 BuildRequires:  gawk
 BuildRequires:  perl-interpreter
 BuildRequires:  util-linux
+BuildRequires:  /usr/bin/annocheck
 BuildRequires:  chrpath
 
 Requires:       gcc
@@ -187,9 +188,17 @@ make=make
 #
 # Force --host because of:
 # https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/2O4HBOK6PTQZAFAVIRDVMZGG2PYB2QHM/
+# (see also https://github.com/ocaml/ocaml/issues/8647)
+#
+# OC_CFLAGS/OC_LDFLAGS control what flags OCaml passes to the linker
+# when doing final linking of OCaml binaries.  Setting these is
+# necessary to ensure that generated binaries have Fedora hardening
+# features.
 %configure \
+    OC_CFLAGS="$CFLAGS" \
+    OC_LDFLAGS="$LDFLAGS" \
     --libdir=%{_libdir}/ocaml \
-    --host=`./config/gnu/config.guess`
+    --host=`./build-aux/config.guess`
 $make world
 %if %{native_compiler}
 $make opt
@@ -198,6 +207,15 @@ $make opt.opt
 
 
 %check
+%ifarch %{ocaml_native_compiler}
+# For information only, compile a binary and dump the annocheck data
+# from it.  Useful so we know if hardening is being enabled, but don't
+# fail because not every hardening feature can be enabled here.
+echo 'print_endline "hello, world"' > hello.ml
+./ocamlopt.opt -verbose -I stdlib hello.ml -o hello ||:
+annocheck -v hello ||:
+%endif
+
 %ifarch %{test_arches}
 cd testsuite
 
@@ -362,6 +380,7 @@ find $RPM_BUILD_ROOT \( -name '*.cmt' -o -name '*.cmti' \) -a -delete
 - Rename target_camlheader[di] -> camlheader[di] files.
 - Remove vmthreads - old threading library which is no longer built.
 - Remove x11 subpackage which is obsolete.
+- Further fixes to CFLAGS and annobin.
 
 * Fri Aug 16 2019 Richard W.M. Jones <rjones@redhat.com> - 4.08.1-1
 - OCaml 4.08.1 final.