40 changed files with 1638 additions and 1502 deletions
--- a/.redhat-rpm-config.metadata
+++ b/.redhat-rpm-config.metadata
--- a/SOURCES/brp-fix-pyc-reproducibility
+++ b/SOURCES/brp-fix-pyc-reproducibility
@ -0,0 +1,18 @@
+#!/bin/bash -e
+
+# If using normal root, avoid changing anything.
+if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
+  exit 0
+fi
+
+# Defined as %py_reproducible_pyc_path macro and passed here as
+# the first command-line argument
+path_to_fix=$1
+
+# First, check that the parser is available:
+if [ ! -x /usr/bin/marshalparser ]; then
+  echo "ERROR: If %py_reproducible_pyc_path is defined, you have to also BuildRequire: /usr/bin/marshalparser !"
+  exit 1
+fi
+
+find "$path_to_fix" -type f -name "*.pyc" | xargs /usr/bin/marshalparser --fix --overwrite
--- a/SOURCES/brp-kmod-restore-perms
+++ b/SOURCES/brp-kmod-restore-perms
@ -1,20 +0,0 @@
-#! /bin/bash -f
-
-## A counterpart of brp-kmod-set-exec-bits that restores original kmod
-## file permissions
-
-# If using normal root, avoid changing anything.
-[ -n "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != "/" ] || exit 0
-
-# Checking for required programs
-which chmod >/dev/null || exit 0
-
-[ -r "$RPM_BUILD_ROOT/kmod-permissions.list" ] || exit 0
-
-while read perm path; do
-	[ -n "$perm" ] || continue
-
-	chmod "$perm" "$RPM_BUILD_ROOT/$path"
-done < "$RPM_BUILD_ROOT/kmod-permissions.list"
-
-rm -f "$RPM_BUILD_ROOT/kmod-permissions.list"
--- a/SOURCES/brp-kmod-set-exec-bit
+++ b/SOURCES/brp-kmod-set-exec-bit
@ -1,14 +0,0 @@
-#! /bin/bash -fx
-
-## A hack for making brp-strip taking into account kmod files
-
-# If using normal root, avoid changing anything.
-[ -n "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != "/" ] || exit 0
-
-# Checking for required programs
-which find chmod >/dev/null || exit 0
-
-find "$RPM_BUILD_ROOT" \
-	-name '*.ko' \
-	-printf '%#m %P\n' \
-	-exec chmod u+x '{}' \; > "$RPM_BUILD_ROOT/kmod-permissions.list"
--- a/SOURCES/brp-ldconfig
+++ b/SOURCES/brp-ldconfig
@ -1,4 +1,4 @@
-#!/bin/sh -f
+#!/bin/sh -efu
 # Force creating of DSO symlinks.

 # If using normal root, avoid changing anything.
@ -6,5 +6,8 @@ if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
  exit 0
 fi

-/sbin/ldconfig -N -r "$RPM_BUILD_ROOT"
+# Create an empty config file for ldconfig to shut up a warning
+config=$(mktemp -p "$RPM_BUILD_ROOT")
+/sbin/ldconfig -f $(basename "$config") -N -r "$RPM_BUILD_ROOT"
+rm -f "$config"
 # TODO: warn if it created new symlinks and guide people.
--- a/SOURCES/brp-llvm-compile-lto-elf
+++ b/SOURCES/brp-llvm-compile-lto-elf
@ -0,0 +1,54 @@
+#!/usr/bin/bash -eu
+
+
+if [ -z "$RPM_BUILD_ROOT" ] || [ "$RPM_BUILD_ROOT" = "/" ]; then
+	exit 0
+fi
+
+CLANG_FLAGS=$@
+NCPUS=${RPM_BUILD_NCPUS:-1}
+
+check_convert_bitcode () {
+  local file_name=$(realpath ${1})
+  local file_type=$(file ${file_name})
+
+  shift
+  CLANG_FLAGS="$@"
+
+  if [[ "${file_type}" == *"LLVM IR bitcode"* ]]; then
+    # Check the output of llvm-strings for the command line, which is in the LLVM bitcode because
+    # we pass -frecord-gcc-switches.
+    # Check for a line that has "-flto" after (or without) "-fno-lto".
+    llvm-strings ${file_name} | while read line ; do
+      flto=$(echo $line   | grep -o -b -e -flto     | tail -n 1 | cut -d : -f 1)
+      fnolto=$(echo $line | grep -o -b -e -fno-lto  | tail -n 1 | cut -d : -f 1)
+
+      if test -n "$flto" && { test -z "$fnolto" || test "$flto" -gt "$fnolto"; } ; then
+        echo "Compiling LLVM bitcode file ${file_name}."
+        clang ${CLANG_FLAGS} -fno-lto -Wno-unused-command-line-argument \
+          -x ir ${file_name} -c -o ${file_name}
+        break
+      fi
+      done
+  elif [[ "${file_type}" == *"current ar archive"* ]]; then
+    echo "Unpacking ar archive ${file_name} to check for LLVM bitcode components."
+    # create archive stage for objects
+    local archive_stage=$(mktemp -d)
+    local archive=${file_name}
+    pushd ${archive_stage}
+    ar x ${archive}
+    for archived_file in $(find -not -type d); do
+      check_convert_bitcode ${archived_file} ${CLANG_FLAGS}
+      echo "Repacking ${archived_file} into ${archive}."
+      ar r ${archive} ${archived_file}
+    done
+    popd
+  fi
+}
+
+echo "Checking for LLVM bitcode artifacts"
+export -f check_convert_bitcode
+# Deduplicate by device:inode to avoid processing hardlinks in parallel.
+find "$RPM_BUILD_ROOT" -type f -name "*.[ao]" -printf "%D:%i %p\n" | \
+  awk '!seen[$1]++' | cut -d" " -f2- | \
+  xargs -d"\n" -r -n1 -P$NCPUS sh -c "check_convert_bitcode \$@ $CLANG_FLAGS" ARG0
--- a/SOURCES/brp-mangle-shebangs
+++ b/SOURCES/brp-mangle-shebangs
@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -eu

 # If using normal root, avoid changing anything.
 if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
@ -76,7 +76,7 @@ cd "$RPM_BUILD_ROOT"
 # (Take care to exclude filenames which would mangle "file" output).
 find -executable -type f ! -path '*:*' ! -path $'*\n*' \
 | file -N --mime-type -f - \
-| grep -P ".+(?=: text/)" \
+| grep -P ".+(?=: (text/|application/javascript))" \
 | {
 fail=0
 while IFS= read -r line; do
@ -137,16 +137,14 @@ while IFS= read -r line; do
  fi

  # Replace "special" env shebang:
-  # /whatsoever/env /whatever/foo → /whatever/foo
-  shebang=$(echo "$shebang" | sed -r -e 's@^(.+)/env /(.+)$@/\2@')
-  # /whatsoever/env foo → /whatsoever/foo
-  shebang=$(echo "$shebang" | sed -r -e 's@^(.+/)env (.+)$@\1\2@')
+  # /whatsoever/env -whatever /whatever/foo → /whatever/foo
+  shebang=$(echo "$shebang" | sed -r -e 's@^(.+)/env( -[^ ]+)* /(.+)$@/\3@')
+  # /whatsoever/env -whatever foo → /whatsoever/foo
+  shebang=$(echo "$shebang" | sed -r -e 's@^(.+/)env( -[^ ]+)* (.+)$@\1\3@')

-  # Replace python3 with the desired Python 3 shebang,
-  # if passed as an non-empty environment variable PYTHON3
-  if [ -n "${PYTHON3:+x}" ]; then
-    shebang=$(echo "$shebang" | sed -r -e "s@/usr/bin/python3(\s|$)@${PYTHON3}\1@")
-  fi
+  # If the shebang now starts with /bin, change it to /usr/bin
+  # https://bugzilla.redhat.com/show_bug.cgi?id=1581757
+  shebang=$(echo "$shebang" | sed -r -e 's@^/bin/@/usr/bin/@')

