Fix globally disabled LTO

Using %define _lto_cflags %{nil} in %check
would zero the LTO flags globally, resulting
in disabled LTO for the entire build instead
of just the tests.

Related: RHEL-111633

openssl.spec

@@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16))
 Summary: Utilities from the general purpose cryptography library with TLS implementation
 Name: openssl
 Version: 3.5.1
-Release: 4%{?dist}
+Release: 5%{?dist}
 Epoch: 1
 Source0: openssl-%{version}.tar.gz
 Source1: fips-hmacify.sh
@@ -287,9 +287,10 @@ export OPENSSL_SYSTEM_CIPHERS_OVERRIDE
 #embed HMAC into fips provider for test run
 %{SOURCE1} providers/fips.so
 
-# Disable LTO, build tests, and run them
-%define _lto_cflags %{nil}
-make -s %{?_smp_mflags} build_programs
+# Build tests with LTO disabled and run them
+make -s %{?_smp_mflags} build_programs \
+    CFLAGS="%{build_cflags} -fno-lto" \
+    CXXFLAGS="%{build_cxxflags} -fno-lto"
 make test HARNESS_JOBS=8
 
 # Add generation of HMAC checksum of the final stripped library
@@ -455,6 +456,10 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco
 %ldconfig_scriptlets libs
 
 %changelog
+* Fri Sep 05 2025 Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-5
+- Fix globally disabled LTO
+  Related: RHEL-111633
+
 * Thu Aug 28 2025 Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
 - Make openssl speed test signatures without errors
   Resolves: RHEL-95502