From e832a5fa41daa5070ae3dc512fbddd60c61e1046 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= <pzacik@redhat.com>
Date: Thu, 4 Sep 2025 17:05:43 +0200
Subject: [PATCH] Fix globally disabled LTO

Using %define _lto_cflags %{nil} in %check
would zero the LTO flags globally, resulting
in disabled LTO for the entire build instead
of just the tests.

Related: RHEL-111634
---
 openssl.spec | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/openssl.spec b/openssl.spec
index 5024cdb..5ad4729 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16))
 Summary: Utilities from the general purpose cryptography library with TLS implementation
 Name: openssl
 Version: 3.5.1
-Release: 4%{?dist}
+Release: 5%{?dist}
 Epoch: 1
 Source0: openssl-%{version}.tar.gz
 Source1: fips-hmacify.sh
@@ -291,9 +291,10 @@ OPENSSL_SYSTEM_CIPHERS_OVERRIDE=xyz_nonexistent_file
 export OPENSSL_SYSTEM_CIPHERS_OVERRIDE
 %{SOURCE1} providers/fips.so
 
-# Disable LTO, build tests, and run them
-%define _lto_cflags %{nil}
-make -s %{?_smp_mflags} build_programs
+# Build tests with LTO disabled and run them
+make -s %{?_smp_mflags} build_programs \
+    CFLAGS="%{build_cflags} -fno-lto" \
+    CXXFLAGS="%{build_cxxflags} -fno-lto"
 make test HARNESS_JOBS=8
 
 # Add generation of HMAC checksum of the final stripped library
@@ -458,6 +459,10 @@ touch $RPM_BUILD_ROOT/%{_prefix}/include/openssl/engine.h
 %ldconfig_scriptlets libs
 
 %changelog
+* Fri Sep 05 2025 Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-5
+- Fix globally disabled LTO
+  Related: RHEL-111634
+
 * Thu Aug 28 2025 Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
 - Make openssl speed test signatures without errors
   Resolves: RHEL-95182