  # Replace ambiguous python with python2
  py_shebang=$(echo "$shebang" | sed -r -e 's@/usr/bin/python(\s|$)@/usr/bin/python2\1@')
--- a/SOURCES/brp-python-bytecompile
+++ b/SOURCES/brp-python-bytecompile
@ -0,0 +1,141 @@
+#!/bin/bash
+errors_terminate=$2
+
+# Usage of %_python_bytecompile_extra is not allowed anymore
+# See: https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation_phase_3
+# Therefore $1 ($default_python) is not needed and is invoked with "" by default.
+# $default_python stays in the arguments for backward compatibility and $extra for the following check:
+extra=$3
+if [ 0$extra -eq 1 ]; then
+    echo -e "%_python_bytecompile_extra is discontinued, use %py_byte_compile instead.\nSee: https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation_phase_3" >/dev/stderr
+    exit 1
+fi
+
+# If using normal root, avoid changing anything.
+if [ -z "$RPM_BUILD_ROOT" -o "$RPM_BUILD_ROOT" = "/" ]; then
+	exit 0
+fi
+
+# Figure out how deep we need to descend.  We could pick an insanely high
+# number and hope it's enough, but somewhere, somebody's sure to run into it.
+depth=`(find "$RPM_BUILD_ROOT" -type f -name "*.py" -print0 ; echo /) | \
+       xargs -0 -n 1 dirname | sed 's,[^/],,g' | sort -u | tail -n 1 | wc -c`
+if [ -z "$depth" -o "$depth" -le "1" ]; then
+	exit 0
+fi
+
+# This function now implements Python byte-compilation in three different ways:
+# Python >= 3.4 and < 3.9 uses a new module compileall2 - https://github.com/fedora-python/compileall2
+# Python < 3.4 (inc. Python 2) uses compileall module from stdlib with some hacks
+# When we drop support for Python 2, we'd be able to use all compileall2 features like:
+# - -s and -p options to manipulate with a path baked into pyc files instead of $real_libdir
+# - -o 0 -o 1 to produce multiple files in one run - each with a different optimization level - instead of $options
+# - removed useless $depth - both compileall and compileall2 are limited by sys.getrecursionlimit()
+# These changes will make this script much simpler
+# In Python >= 3.9, compileall2 was merged back to standard library (compileall) so we can use it directly again.
+function python_bytecompile()
+{
+    local options=$1
+    local python_binary=$2
+    local exclude=$3
+    local python_libdir=$4
+    local depth=$5 # Not used for Python >= 3.4
+    local real_libdir=$6 # Not used for Python >= 3.4
+
+	python_version=$($python_binary -c "import sys; sys.stdout.write('{0.major}{0.minor}'.format(sys.version_info))")
+
+	#
+	# Python 3.9 and higher
+	#
+	if [ "$python_version" -ge 39 ]; then
+
+		[ ! -z $exclude ] && exclude="-x '$exclude'"
+		# -q disables verbose output
+		# -f forces the process to overwrite existing compiled files
+		# -x excludes paths defined by regex
+		# -e excludes symbolic links pointing outside the build root
+		# -x and -e together implements the same functionality as the Filter class below
+		# -s strips $RPM_BUILD_ROOT from the path
+		# -p prepends the leading slash to the path to make it absolute
+		$python_binary -B $options -m compileall -q -f $exclude -s $RPM_BUILD_ROOT -p / -e $RPM_BUILD_ROOT --invalidation-mode=timestamp $python_libdir
+
+	#
+	# Python 3.4 and higher
+	#
+	elif [ "$python_version" -ge 34 ]; then
+
+		[ ! -z $exclude ] && exclude="-x '$exclude'"
+		# /usr/lib/rpm/redhat/ contains compileall2 Python module
+		# -q disables verbose output
+		# -f forces the process to overwrite existing compiled files
+		# -x excludes paths defined by regex
+		# -e excludes symbolic links pointing outside the build root
+		# -x and -e together implements the same functionality as the Filter class below
+		# -s strips $RPM_BUILD_ROOT from the path
+		# -p prepends the leading slash to the path to make it absolute
+		PYTHONPATH=/usr/lib/rpm/redhat/ $python_binary -B $options -m compileall2 -q -f $exclude -s $RPM_BUILD_ROOT -p / -e $RPM_BUILD_ROOT $python_libdir
+	else
+#
+# Python 3.3 and lower (incl. Python 2)
+#
+
+cat << EOF | $python_binary $options
+import compileall, sys, os, re
+
+python_libdir = "$python_libdir"
+depth = $depth
+real_libdir = "$real_libdir"
+build_root = "$RPM_BUILD_ROOT"
+exclude = r"$exclude"
+
+class Filter:
+    def search(self, path):
+        ret = not os.path.realpath(path).startswith(build_root)
+        if exclude:
+            ret = ret or re.search(exclude, path)
+        return ret
+
+sys.exit(not compileall.compile_dir(python_libdir, depth, real_libdir, force=1, rx=Filter(), quiet=1))
+EOF
+
+fi
+}
+
+# .pyc/.pyo files embed a "magic" value, identifying the ABI version of Python
+# bytecode that they are for.
+#
+# The files below RPM_BUILD_ROOT could be targeting multiple versions of
+# python (e.g. a single build that emits several subpackages e.g. a
+# python26-foo subpackage, a python31-foo subpackage etc)
+#
+# Support this by assuming that below each /usr/lib/python$VERSION/, all
+# .pyc/.pyo files are to be compiled for /usr/bin/python$VERSION.
+#
+# For example, below /usr/lib/python2.6/, we're targeting /usr/bin/python2.6
+# and below /usr/lib/python3.1/, we're targeting /usr/bin/python3.1
+
+# Disable Python hash seed randomization
+# This should help with byte-compilation reproducibility: https://bugzilla.redhat.com/show_bug.cgi?id=1686078
+export PYTHONHASHSEED=0
+
+shopt -s nullglob
+for python_libdir in `find "$RPM_BUILD_ROOT" -type d|grep -E "/(usr|app)/lib(64)?/python[0-9]\.[0-9]+$"`;
+do
+	python_binary=$(basename $python_libdir)
+	real_libdir=${python_libdir/$RPM_BUILD_ROOT/}
+	echo "Bytecompiling .py files below $python_libdir using $python_binary"
+
+	# Generate normal (.pyc) byte-compiled files.
+	python_bytecompile "" "$python_binary" "" "$python_libdir" "$depth" "$real_libdir"
+	if [ $? -ne 0 -a 0$errors_terminate -ne 0 ]; then
+		# One or more of the files had a syntax error
+		exit 1
+	fi
+
+	# Generate optimized (.pyo) byte-compiled files.
+	python_bytecompile "-O" "$python_binary" "" "$python_libdir" "$depth" "$real_libdir"
+	if [ $? -ne 0 -a 0$errors_terminate -ne 0 ]; then
+		# One or more of the files had a syntax error
+		exit 1
+	fi
+done
--- a/SOURCES/brp-strip-lto
+++ b/SOURCES/brp-strip-lto
@ -0,0 +1,17 @@
+#!/usr/bin/sh
+# If using normal root, avoid changing anything.
+if [ -z "$RPM_BUILD_ROOT" ] || [ "$RPM_BUILD_ROOT" = "/" ]; then
+	exit 0
+fi
+
+STRIP=${1:-strip}
+NCPUS=${RPM_BUILD_NCPUS:-1}
+
+case `uname -a` in
+Darwin*) exit 0 ;;
+*) ;;
+esac
+
+# Strip ELF binaries
+find "$RPM_BUILD_ROOT" -type f -name '*.[ao]' \! -regex "$RPM_BUILD_ROOT/*usr/lib/debug.*" -print0 | \
+  eu-elfclassify --not-program --not-library --not-linux-kernel-module --stdin0 --print0 | xargs -0 -r -P$NCPUS -n32 sh -c "$STRIP -p -R .gnu.lto_* -R .gnu.debuglto_* -N __gnu_lto_v1 \"\$@\"" ARG0
--- a/SOURCES/buildflags.md
+++ b/SOURCES/buildflags.md
@ -17,9 +17,9 @@ Prior to that, some common problems in autotools scripts are
 automatically patched across the source tree.

 As a side effect, this will set the environment variables `CFLAGS`,
-`CXXFLAGS`, `FFLAGS`, `FCFLAGS`, and `LDFLAGS`, so they can be used by
-makefiles and other build tools.  (However, existing values for this
-variables are not overwritten.)
+`CXXFLAGS`, `FFLAGS`, `FCFLAGS`, `LDFLAGS` and `LT_SYS_LIBRARY_PATH`,
+so they can be used by makefiles and other build tools.  (However,
+existing values for these variables are not overwritten.)

 If your package does not use autoconf, you can still set the same
 environment variables using
@ -46,6 +46,9 @@ Individual build flags are also available through RPM macros:
  driver.  At the start of the `%build` section, the environment
  variable `RPM_LD_FLAGS` is set to this value.

+The variable `LT_SYS_LIBRARY_PATH` is defined here to prevent the `libtool`
+script (v2.4.6+) from hardcoding %_libdir into the binaries' RPATH.
+
 These RPM macros do not alter shell environment variables.

 For some other build tools separate mechanisms exist:
@ -67,7 +70,7 @@ For building shared objects, you must compile with `-fPIC` in

 For other considerations involving shared objects, see:

-* [Fedora Packaging Guidelines: Shared Libraries](https://fedoraproject.org/wiki/Packaging:Guidelines#Shared_Libraries)
+* [Fedora Packaging Guidelines: Shared Libraries](https://docs.fedoraproject.org/en-US/packaging-guidelines/#_shared_libraries)

 # Customizing compiler and other build flags

@ -75,6 +78,33 @@ It is possible to set RPM macros to change some aspects of the
 compiler flags.  Changing these flags should be used as a last
 recourse if other workarounds are not available.

+### Toolchain selection
+
+The default toolchain uses GCC, and the `%toolchain` macro is defined
+as `gcc`.
+
+It is enough to override `toolchain` macro and all relevant macro for C/C++
+compilers will be switched. Either in the spec or in the command-line.
+
+    %global toolchain clang
+
+or:
+
+    rpmbuild -D "toolchain clang" …
+
+Inside a spec file it is also possible to determine which toolchain is in use
+by testing the same macro. For example:
+
+    %if "%{toolchain}" == "gcc"
+    BuildRequires: gcc
+    %endif
+
+or:
+
+    %if "%{toolchain}" == "clang"
+    BuildRequires: clang compiler-rt
+    %endif
+
 ### Disable autotools compatibility patching

 By default, the invocation of the `%configure` macro replaces
@ -88,6 +118,24 @@ are set as well during libtool-.  This can be switched off using:

    %global _configure_libtool_hardening_hack 0

+Further patching happens in LTO mode, see below.
+
+### Disabling Link-Time Optimization
+
+By default, builds use link-time optimization.  In this build mode,
+object code is generated at the time of the final link, by combining
+information from all available translation units, and taking into
+account which symbols are exported.
+
+To disable this optimization, include this in the spec file:
+
+   %define _lto_cflags %{nil}
+
+If LTO is enabled, `%configure` applies some common required fixes to
+`configure` scripts.  To disable that, define the RPM macro
+`_fix_broken_configure_for_lto` as `true` (sic; it has to be a shell
+command).
+
 ### Lazy binding

 If your package depends on the semantics of lazy binding (e.g., it has
@ -129,6 +177,21 @@ recognized, so it has to come after the hardening flags on the command
 line (it has to be added at the end of `CFLAGS`, or specified after
 the `CFLAGS` variable contents).

+### Keeping dependencies on unused shared objects
+
+By default, ELF shared objects which are listed on the linker command
+line, but which have no referencing symbols in the preceding objects,
+are not added to the output file during the final link.
+
+In order to keep dependencies on shared objects even if none of
+their symbols are used, include this in the RPM spec file:
+
+    %undefine _ld_as_needed
+
+For example, this can be required if shared objects are used for their
+side effects in ELF constructors, or for making them available to
+dynamically loaded plugins.
+
 ### Strict symbol checks in the link editor (ld)

 Optionally, the link editor will refuse to link shared objects which
@ -161,6 +224,18 @@ to the RPM spec file to disable these strict checks.  Alternatively,
 you can pass `-z undefs` to ld (written as `-Wl,-z,undefs` on the gcc
 command line).  The latter needs binutils 2.29.1-12.fc28 or later.

+### Legacy -fcommon
+
+Since version 10, [gcc defaults to `-fno-common`](https://gcc.gnu.org/gcc-10/porting_to.html#common).
+Builds may fail with `multiple definition of ...` errors.
+
+As a short term workaround for such failure,
+it is possible to add `-fcommon` to the flags by defining `%_legacy_common_support`.
+
+    %define _legacy_common_support 1
+
+Properly fixing the failure is always preferred!
+
 ### Post-build ELF object processing

 By default, DWARF debugging information is separated from installed
@ -211,6 +286,15 @@ These steps can be skipped by undefining the corresponding macros:
  processes static `.a` archives instead.
 * `__brp_strip_comment_note`: This step removes unallocated `.note`
  sections, and `.comment` sections from ELF files.
+* `__brp_strip_lto`: This step removes GCC LTO intermediate representation
+  in ELF sections starting with `.gnu.lto_` and `.gnu.debuglto_`.  Skipping
+  this step is strongly discouraged because the tight coupling of LTO
+  data with the GCC version.  The underlying tool is again determined by the
+  `__strip` macro.
+* `__brp_llvm_compile_lto_elf`: This step replaces LLVM bitcode files
+  with object files, thereby removing LLVM bitcode from the installed
+  files.  This transformation is applied to object files in static `.a`
+  archives, too.
 * `__brp_ldconfig`: For each shared object on the library search path
  whose soname does not match its file name, a symbolic link from the
  soname to the file name is created.  This way, these shared objects
@ -264,6 +348,12 @@ The general (architecture-independent) build flags are:
  it possible to unwind the stack (using C++ `throw` or Rust panics)
  from C callback functions if a C library supports non-local exits
  from them (e.g., via `longjmp`).
+* `-fasynchronous-unwind-tables`: Generate full unwind information
+  covering all program points.  This is required for support of
+  asynchronous cancellation and proper unwinding from signal
+  handlers.  It also makes performance and debugging tools more
+  useful because unwind information is available without having to
+  install (and load) debugging information.
 * `-Wp,-D_GLIBCXX_ASSERTIONS`: Enable lightweight assertions in the
  C++ standard library, such as bounds checking for the subscription
  operator on vectors.  (This flag is added to both `CFLAGS` and
@ -280,9 +370,17 @@ The general (architecture-independent) build flags are:
  vulnerabilities can result where the stack overlaps with the heap,
  or thread stacks spill into other regions of memory.)  This flag is
  fully ABI-compatible and has adds very little run-time overhead.
+  This flag is currently not available on aarch64 with the `clang` toolchain.
+* `-flto=auto`: Enable link-time optimization (LTO), using `make` job server
+  integration for parallel processing.  (`gcc` toolchain only)
+* `-ffat-lto-objects`: Generate EFL object files which contain both
+  object code and LTO intermediate representation.  (`gcc` toolchain only)
+* `-flto`: Enable link-time optimization. (`clang` toolchain only)
 * `-grecord-gcc-switches`: Include select GCC command line switches in
  the DWARF debugging information.  This is useful for detecting the
  presence of certain build flags and general hardening coverage.
+* `-fcommon`: This optional flag is used to build legacy software
+  which relies on C tentative definitions.  It is disabled by default.

 For hardened builds (which are enabled by default, see above for how
 to disable them), the flag
@ -310,8 +408,9 @@ command line.  It adds the following flag to the command line:
 To support [binary watermarks for ELF
 objects](https://fedoraproject.org/wiki/Toolchain/Watermark) using
 annobin, the `-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1` flag is
-added by default.  This can be switched off by undefining the
-`%_annotated_build` RPM macro (see above).
+added by default (with the `gcc` toolchain).  This can be switched off
+by undefining the `%_annotated_build` RPM macro (see above).  Binary
+watermarks are currently disabled with the `clang` toolchain.

 ### Architecture-specific compiler flags

@ -324,43 +423,30 @@ not), but their selection depends on the architecture:
    the same compilation.  For such architectures, the RPM build process
    explicitly selects the architecture variant by passing this compiler
    flag.
-*   `-fasynchronous-unwind-tables`: Generate full unwind information
-    covering all program points.  This is required for support of
-    asynchronous cancellation and proper unwinding from signal
-    handlers.  It also makes performance and debugging tools more
-    useful because unwind information is available without having to
-    install (and load) debugging ienformation.
-    Asynchronous unwind tables are enabled for aarch64, i686, s390x,
-    and x86_64.  They are not needed on ppc64le due
-    to architectural differences in stack management.  On these
-    architectures, `-fexceptions` (see above) still enables regular
-    unwind tables (or they are enabled by default even without this
-    option).
-*   `-funwind-tables`: A subset of the unwind information restricted
-    to actual call sites.  Used on ppc64le.  Also implied by
-    `-fexceptions`.

 In addition, `redhat-rpm-config` re-selects the built-in default
 tuning in the `gcc` package.  These settings are:

-*   **i686**: `-march=x86-64` is used to select a minimum supported
-    CPU level matching the baseline for the x86_64 architecture.
-    `-mtune=generic` activates tuning for a current blend of CPUs.
-    `-mfpmath=sse` uses the SSE2 unit for floating point math,
-    instead of the legacy i387 FPU, avoiding issues related to excess
-    precision.  `-mstackrealign` ensures that the generated code
-    does not assume 16-byte stack alignment (as required by the current
-    i386 ABI), but stays compatible with application code compiled
-    before the introduction of 16-byte stack alignment along with SSE2
-    support.
-*   **ppc64le**: `-mcpu=power8 -mtune=power8` selects a minimum supported
-    CPU level of POWER8 (the first CPU with ppc64le support) and tunes
-    for POWER8.
-*   **s390x**: `-march=z13 -mtune=z14` specifies a minimum supported CPU
-    level of z13, while optimizing for a subsequent CPU generation
-    (z14).
-*   **x86_64**: `-mtune=generic` selects tuning which is expected to
-     beneficial for a broad range of current CPUs.
+*   **i686**: `-march=i686` is used to select a minmum support CPU level
+    of i686 (corresponding to the Pentium Pro).  SSE2 support is
+    enabled with `-msse2` (so only CPUs with SSE2 support can run the
+    compiled code; SSE2 was introduced first with the Pentium 4).
+    `-mtune=generic` activates tuning for a current blend of CPUs
+    (under the assumption that most users of i686 packages obtain them
+    through an x86_64 installation on current hardware).
+    `-mfpmath=sse` instructs GCC to use the SSE2 unit for floating
+    point math to avoid excess precision issues.  `-mstackrealign`
+    avoids relying on the stack alignment guaranteed by the current
+    version of the i386 ABI.
+*   **ppc64le**: `-mcpu=power9 -mtune=power9` selects a minimum supported
+    CPU level of POWER9.
+*   **s390x**: `-march=z14 -mtune=z15` specifies a minimum supported CPU
+    level of z14, while optimizing for a subsequent CPU generation
+    (z15).
+*   **x86_64**: `-march=x86-64-v2 -mtune=generic` builds for the
+    [x86-64-v2 micro-architecture level](https://gitlab.com/x86-psABIs/x86-64-ABI/-/blob/master/x86-64-ABI/low-level-sys-info.tex)
+    and selects tuning which is expected to beneficial for a broad range
+    of current CPUs.
 *   **aarch64** does not have any architecture-specific tuning.

 # Individual linker flags
@ -377,6 +463,10 @@ to the compiler driver `gcc`, and not directly to the link editor
  dynamic linker is instructed to revoke write permissions after
  dynamic linking.  Full protection of relocation data requires the
  `-z now` flag (see below).
+* `--as-needed`: In the final link, only generate ELF dependencies
+  for shared objects that actually provide symbols required by the link.
+  Shared objects which are not needed to fulfill symbol dependencies
+  are essentially ignored due to this flag.
 * `-z defs`: Refuse to link shared objects (DSOs) with undefined symbols
  (optional, see above).

--- a/SOURCES/common.lua
+++ b/SOURCES/common.lua
@ -0,0 +1,294 @@
+-- Convenience Lua functions that can be used within rpm macros
+
+-- Reads an rpm variable. Unlike a basic rpm.expand("{?foo}"), returns nil if
+-- the variable is unset, which is convenient in lua tests and enables
+-- differentiating unset variables from variables set to ""
+local function read(rpmvar)
+  if not rpmvar or
+    (rpm.expand("%{" .. rpmvar .. "}") == "%{" .. rpmvar .. "}") then
+    return nil
+  else
+    return rpm.expand("%{?" .. rpmvar .. "}")
+  end
+end
+
+-- Returns true if the macro that called this function had flag set
+--   – for example, hasflag("z") would give the following results:
+--     %foo -z bar → true
+--     %foo -z     → true
+--     %foo        → false
+local function hasflag(flag)
+  return (rpm.expand("%{-" .. flag .. "}") ~= "")
+end
+
+-- Returns the argument passed to flag in the macro that called this function
+--  – for example, readflag("z") would give the following results:
+--      %foo -z bar → bar
+--      %foo        → nil
+--      %foo -z ""  → empty string
+--      %foo -z ''  → empty string
+local function readflag(flag)
+  if not hasflag(flag) then
+    return nil
+  else
+    local a = rpm.expand("%{-" .. flag .. "*}")
+    -- Handle "" and '' as empty strings
+    if (a == '""') or (a == "''") then
+      a = ''
+    end
+    return a
+  end
+end
+
+-- Sets a spec variable; echoes the result if verbose
+local function explicitset(rpmvar, value, verbose)
+  local value = value
+  if (value == nil) or (value == "") then
+    value = "%{nil}"
+  end
+  rpm.define(rpmvar .. " " .. value)
+  if verbose then
+    rpm.expand("%{warn:Setting %%{" .. rpmvar .. "} = " .. value .. "}")
+  end
+end
+
+-- Unsets a spec variable if it is defined; echoes the result if verbose
+local function explicitunset(rpmvar, verbose)
+  if (rpm.expand("%{" .. rpmvar .. "}") ~= "%{" .. rpmvar .. "}") then
+    rpm.define(rpmvar .. " %{nil}")
+    if verbose then
+      rpm.expand("%{warn:Unsetting %%{" .. rpmvar .. "}}")
+    end
+  end
+end
+
+-- Sets a spec variable, if not already set; echoes the result if verbose
+local function safeset(rpmvar, value, verbose)
+  if (rpm.expand("%{" .. rpmvar .. "}") == "%{" .. rpmvar .. "}") then
+    explicitset(rpmvar,value,verbose)
+  end
+end
+
+-- Aliases a list of rpm variables to the same variables suffixed with 0 (and
+-- vice versa); echoes the result if verbose
+local function zalias(rpmvars, verbose)
+  for _, sfx in ipairs({{"","0"},{"0",""}}) do
+    for _, rpmvar in ipairs(rpmvars) do
+      local toalias = "%{?" .. rpmvar .. sfx[1] .. "}"
+      if (rpm.expand(toalias) ~= "") then
+        safeset(rpmvar .. sfx[2], toalias, verbose)
+      end
+    end
+  end
+end
+
+-- Takes a list of rpm variable roots and a suffix and alias current<root> to
+-- <root><suffix> if it resolves to something not empty
+local function setcurrent(rpmvars, suffix, verbose)
+  for _, rpmvar in ipairs(rpmvars) do
+    if (rpm.expand("%{?" .. rpmvar .. suffix .. "}") ~= "") then
+      explicitset(  "current" .. rpmvar, "%{" .. rpmvar .. suffix .. "}", verbose)
+    else
+      explicitunset("current" .. rpmvar,                                  verbose)
+    end
+  end
+end
+
+-- Echo the list of rpm variables, with suffix, if set
+local function echovars(rpmvars, suffix)
+  for _, rpmvar in ipairs(rpmvars) do
+    rpmvar = rpmvar .. suffix
+    local header = string.sub("  " .. rpmvar .. ":                                               ",1,21)
+    rpm.expand("%{?" .. rpmvar .. ":%{echo:" .. header .. "%{?" .. rpmvar .. "}}}")
+  end
+end
+
+-- Returns an array, indexed by suffix, containing the non-empy values of
+-- <rpmvar><suffix>, with suffix an integer string or the empty string
+local function getsuffixed(rpmvar)
+  local suffixes = {}
+  zalias({rpmvar})
+  for suffix=0,9999 do
+    local value = rpm.expand("%{?" .. rpmvar .. suffix .. "}")
+    if (value ~= "") then
+      suffixes[tostring(suffix)] = value
+    end
+  end
+  -- rpm convention is to alias no suffix to zero suffix
+  -- only add no suffix if zero suffix is different
+  local value = rpm.expand("%{?" .. rpmvar .. "}")
+  if (value ~= "") and (value ~= suffixes["0"]) then
+     suffixes[""] = value
+  end
+  return suffixes
+end
+
+-- Returns the list of suffixes, including the empty string, for which
+-- <rpmvar><suffix> is set to a non empty value
+local function getsuffixes(rpmvar)
+  suffixes = {}
+  for suffix in pairs(getsuffixed(rpmvar)) do
+    table.insert(suffixes,suffix)
+  end
+  table.sort(suffixes,
+             function(a,b) return (tonumber(a) or 0) < (tonumber(b) or 0) end)
+  return suffixes
+end
+
+-- Returns the suffix for which <rpmvar><suffix> has a non-empty value that
+-- matches best the beginning of the value string
+local function getbestsuffix(rpmvar, value)
+  local best         = nil
+  local currentmatch = ""
+  for suffix, setvalue in pairs(getsuffixed(rpmvar)) do
+  if (string.len(setvalue) > string.len(currentmatch)) and
+     (string.find(value, "^" .. setvalue)) then
+      currentmatch = setvalue
+      best         = suffix
+    end
+  end
+  return best
+end
+
+-- %writevars core
+local function writevars(macrofile, rpmvars)
+  for _, rpmvar in ipairs(rpmvars) do
+    print("sed -i 's\029" .. string.upper("@@" .. rpmvar .. "@@") ..
+                   "\029" .. rpm.expand(  "%{" .. rpmvar .. "}" ) ..
+                   "\029g' " .. macrofile .. "\n")
+  end
+end
+
+-- https://github.com/rpm-software-management/rpm/issues/566
+-- Reformat a text intended to be used used in a package description, removing
+-- rpm macro generation artefacts.
+-- – remove leading and ending empty lines
+-- – trim intermediary empty lines to a single line
+-- – fold on spaces
+-- Should really be a %%{wordwrap:…} verb
+local function wordwrap(text)
+  text = rpm.expand(text .. "\n")
+  text = string.gsub(text, "\t",              "  ")
+  text = string.gsub(text, "\r",              "\n")
+  text = string.gsub(text, " +\n",            "\n")
+  text = string.gsub(text, "\n+\n",           "\n\n")
+  text = string.gsub(text, "^\n",             "")
+  text = string.gsub(text, "\n( *)[-*—][  ]+", "\n%1– ")
+  output = ""
+  for line in string.gmatch(text, "[^\n]*\n") do
+    local pos = 0
+    local advance = ""
+    for word in string.gmatch(line, "%s*[^%s]*\n?") do
+      local wl, bad = utf8.len(word)
+      if not wl then
+        print("%{warn:Invalid UTF-8 sequence detected in:}" ..
+              "%{warn:" .. word .. "}" ..
+              "%{warn:It may produce unexpected results.}")
+        wl = bad
+      end
+      if (pos == 0) then
+        advance, n = string.gsub(word, "^(%s*– ).*", "%1")
+        if (n == 0) then
+          advance = string.gsub(word, "^(%s*).*", "%1")
+        end
+        advance = string.gsub(advance, "– ", "  ")
+        pos = pos + wl
+      elseif  (pos + wl  < 81) or
+             ((pos + wl == 81) and string.match(word, "\n$")) then
+        pos = pos + wl
+      else
+        word = advance .. string.gsub(word, "^%s*", "")
+        output = output .. "\n"
+        pos = utf8.len(word)
+      end
+      output = output .. word
+      if pos > 80 then
+        pos = 0
+        if not string.match(word, "\n$") then
+          output = output .. "\n"
+        end
+      end
+    end
+  end
+  output = string.gsub(output, "\n*$", "\n")
+  return output
+end
+
+-- Because rpmbuild will fail if a subpackage is declared before the source
+-- package itself, provide a source package declaration shell as fallback.
+local function srcpkg(verbose)
+  if verbose then
+    rpm.expand([[
+%{echo:Creating a header for the SRPM from %%{source_name}, %%{source_summary} and}
+%{echo:%%{source_description}. If that is not the intended result, please declare the}
+%{echo:SRPM header and set %%{source_name} in your spec file before calling a macro}
+%{echo:that creates other package headers.}
+]])
+  end
+  print(rpm.expand([[
+Name:           %{source_name}
+Summary:        %{source_summary}
+%description
+%wordwrap -v source_description
+]]))
+  explicitset("currentname", "%{source_name}", verbose)
+end
+
+-- %new_package core
+local function new_package(source_name, pkg_name, name_suffix, first, verbose)
+  -- Safety net when the wrapper is used in conjunction with traditional syntax
+  if (not first) and (not source_name) then
+    rpm.expand([[
+%{warn:Something already set a package name. However, %%{source_name} is not set.}
+%{warn:Please set %%{source_name} to the SRPM name to ensure reliable processing.}
+]])
+    if name_suffix then
+      print(rpm.expand("%package        " .. name_suffix))
+    else
+      print(rpm.expand("%package     -n " .. pkg_name))
+    end
+    return
+  end
+  -- New processing
+  if not (pkg_name or name_suffix or source_name) then
+    rpm.expand([[
+%{error:You need to set %%{source_name} or provide explicit package naming!}
+]])
+  end
+  if name_suffix then
+    print(rpm.expand("%package        "  .. name_suffix))
+    explicitset("currentname", "%{source_name}-" .. name_suffix, verbose)
+  else
+    if not source_name then
+      source_name = pkg_name
+    end
+    if (pkg_name == source_name) then
+      safeset("source_name", source_name, verbose)
+      print(rpm.expand("Name:           %{source_name}"))
+    else
+      if source_name and first then
+        srcpkg(verbose)
+      end
+      print(rpm.expand("%package     -n " .. pkg_name))
+    end
+    explicitset("currentname", pkg_name, verbose)
+  end
+end
+
+return {
+  read          = read,
+  hasflag       = hasflag,
+  readflag      = readflag,
+  explicitset   = explicitset,
+  explicitunset = explicitunset,
+  safeset       = safeset,
+  zalias        = zalias,
+  setcurrent    = setcurrent,
+  echovars      = echovars,
+  getsuffixed   = getsuffixed,
+  getsuffixes   = getsuffixes,
+  getbestsuffix = getbestsuffix,
+  writevars     = writevars,
+  wordwrap      = wordwrap,
+  new_package   = new_package,
+}
--- a/SOURCES/dist.sh
+++ b/SOURCES/dist.sh
@ -25,7 +25,7 @@ function check_rhl {
 }

 function check_rhel {
-    egrep -q "(Enterprise|Advanced)" $RELEASEFILE && echo $DISTNUM
+    egrep -q "(Enterprise|Advanced|CentOS|AlmaLinux)" $RELEASEFILE && echo $DISTNUM
 }

 function check_fedora {
--- a/SOURCES/find-provides.ksyms
+++ b/SOURCES/find-provides.ksyms
@ -1,48 +0,0 @@
-#! /bin/bash
-
-IFS=$'\n'
-
-for module in $(grep -E '/lib/modules/.+\.ko(\.gz|\.bz2|\.xz)?$'); do
-    tmpfile=""
-    if [ "x${module%.ko}" = "x${module}" ]; then
-        tmpfile=$(mktemp -t ${0##*/}.XXXXXX.ko)
-        proc_bin=
-        case "${module##*.}" in
-        xz)
-                proc_bin=xz
-                ;;
-        bz2)
-                proc_bin=bzip2
-                ;;
-        gz)
-                proc_bin=gzip
-                ;;
-        esac
-
-        [ -n "$proc_bin" ] || continue
-
-        "$proc_bin" -d -c - < "$module" > "$tmpfile" || continue
-        module="$tmpfile"
-    fi
-
-    if [[ -n $(nm $module | sed -r -ne 's:^0*([0-9a-f]+) A __crc_(.+):0x\1 \2:p') ]]; then
-        nm $module \
-        | sed -r -ne 's:^0*([0-9a-f]+) A __crc_(.+):0x\1 \2:p' \
-        | awk --non-decimal-data '{printf("ksym(%s) = 0x%08x\n", $2, $1)}' \
-        | LC_ALL=C sort -u
-    else
-        ELFRODATA=$(readelf -R .rodata $module | awk '/0x/{printf $2$3$4$5}')
-        if [[ -n $(readelf -h $module | grep "little endian") ]]; then
-            RODATA=$(echo $ELFRODATA | sed 's/\(..\)\(..\)\(..\)\(..\)/\4\3\2\1/g')
-        else
-            RODATA=$ELFRODATA
-        fi
-        for sym in $(nm $module | sed -r -ne 's:^0*([0-9a-f]+) R __crc_(.+):0x\1 \2:p'); do
-            echo $sym $RODATA
-        done \
-        | awk --non-decimal-data '{printf("ksym(%s) = 0x%08s\n", $2, substr($3,($1*2)+1,8))}' \
-        | LC_ALL=C sort -u
-    fi
-
-    [ -z "$tmpfile" ] || rm -f -- "$tmpfile"
-done
--- a/SOURCES/find-requires
+++ b/SOURCES/find-requires
@ -32,7 +32,8 @@ for f in $filelist; do
    fi
 done

-[ -x /usr/lib/rpm/redhat/find-requires.ksyms ] && [ "$is_kmod" ] &&
-    printf "%s\n" "${filelist[@]}" | /usr/lib/rpm/redhat/find-requires.ksyms
+# Disabling for now while the Fedora kernel doesn't produce kABI deps.
+#[ -x /usr/lib/rpm/redhat/find-requires.ksyms ] && [ "$is_kmod" ] &&
+#    printf "%s\n" "${filelist[@]}" | /usr/lib/rpm/redhat/find-requires.ksyms

 exit 0
--- a/SOURCES/find-requires.ksyms
+++ b/SOURCES/find-requires.ksyms
@ -1,155 +0,0 @@
-#! /bin/bash
-#
-# This script is called during external module building to create dependencies
-# both upon the RHEL kernel, and on additional external modules. Symbols that
-# cannot be reconciled against those provided by the kernel are assumed to be
-# provided by an external module and "ksym" replaces th regular "kernel" dep.
-
-IFS=$'\n'
-
-# Extract all of the symbols provided by this module.
-all_provides() {
-    for module in "$@"; do
-        tmpfile=""
-        if [ "x${module%.ko}" = "x${module}" ]; then
-            tmpfile=$(mktemp -t ${0##*/}.XXXXXX.ko)
-            proc_bin=
-            case "${module##*.}" in
-            xz)
-                    proc_bin=xz
-                    ;;
-            bz2)
-                    proc_bin=bzip2
-                    ;;
-            gz)
-                    proc_bin=gzip
-                    ;;
-            esac
-
-            [ -n "$proc_bin" ] || continue
-
-            "$proc_bin" -d -c - < "$module" > "$tmpfile" || continue
-            module="$tmpfile"
-        fi
-
-        if [[ -n $(nm "$module" | sed -r -ne 's:^0*([0-9a-f]+) A __crc_(.+):0x\1 \2:p') ]]; then
-            nm "$module" \
-            | sed -r -ne 's:^0*([0-9a-f]+) A __crc_(.+):0x\1 \2:p' \
-            | awk --non-decimal-data '{printf("%s:0x%08x\n", $2, $1)}'
-        else
-            ELFRODATA=$(readelf -R .rodata "$module" | awk '/0x/{printf $2$3$4$5}')
-            if [[ -n $(readelf -h "$module" | grep "little endian") ]]; then
-                RODATA=$(echo $ELFRODATA | sed 's/\(..\)\(..\)\(..\)\(..\)/\4\3\2\1/g')
-            else
-                RODATA=$ELFRODATA
-            fi
-            for sym in $(nm "$module" | sed -r -ne 's:^0*([0-9a-f]+) R __crc_(.+):0x\1 \2:p'); do
-                echo $sym $RODATA
-            done \
-            | awk --non-decimal-data '{printf("%s:0x%08s\n", $2, substr($3,($1*2)+1,8))}'
-        fi
-
-        [ -z "$tmpfile" ] || rm -f -- "$tmpfile"
-    done \
-    | LC_ALL=C sort -k1,1 -u
-}
-
-# Extract all of the requirements of this module.
-all_requires() {
-    for module in "$@"; do
-        set -- $(/sbin/modinfo -F vermagic "$module" | sed -e 's: .*::' -e q)
-        /sbin/modprobe --dump-modversions "$module" \
-        | awk --non-decimal-data '
-            BEGIN { FS = "\t" ; OFS = "\t" }
-            {printf("%s:0x%08x\n", $2, $1)}' \
-        | sed -r -e 's:$:\t'"$1"':'
-    done \
-    | LC_ALL=C sort -k1,1 -u
-}
-
-# Filter out requirements fulfilled by the module itself.
-mod_requires() {
-    LC_ALL=C join -t $'\t' -j 1 -v 1 \
-        <(all_requires "$@") \
-        <(all_provides "$@") \
-    | LC_ALL=C sort -k1,1 -u
-}
-
-if ! [ -e /sbin/modinfo -a -e /sbin/modprobe ]; then
-    cat > /dev/null
-    exit 0
-fi
-
-check_kabi() {
-    arch=$(uname -m)
-    kabi_file="/lib/modules/kabi-current/kabi_whitelist_$arch"
-
-    # If not installed, output a warning and return (continue)
-    if [ ! -f "$kabi_file" ]; then
-        echo "" >&2
-        echo "********************************************************************************" >&2
-        echo "*********************** KERNEL ABI COMPATIBILITY WARNING ***********************" >&2
-        echo "********************************************************************************" >&2
-        echo "The kernel ABI reference files (provided by "kabi-whitelists") were not found." >&2
-        echo "No compatibility check was performed. Please install the kABI reference files" >&2
-        echo "and rebuild if you would like to verify compatibility with kernel ABI." >&2
-        echo "" >&2
-        return
-    fi
-
-    unset non_kabi
-    for symbol in "$@"; do
-        if ! egrep "^[[:space:]]$symbol\$" $kabi_file >/dev/null; then
-            non_kabi=("${non_kabi[@]}" "$symbol")
-        fi
-    done
-
-    if [ ${#non_kabi[@]} -gt 0 ]; then
-        echo "" >&2
-        echo "********************************************************************************" >&2
-        echo "*********************** KERNEL ABI COMPATIBILITY WARNING ***********************" >&2
-        echo "********************************************************************************" >&2
-        echo "The following kernel symbols are not guaranteed to remain compatible with" >&2
-        echo "future kernel updates to this RHEL release:" >&2
-        echo "" >&2
-        for symbol in "${non_kabi[@]}"; do
-            printf "\t$symbol\n" >&2
-        done
-        echo "" >&2
-        echo "Red Hat recommends that you consider using only official kernel ABI symbols" >&2
-        echo "where possible. Requests for additions to the kernel ABI can be filed with" >&2
-        echo "your partner or customer representative (component: driver-update-program)." >&2
-        echo "" >&2
-    fi
-}
-
-modules=($(grep -E '/lib/modules/.+\.ko(\.gz|\.bz2|\.xz)?$'))
-if [ ${#modules[@]} -gt 0 ]; then
-    kernel=$(/sbin/modinfo -F vermagic "${modules[0]}" | sed -e 's: .*::' -e q)
-
-    # get all that kernel provides
-    symvers=$(mktemp -t ${0##*/}.XXXXX)
-
-    cat /usr/src/kernels/$kernel/Module.symvers | awk '
-        BEGIN { FS = "\t" ; OFS = "\t" }
-        { print $2 ":" $1 }
-    ' \
-    | sed -r -e 's:$:\t'"$kernel"':' \
-    | LC_ALL=C sort -k1,1 -u > $symvers
-
-    # Symbols matching with the kernel get a "kernel" dependency
-    mod_req=$(mktemp -t mod_req.XXXXX)
-    mod_requires "${modules[@]}" > "$mod_req"
-    LC_ALL=C join -t $'\t' -j 1 $symvers "$mod_req" | LC_ALL=C sort -u \
-    | awk 'BEGIN { FS = "[\t:]" ; OFS = "\t" } { print "kernel(" $1 ") = " $2 }'
-
-    # Symbols from elsewhere get a "ksym" dependency
-    LC_ALL=C join -t $'\t' -j 1 -v 2 $symvers "$mod_req" | LC_ALL=C sort -u \
-    | awk 'BEGIN { FS = "[\t:]" ; OFS = "\t" } { print "ksym(" $1 ") = " $2 }'
-
-    # Check kABI if the kabi-whitelists package is installed
-    # Do this last so we can try to output this error at the end
-    kabi_check_symbols=($(LC_ALL=C join -t $'\t' -j 1 $symvers "$mod_req" | LC_ALL=C sort -u \
-    | awk 'BEGIN { FS = "[\t:]" ; OFS = "\t" } { print $1 }'))
-    check_kabi "${kabi_check_symbols[@]}"
-fi
--- a/SOURCES/firmware.prov
+++ b/SOURCES/firmware.prov
@ -1,14 +0,0 @@
-#!/bin/sh
-#
-# firmware.prov - Automatically extract any and all firmware dependencies from
-#                 kernel object (.ko) files and add to RPM deps.
-
-IFS=$'\n'
-
-for module in $(grep -E '/lib/modules/.+\.ko(\.gz|\.bz2|\.xz)?$') $*;
-do
-    for firmware in `/sbin/modinfo -F firmware $module`;
-    do
-        echo "firmware($firmware)"
-    done
-done
--- a/SOURCES/forge.lua
+++ b/SOURCES/forge.lua
@ -0,0 +1,312 @@
+-- Lua code used by macros.forge and derivatives
+
+-- Computes the suffix of a version string, removing vprefix if it matches
+-- For example with vprefix 1.2.3: 1.2.3.rc2 → .rc2 but 1.2.30 → 1.2.30 not 0
+local function getversionsuffix(vstring,vprefix)
+  if (string.sub(vstring, 1, #vprefix) == vprefix) and
+     (not string.match(string.sub(vstring, #vprefix + 1), "^%.?%d")) then
+    return string.sub(vstring, #vprefix + 1)
+  else
+    return vstring
+  end
+end
+
+-- Check if an identified url is sane
+local function checkforgeurl(url, id, silent)
+  local checkedurl  = nil
+  local checkedid   = nil
+  local urlpatterns = {
+    gitlab = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://(…[-.])gitlab[-.]…/owner/repo'},
+    pagure = {
+      pattern     = 'https://[^/]+/[^/#?]+',
+      description = 'https://pagure.io/repo'},
+    pagure_ns = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://pagure.io/namespace/repo'},
+    pagure_fork = {
+      pattern     = 'https://[^/]+/fork/[^/]+/[^/#?]+',
+      description = 'https://pagure.io/fork/owner/repo'},
+    pagure_ns_fork = {
+      pattern     = 'https://[^/]+/fork/[^/]+/[^/]+/[^/#?]+',
+      description = 'https://pagure.io/fork/owner/namespace/repo'},
+    ["gitea.com"] = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://gitea.com/owner/repo'},
+    github = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://(…[-.])github[-.]…/owner/repo'},
+    ["code.googlesource.com"] = {
+      pattern     = 'https://code.googlesource.com/[^#?]*[^/#?]+',
+      description = 'https://code.googlesource.com/…/repo'},
+    ["bitbucket.org"] = {
+      pattern     = 'https://[^/]+/[^/]+/[^/#?]+',
+      description = 'https://bitbucket.org/owner/repo'}}
+  if (urlpatterns[id] ~= nil) then
+    checkedurl = string.match(url,urlpatterns[id]["pattern"])
+    if (checkedurl == nil) then
+      if not silent then
+        rpm.expand("%{error:" .. id .. " URLs must match " .. urlpatterns[id]["description"] .. " !}")
+      end
+    else
+      checkedid = id
+    end
+  end
+  return checkedurl, checkedid
+end
+
+-- Check if an url matches a known forge
+local function idforge(url, silent)
+  local forgeurl = nil
+  local forge    = nil
+  if (url ~= "") then
+    forge = string.match(url, "^[^:]+://([^/]+)/")
+    if (forge == nil) then
+      if not silent then
+        rpm.expand("%{error:URLs must include a protocol such as https:// and a path starting with / !}")
+      end
+    else
+      if (forge == "pagure.io") then
+        if     string.match(url, "[^:]+://pagure.io/fork/[^/]+/[^/]+/[^/]+") then
+          forge = "pagure_ns_fork"
+        elseif string.match(url, "[^:]+://pagure.io/fork/[^/]+/[^/]+") then
+          forge = "pagure_fork"
+        elseif  string.match(url, "[^:]+://pagure.io/[^/]+/[^/]+") then
+          forge = "pagure_ns"
+        elseif  string.match(url, "[^:]+://pagure.io/[^/]+") then
+          forge = "pagure"
+        end
+      elseif (string.match(forge, "^gitlab[%.-]") or string.match(forge, "[%.-]gitlab[%.]")) then
+        forge = "gitlab"
+      elseif (string.match(forge, "^github[%.-]") or string.match(forge, "[%.-]github[%.]")) then
+        forge = "github"
+      end
+      forgeurl, forge = checkforgeurl(url, forge, silent)
+    end
+  end
+  return forgeurl, forge
+end
+
+-- The forgemeta macro main processing function
+-- See the documentation in the macros.forge file for argument description
+-- Also called directly by gometa
+local function meta(suffix, verbose, informative, silent)
+  local fedora = require "fedora.common"
+  local ismain = (suffix == "") or (suffix == "0")
+  if ismain then
+    fedora.zalias({"forgeurl", "forgesource", "forgesetupargs",
+                      "archivename", "archiveext", "archiveurl",
+                      "topdir", "extractdir", "repo", "owner", "namespace",
+                      "scm", "tag", "commit", "shortcommit", "branch", "version",
+                      "date", "distprefix"}, verbose)
+  end
+  local variables = {
+    default = {
+      scm         = "git",
+      archiveext  = "tar.bz2",
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/[^/]+/([^/?#]+)"))}',
+      archivename = "%{repo"         .. suffix .. "}-%{ref"           .. suffix .. "}",
+      topdir      = "%{archivename"  .. suffix .. "}" },
+    gitlab = {
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/-/archive/%{ref" .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    pagure = {
+      archiveext  = "tar.gz",
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/([^/?#]+)"))}',
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    pagure_ns = {
+      archiveext  = "tar.gz",
+      namespace   = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/([^/]+)/[^/?#]+"))}',
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/[^/]+/([^/?#]+)"))}',
+      archivename = "%{namespace"    .. suffix .. "}-%{repo"          .. suffix .. "}-%{ref"         .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    pagure_fork = {
+      archiveext  = "tar.gz",
+      owner       = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/([^/]+)/[^/?#]+"))}',
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/[^/]+/([^/?#]+)"))}',
+      archivename = "%{owner"        .. suffix .. "}-%{repo"          .. suffix .. "}-%{ref"         .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    pagure_ns_fork = {
+      owner       = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/([^/]+)/[^/]+/[^/?#]+"))}',
+      namespace   = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/[^/]+/([^/]+)/[^/?#]+")}',
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "https://[^/]+/fork/[^/]+/[^/]+/([^/?#]+)")}',
+      archivename = "%{owner"        .. suffix .. "}-%{namespace"     .. suffix .. "}-%{repo"        .. suffix .. "}-%{ref"        .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    ["gitea.com"] = {
+      archiveext  = "tar.gz",
+      archivename = "%{fileref"      .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}.%{archiveext" .. suffix .. "}",
+      topdir      = "%{repo}" },
+    github = {
+      archiveext  = "tar.gz",
+      archivename = "%{repo"         .. suffix .. "}-%{fileref"       .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/archive/%{ref"   .. suffix .. "}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}" },
+    ["code.googlesource.com"] = {
+      archiveext  = "tar.gz",
+      repo        = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://.+/([^/?#]+)"))}',
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/+archive/%{ref"  .. suffix .. "}.%{archiveext"  .. suffix .. "}",
+      topdir      = "" },
+    ["bitbucket.org"] = {
+      shortcommit = '%{lua:print(string.sub(rpm.expand("%{commit'     .. suffix .. '}"), 1, 12))}',
+      owner       = '%{lua:print(string.match(rpm.expand("%{forgeurl' .. suffix .. '}"), "^[^:]+://[^/]+/([^/?#]+)"))}',
+      archivename = "%{owner"        .. suffix .. "}-%{repo"          .. suffix .. "}-%{shortcommit" .. suffix .. "}",
+      archiveurl  = "%{forgeurl"     .. suffix .. "}/get/%{ref"       .. suffix .. "}.%{archiveext"  .. suffix .. "}" } }
+  -- Packaging a moving branch is quite a bad idea, but since at least Gitlab
+  -- will treat branches and tags the same way better support branches explicitly
+  -- than have packagers hijack %{tag} to download branch states
+  local spec = {}
+  for _, v in ipairs({'forgeurl','tag','commit','branch','version'}) do
+    spec[v] = rpm.expand("%{?" .. v .. suffix .. "}")
+  end
+  -- Compute the reference of the object to fetch
+  local isrelease = false
+  if     (spec["tag"]     ~= "") then       ref = "%{?tag"     .. suffix .. "}"
+  elseif (spec["commit"]  ~= "") then       ref = "%{?commit"  .. suffix .. "}"
+  elseif (spec["branch"]  ~= "") then       ref = "%{?branch"  .. suffix .. "}"
+  else                                      ref = "%{?version" .. suffix .. "}"
+                                      isrelease = true
+  end
+  if (rpm.expand(ref) == "") then
+    if (suffix == "") then
+      rpm.expand("%{error:You need to define Version:, %{commit} or %{tag} before the macro invocation !}")
+    else
+      rpm.expand("%{error:You need to define %{version" .. suffix .. "}, %{commit" .. suffix .. "} or %{tag" .. suffix .. "} before the macro invocation !}")
+    end
+  end
+  local    forgeurl = spec["forgeurl"]
+  -- For backwards compatibility only
+  local expliciturl = rpm.expand("%{?-u*}")
+  if   (expliciturl ~= "") then
+    rpm.expand("%{warn:-u use in %%forgemeta is deprecated, use -z instead to select a separate set of rpm variables!}")
+           forgeurl = expliciturl
+  end
+  local forge
+  forgeurl,   forge = idforge(forgeurl, silent)
+  if (forge ~= nil) then
+    fedora.explicitset("forgeurl" .. suffix, forgeurl, verbose)
+    -- Custom processing of quirky forges that can not be handled with simple variables
+    if (forge == "github") then
+      -- Workaround the way GitHub injects "v"s before some version strings (but not all!)
+      -- To package one of the minority of sane GitHub projects that do not munge their version
+      -- strings set tag to %{version} in your spec
+      local fileref = ref
+      if (ref == "%{?version"  .. suffix .. "}") then
+        ref = "v" .. ref
+      elseif (fileref ~= "%{?commit" .. suffix .. "}") and
+             string.match(rpm.expand(fileref), "^v[%d]") then
+        fileref = string.gsub(rpm.expand(fileref), "^v", "")
+      elseif (string.match(rpm.expand(fileref), "/")) then
+        fileref = string.gsub(rpm.expand(fileref), "/", "-")
+      end
+      fedora.safeset("fileref" .. suffix, fileref, verbose)
+    elseif (forge == "gitea.com") then
+      -- Workaround the way gitea mangles /s in ref names
+      local fileref = ref
+      fileref = string.gsub(rpm.expand(fileref), "/", "-")
+      fedora.safeset("fileref" .. suffix, fileref, verbose)
+    elseif (forge == "code.googlesource.com") then
+      if (ref == "%{?version"  .. suffix .. "}") then
+        ref = "v" .. ref
+      end
+    elseif (forge == "bitbucket.org") then
+      if (spec["commit"] == "") then
+        rpm.expand("%{error:All BitBucket URLs require commit value knowledge: you need to define %{commit}!}")
+      end
+    end
+    fedora.safeset("ref" .. suffix, ref, verbose)
+    -- Mass setting of the remaining variables
+    for k,v in pairs(variables[forge]) do
+      fedora.safeset(k .. suffix, variables[forge][k], verbose)
+    end
+    for k,v in pairs(variables["default"]) do
+      if (variables[forge][k] == nil) then
+        fedora.safeset(k .. suffix, variables["default"][k], verbose)
+      end
+    end
+  end
+  -- Generic rules
+  for _, v in ipairs({'archiveurl','archivename','archiveext','topdir'}) do
+    spec[v] = rpm.expand("%{?" .. v .. suffix .. "}")
+  end
+  -- Source URL processing (computing the forgesource spec variable)
+  local forgesource = "%{archiveurl" .. suffix .. "}"
+  if (string.match(spec["archiveurl"], "/([^/]+)$") ~= spec["archivename"] .. "." .. spec["archiveext"]) then
+    forgesource     = "%{?archiveurl" .. suffix .. "}#/%{?archivename" .. suffix .. "}.%{archiveext" .. suffix .. "}"
+  end
+  fedora.safeset("forgesource" .. suffix, forgesource, verbose)
+  -- Setup processing      (computing the forgesetup and extractdir variables)
+  local forgesetupargs = "-n %{extractdir" .. suffix .. "}"
+  local extractdir     = "%{topdir"        .. suffix .. "}"
+  if (spec["topdir"] == "") then
+    forgesetupargs     = "-c " .. forgesetupargs
+    extractdir         = "%{archivename"   .. suffix .. "}"
+  end
+  if not ismain then
+    if (spec["topdir"] ~= "") then
+      forgesetupargs = "-T -D -b " .. suffix .. " " .. forgesetupargs
+    else
+      forgesetupargs = "-T -D -a " .. suffix .. " " .. forgesetupargs
+    end
+  end
+  fedora.safeset("forgesetupargs" .. suffix, forgesetupargs, verbose)
+  fedora.safeset("extractdir"     .. suffix, extractdir, verbose)
+  -- dist processing       (computing the correct prefix for snapshots)
+  local distprefix = ""
+  if not isrelease then
+    distprefix = string.lower(rpm.expand(ref))
+    if     (ref == "%{?commit" .. suffix .. "}") then
+      distprefix = string.sub(distprefix, 1, 7)
+    elseif (ref ~= "%{?branch" .. suffix .. "}") then
+      distprefix = string.gsub(distprefix,      "[%p%s]+", ".")
+      distprefix = string.gsub(distprefix, "^" .. string.lower(rpm.expand("%{?repo}")) .. "%.?", "")
+      local    v = string.gsub(rpm.expand("%{version}"), "[%p%s]+", ".")
+      for _, p in ipairs({'','v','v.','version','version.','tags.v', 'tags.v.'}) do
+        distprefix = getversionsuffix(distprefix, p .. v)
+      end
+      distprefix = string.gsub(distprefix, "^%.", "")
+    end
+    if (distprefix ~= "") then
+      distprefix = "%{scm"     .. suffix .. "}" .. distprefix
+      date = rpm.expand("%{?date" .. suffix .. "}")
+      if (date ~= "") then
+        distprefix = date .. distprefix
+      else
+        distprefix = "%([ -r %{_sourcedir}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "} ] && date +%Y%m%d -u -r %{_sourcedir}/%{archivename" .. suffix .. "}.%{archiveext" .. suffix .. "})" .. distprefix
+      end
+      distprefix = "." .. distprefix
+    end
+  end
+  if (spec["version"] ~= "") and
+     (spec["version"] ~= "0") and
+     (spec["version"] ~= rpm.expand("%{?version}")) then
+    distprefix = ".%{version" .. suffix .. "}" .. distprefix
+  end
+  if (rpm.expand(distprefix) ~= "") then
+    if not ismain then
+      distprefix = string.gsub(distprefix, "^%.", ".s")
+    end
+    fedora.safeset ("distprefix"    .. suffix, distprefix, verbose)
+  end
+  if ismain then
+    fedora.zalias({"forgeurl", "forgesource", "forgesetupargs",
+                      "archivename", "archiveext", "archiveurl",
+                      "topdir", "extractdir", "repo", "owner", "namespace",
+                      "scm", "shortcommit", "distprefix"}, verbose)
+  end
+  -- Final spec variable summary if the macro was called with -i
+  if informative then
+    rpm.expand("%{echo:Packaging variables read or set by %%forgemeta}")
+    fedora.echovars({"forgeurl", "forgesource", "forgesetupargs",
+                        "archivename", "archiveext", "archiveurl",
+                        "topdir", "extractdir", "repo", "owner", "namespace",
+                        "scm", "tag", "commit", "shortcommit", "branch", "version",
+                        "date", "distprefix"}, suffix)
+    fedora.echovars({"dist"},"")
+    rpm.expand("%{echo:  (snapshot date is either manually supplied or computed once %%{_sourcedir}/%%{archivename" .. suffix .. "}.%%{archiveext" .. suffix .. "} is available)}")
+  end
+end
+
+return {
+  meta = meta,
+}
+
--- a/SOURCES/kabi.attr
+++ b/SOURCES/kabi.attr
@ -1,2 +0,0 @@
-%__kabi_provides	%{_rpmconfigdir}/kabi.sh
-%__kabi_path            ^(/boot/symvers-.*|/lib/modules/[1-9].*/symvers)\.gz$
--- a/SOURCES/kabi.sh
+++ b/SOURCES/kabi.sh
@ -1,13 +0,0 @@
-#!/bin/bash +x
-#
-# kabi.sh - Automatically extract any kernel symbol checksum from the
-#           symvers file and add to RPM deps.  This is used to move the
-#           checksum checking from modprobe to rpm install for 3rd party
-#           modules (so they can fail during install and not at load).
-
-IFS=$'\n'
-
-for symvers in $(grep -E '(/boot/symvers-.*|/lib/modules/[1-9].*/symvers)\.gz') "$@";
-do
-    zcat $symvers | awk ' {print "kernel(" $2 ") = " $1 }'
-done
--- a/SOURCES/kmod.attr
+++ b/SOURCES/kmod.attr
@ -1,2 +0,0 @@
-%__kmod_provides       %{_rpmconfigdir}/kmod.prov
-%__kmod_path           ^/lib/modules/.*$
--- a/SOURCES/kmod.prov
+++ b/SOURCES/kmod.prov
@ -1,28 +0,0 @@
-#!/bin/sh +x
-# Kernel build can have many thousands of modules.
-# kmod.prov is run for every one of them.
-# Try to make this script run as fast as we can.
-# For example, use shell string ops instead of external programs
-# where possible.
-
-IFS=$'\n'
-
-read -r fname || exit
-
-# Only process files from .../lib/modules/... subtree
-[ "${fname#*/lib/modules/*}" != "$fname" ] || exit 0
-
-kmod=${fname##*/}  # like basename, but faster
-
-if [ "$kmod" = "modules.builtin" ]; then
-        for j in $(cat -- "$fname"); do
-                echo "kmod(${j##*/})"
-        done
-        exit 0
-fi
-
-kmod=${kmod%.gz}
-kmod=${kmod%.xz}
-if [ "${kmod%.ko}" != "$kmod" ]; then
-        echo "kmod($kmod)"
-fi
--- a/SOURCES/kmodtool
+++ b/SOURCES/kmodtool
@ -1,349 +0,0 @@
-#!/bin/bash
-
-# kmodtool - Helper script for building kernel module RPMs
-#            An original version appeared in Fedora. This version is
-#            generally called only by the %kernel_module_package RPM macro
-#            during the process of building Driver Update Packages (which
-#            are also known as "kmods" in the Fedora community).
-#
-# Copyright (c) 2003-2010 Ville Skyttä <ville.skytta@iki.fi>,
-#                         Thorsten Leemhuis <fedora@leemhuis.info>
-#                         Jon Masters <jcm@redhat.com>
-#
-# Permission is hereby granted, free of charge, to any person obtaining
-# a copy of this software and associated documentation files (the
-# "Software"), to deal in the Software without restriction, including
-# without limitation the rights to use, copy, modify, merge, publish,
-# distribute, sublicense, and/or sell copies of the Software, and to
-# permit persons to whom the Software is furnished to do so, subject to
-# the following conditions:
-#
-# The above copyright notice and this permission notice shall be
-# included in all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-# Changelog:
-#
-#            2010/07/28 - Add fixes for filelists in line with LF standard
-#			- Remove now defunct "framepointer" kernel variant
-#			- Change version to "rhel6-rh2" as a consequence.
-#
-#            2010/01/10 - Simplified for RHEL6. We are working on upstream
-#                         moving to a newer format and in any case do not
-#                         need to retain support for really old systems.
-
-shopt -s extglob
-
-myprog="kmodtool"
-myver="0.10.10_rhel8"
-knownvariants=@(debug|kdump|zfcpdump)
-kmod_name=
-kver=
-verrel=
-variant=
-
-get_verrel ()
-{
-  verrel=${1:-$(uname -r)}
-  verrel=${verrel/%[.+]$knownvariants/}
-}
-
-print_verrel ()
-{
-  get_verrel "$@"
-  echo "${verrel}"
-}
-
-get_variant ()
-{
-  get_verrel "$@"
-  variant=${1:-$(uname -r)}
-  variant=${variant/#$verrel?(.+)/}
-  variant=${variant:-'""'}
-}
-
-print_variant ()
-{
-  get_variant $@
-  echo "${variant}"
-}
-
-# Detect flavor separator character. We have to do that due to
-# a systemd-tailored patch for kernel spec[1][2] introduced in Fedora and then
-# imported in RHEL 8 that broke all OOT kmod infrastructure for the flavored
-# kernels.
-#
-# [1] https://lists.fedoraproject.org/pipermail/kernel/2013-June/004262.html
-# [2] https://src.fedoraproject.org/rpms/kernel/c/faf25207dc86666a611c45ae3ffaf385c170bd2a
-#
-# $1 - kver
-# $2 - variant
-get_variant_char ()
-{
-  variant="$2"
-  [ "$variant" != "default" ] || variant=""
-
-  get_verrel "$1"
-
-  variant_char=""
-  [ -n "$variant" ] || return 0
-
-  # We expect that the flavored kernel is already installed in the buildroot
-  variant_char="+"
-  [ -e "/usr/src/kernels/${verrel}+${variant}" ] && return 0
-
-  variant_char="."
-}
-
-print_variant_char ()
-{
-  get_variant_char "$@"
-  echo "${variant_char}"
-}
-
-print_kernel_source ()
-{
-  get_variant_char "$@"
-  echo "/usr/src/kernels/${verrel}${variant_char}${variant}"
-}
-
-get_filelist() {
-	local IFS=$'\n'
-	filelist=($(cat))
-
-	if [ ${#filelist[@]} -gt 0 ];
-	then
-		for ((n = 0; n < ${#filelist[@]}; n++));
-		do
-			line="${filelist[n]}"
-			line=$(echo "$line" \
-				| sed -e "s/%verrel/$verrel/g" \
-				| sed -e "s/%variant/$variant/g" \
-				| sed -e "s/%dashvariant/$dashvariant/g" \
-				| sed -e "s/%dotvariant/$dotvariant/g" \
-				| sed -e "s/\+%1/$dotvariant/g" \
-				| sed -e "s/\.%1/$dotvariant/g" \
-				| sed -e "s/\-%1/$dotvariant/g" \
-				| sed -e "s/%2/$verrel/g")
-			echo "$line"
-		done
-	else
-		echo "%defattr(644,root,root,755)"
-		echo "/lib/modules/${verrel}${dotvariant}"
-	fi
-}
-
-
-get_rpmtemplate ()
-{
-    local variant="${1}"
-
-    get_variant_char "${verrel}" "${variant}"
-
-    local dashvariant="${variant:+-${variant}}"
-    local dotvariant="${variant:+${variant_char}${variant}}"
-
-    echo "%package       -n kmod-${kmod_name}${dashvariant}"
-
-    if [ -z "$kmod_provides_summary" ]; then
-        echo "Summary:          ${kmod_name} kernel module(s)"
-    fi
-
-    if [ -z "$kmod_provides_group" ]; then
-        echo "Group:            System Environment/Kernel"
-    fi
-
-    if [ ! -z "$kmod_version" ]; then
-        echo "Version: %{kmod_version}"
-    fi
-
-    if [ ! -z "$kmod_release" ]; then
-        echo "Release: %{kmod_release}"
-    fi
-
-    # Turn of the internal dep generator so we will use the kmod scripts.
-    echo "%global _use_internal_dependency_generator 0"
-
-    cat <<EOF
-Provides:         kernel-modules >= ${verrel}${dotvariant}
-Provides:         kernel${dashvariant}-modules >= ${verrel}
-Provides:         ${kmod_name}-kmod = %{?epoch:%{epoch}:}%{version}-%{release}
-Requires(post):   /usr/sbin/depmod
-Requires(postun): /usr/sbin/depmod
-Requires(post):   /usr/sbin/weak-modules
-Requires(postun): /usr/sbin/weak-modules
-EOF
-
-    if [ "yes" != "$nobuildreqs" ]
-    then
-        cat <<EOF
-BuildRequires:    kernel${dashvariant}-devel
-BuildRequires:    kernel-abi-whitelists
-BuildRequires:    redhat-rpm-config kernel-rpm-macros
-BuildRequires:    elfutils-libelf-devel kmod
-EOF
-    fi
-
-    if [ "" != "$override_preamble" ]
-    then
-        cat "$override_preamble"
-    fi
-
-cat <<EOF
-%description   -n kmod-${kmod_name}${dashvariant}
-This package provides the ${kmod_name} kernel modules built for
-the Linux kernel ${verrel}${dotvariant} for the %{_target_cpu}
-family of processors.
-EOF
-
-##############################################################################
-## The following are not part of this script directly, they are scripts     ##
-## that will be executed by RPM during various stages of package processing ##
-##############################################################################
-
-cat <<EOF
-%post          -n kmod-${kmod_name}${dashvariant}
-if [ -e "/boot/System.map-${verrel}${dotvariant}" ]; then
-    /usr/sbin/depmod -aeF "/boot/System.map-${verrel}${dotvariant}" "${verrel}${dotvariant}" > /dev/null || :
-fi
-
-modules=( \$(find /lib/modules/${verrel}${dotvariant}/extra/${kmod_name} | grep '\.ko$') )
-if [ -x "/usr/sbin/weak-modules" ]; then
-    printf '%s\n' "\${modules[@]}" \
-    | /usr/sbin/weak-modules --add-modules
-fi
-EOF
-
-cat <<EOF
-%preun         -n kmod-${kmod_name}${dashvariant}
-rpm -ql kmod-${kmod_name}${dashvariant}-%{kmod_version}-%{kmod_release}.$(arch) | grep '\.ko$' > /var/run/rpm-kmod-${kmod_name}${dashvariant}-modules
-EOF
-
-cat <<EOF
-%postun        -n kmod-${kmod_name}${dashvariant}
-if [ -e "/boot/System.map-${verrel}${dotvariant}" ]; then
-    /usr/sbin/depmod -aeF "/boot/System.map-${verrel}${dotvariant}" "${verrel}${dotvariant}" > /dev/null || :
-fi
-
-modules=( \$(cat /var/run/rpm-kmod-${kmod_name}${dashvariant}-modules) )
-rm /var/run/rpm-kmod-${kmod_name}${dashvariant}-modules
-if [ -x "/usr/sbin/weak-modules" ]; then
-    printf '%s\n' "\${modules[@]}" \
-    | /usr/sbin/weak-modules --remove-modules
-fi
-EOF
-
-echo "%files         -n kmod-${kmod_name}${dashvariant}"
-
-if [ "" == "$override_filelist" ];
-then
-    echo "%defattr(644,root,root,755)"
-    echo "/lib/modules/${verrel}${dotvariant}"
-else
-    cat "$override_filelist" | get_filelist
-fi
-}
-
-print_rpmtemplate ()
-{
-  kmod_name="${1}"
-  shift
-  kver="${1}"
-  get_verrel "${1}"
-  shift
-  if [ -z "${kmod_name}" ] ; then
-    echo "Please provide the kmodule-name as first parameter." >&2
-    exit 2
-  elif [ -z "${kver}" ] ; then
-    echo "Please provide the kver as second parameter." >&2
-    exit 2
-  elif [ -z "${verrel}" ] ; then
-    echo "Couldn't find out the verrel." >&2
-    exit 2
-  fi
-
-  for variant in "$@" ; do
-      if [ "default" == "$variant" ];
-      then
-            get_rpmtemplate ""
-      else
-            get_rpmtemplate "${variant}"
-      fi
-  done
-}
-
-usage ()
-{
-  cat <<EOF
-You called: ${invocation}
-
-Usage: ${myprog} <command> <option>+
- Commands:
-  verrel <uname>
-    - Get "base" version-release.
-  variant <uname>
-    - Get variant from uname.
-  variant_char <uname> <variant>
-    - Get kernel variant separator character.
-  kernel_source <uname> <variant>
-    - Get path to kernel source directory.
-  rpmtemplate <mainpgkname> <uname> <variants>
-    - Return a template for use in a source RPM
-  version
-    - Output version number and exit.
-EOF
-}
-
-invocation="$(basename ${0}) $@"
-while [ "${1}" ] ; do
-  case "${1}" in
-    verrel)
-      shift
-      print_verrel "$@"
-      exit $?
-      ;;
-    variant)
-      shift
-      print_variant "$@"
-      exit $?
-      ;;
-    variant_char)
-      shift
-      print_variant_char "$@"
-      exit $?
-      ;;
-    kernel_source)
-      shift
-      print_kernel_source "$@"
-      exit $?
-      ;;
-    rpmtemplate)
-      shift
-      print_rpmtemplate "$@"
-      exit $?
-      ;;
-    version)
-      echo "${myprog} ${myver}"
-      exit 0
-      ;;
-    *)
-      echo "Error: Unknown option '${1}'." >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-# Local variables:
-# mode: sh
-# sh-indentation: 2
-# indent-tabs-mode: nil
-# End:
-# ex: ts=2 sw=2 et
--- a/SOURCES/libsymlink.attr
+++ b/SOURCES/libsymlink.attr
@ -1,5 +1,5 @@
 # Make libfoo.so symlinks require the soname-provide of the target library
 %__libsymlink_requires		%{_rpmconfigdir}/elfdeps --provides --soname-only
-%__libsymlink_magic		^symbolic link to .*lib.*\.so\..*$
-%__libsymlink_path	^.*\.so$
+%__libsymlink_magic		^symbolic link to .*lib.*\\.so\\..*$
+%__libsymlink_path	^.*\\.so$
 %__libsymlink_flags	magic_and_path
--- a/SOURCES/macros
+++ b/SOURCES/macros
@ -18,12 +18,31 @@

 %_fmoddir		%{_libdir}/gfortran/modules

+%source_date_epoch_from_changelog 1
+
 %_enable_debug_packages 1
 %_include_minidebuginfo 1
 %_include_gdb_index     1
 %_debugsource_packages  1
 %_debuginfo_subpackages 1

+# GCC toolchain
+%__cc_gcc gcc
+%__cxx_gcc g++
+%__cpp_gcc gcc -E
+
+# Clang toolchain
+%__cc_clang clang
+%__cxx_clang clang++
+%__cpp_clang clang-cpp
+
+# Default to the GCC toolchain
+%toolchain gcc
+
+%__cc %{expand:%%{__cc_%{toolchain}}}
+%__cxx %{expand:%%{__cxx_%{toolchain}}}
+%__cpp %{expand:%%{__cpp_%{toolchain}}}
+
 #==============================================================================
 # ---- compiler flags.

@ -44,25 +63,34 @@
 # the flags, while intended for ld, are still passed through the gcc
 # compiler driver.  At the beginning of %%build, the environment
 # variable RPM_LD_FLAGS to this value.
-%build_ldflags -Wl,-z,relro %{_ld_symbols_flags} %{_hardened_ldflags}
+# When clang is used as a linker driver, it does not auto-detect the LTO
+# bytecode and neither does bfd, so we need to explicitly pass the -flto
+# flag when linking.
+%build_ldflags -Wl,-z,relro %{_ld_as_needed_flags} %{_ld_symbols_flags} %{_hardened_ldflags} %{_annotation_ldflags} %[ "%{toolchain}" == "clang" ? "%{?_lto_cflags}" : "" ]

-# Expands to shell code to seot the compiler/linker environment
+# Expands to shell code to set the compiler/linker environment
 # variables CFLAGS, CXXFLAGS, FFLAGS, FCFLAGS, LDFLAGS if they have
 # not been set already.  RPM_OPT_FLAGS and RPM_LD_FLAGS have already
 # been set implicitly at the start of the %%build section.
+# LT_SYS_LIBRARY_PATH is used by libtool script.
 %set_build_flags \
  CFLAGS="${CFLAGS:-%{build_cflags}}" ; export CFLAGS ; \
  CXXFLAGS="${CXXFLAGS:-%{build_cxxflags}}" ; export CXXFLAGS ; \
  FFLAGS="${FFLAGS:-%{build_fflags}}" ; export FFLAGS ; \
  FCFLAGS="${FCFLAGS:-%{build_fflags}}" ; export FCFLAGS ; \
-  LDFLAGS="${LDFLAGS:-%{build_ldflags}}" ; export LDFLAGS
+  LDFLAGS="${LDFLAGS:-%{build_ldflags}}" ; export LDFLAGS ; \
+  LT_SYS_LIBRARY_PATH="${LT_SYS_LIBRARY_PATH:-%_libdir:}" ; export LT_SYS_LIBRARY_PATH ; \
+  CC="${CC:-%{__cc}}" ; export CC ; \
+  CXX="${CXX:-%{__cxx}}" ; export CXX

 # Internal-only.  Do not use.  Expand a variable and strip the flags
 # not suitable to extension builders.
 %__extension_strip_flags() %{lua:
 local name = rpm.expand("%{1}")
 local value = " " .. rpm.expand("%{build_" .. name .. "}")
-local result = string.gsub(value, "%s+-specs=[^%s]+", " ")
+local specs_pattern = "%s+-specs=[^%s]+"
+local lto_flags_pattern = rpm.expand("%{?_lto_cflags}"):gsub("[%-%.]", "%%%1")
+local result = value:gsub(specs_pattern, " "):gsub(lto_flags_pattern, "")
 print(result)
 }

@ -80,6 +108,16 @@ print(result)
 %__global_fcflags %{build_fflags}
 %__global_ldflags %{build_ldflags}

+# Architecture-specific support.  Internal.  Do not use directly.
+
+%__cflags_arch_x86_64 %[0%{?rhel} >= 9 ? "-march=x86-64-v2" : ""]
+
+# Also used for s390.
+%__cflags_arch_s390x %[0%{?rhel} >= 9 ? "-march=z14 -mtune=z15" : "-march=zEC12 -mtune=z13"]
+
+# Also used for ppc64le.
+%__cflags_arch_ppc64le %[0%{?rhel} >= 9 ? "-mcpu=power9 -mtune=power9" : "-mcpu=power8 -mtune=power8"]
+
 #==============================================================================
 # ---- configure and makeinstall.
 #
@ -90,8 +128,49 @@ print(result)
 # Eventually we'll want to turn this on by default, but this gives packagers a
 # way to turn it back off.
 # %_configure_disable_silent_rules 1
+
+# This fixes various easy resolved configure tests that are compromised by LTO.
+#
+# We use this within the standard %configure macro, but also make it available
+# for packages which don't use %configure
+#
+# The first three are common ways to test for the existence of a function, so
+# we ensure the reference to the function is preserved
+#
+# The fourth are constants used to then try to generate NaNs and other key
+# floating point numbers.  We then use those special FP numbers to try and
+# raise a SIGFPE.  By declaring x & y volatile we prevent the optimizers
+# from removing the computation
+#
+# The fifth (and worst) addresses problems with autoconf/libtool's approach
+# to extracting symbols from .o files and generating C code.  In an LTO world
+# types matter much more closely and you can't have an object in one context
+# that is a function definition and a simple scalar variable in another.
+# Thankfully HP-UX has always had that restriction and is supported by
+# autoconf/libtool.  The insane sed script replaces the "generic" code with
+# the HP-UX version.
+#
+# If we do not make changes, we put the original file back.  This avoids
+# unnecessary rebuilds of things that may have dependencies on the configure
+# files.
+#
+%_fix_broken_configure_for_lto \
+  for file in $(find . -type f -name configure -print); do \
+    %{__sed} -r --in-place=.backup 's/^char \\(\\*f\\) \\(\\) = /__attribute__ ((used)) char (*f) () = /g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} -r --in-place=.backup 's/^char \\(\\*f\\) \\(\\);/__attribute__ ((used)) char (*f) ();/g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} -r --in-place=.backup 's/^char \\$2 \\(\\);/__attribute__ ((used)) char \\$2 ();/g' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} --in-place=.backup '1{$!N;$!N};$!N;s/int x = 1;\\nint y = 0;\\nint z;\\nint nan;/volatile int x = 1; volatile int y = 0; volatile int z, nan;/;P;D' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+    %{__sed} --in-place=.backup 's#^lt_cv_sys_global_symbol_to_cdecl=.*#lt_cv_sys_global_symbol_to_cdecl="sed -n -e '"'"'s/^T .* \\\\(.*\\\\)$/extern int \\\\1();/p'"'"' -e '"'"'s/^$symcode* .* \\\\(.*\\\\)$/extern char \\\\1;/p'"'"'"#' $file; \
+    diff -u $file.backup $file && mv $file.backup $file \
+  done
+
 %configure \
  %{set_build_flags}; \
+  [ "%{_lto_cflags}"x != x ] && %{_fix_broken_configure_for_lto}; \
  [ "%_configure_gnuconfig_hack" = 1 ] && for i in $(find $(dirname %{_configure}) -name config.guess -o -name config.sub) ; do \
      [ -f /usr/lib/rpm/redhat/$(basename $i) ] && %{__rm} -f $i && %{__cp} -fv /usr/lib/rpm/redhat/$(basename $i) $i ; \
  done ; \
@ -117,19 +196,6 @@ print(result)
 	--mandir=%{_mandir} \\\
 	--infodir=%{_infodir}

-# Maximum number of CPU's to use when building, 0 for unlimited.
-#
-# This was for some time capped at 16.  Please see
-# https://bugzilla.redhat.com/show_bug.cgi?id=669638 and
-# https://bugzilla.redhat.com/show_bug.cgi?id=1384938 for the situation
-# surrounding this.
-#%_smp_ncpus_max 0
-%_smp_mflags %([ -z "$RPM_BUILD_NCPUS" ] \\\
-	&& RPM_BUILD_NCPUS="`/usr/bin/getconf _NPROCESSORS_ONLN`"; \\\
-        ncpus_max=%{?_smp_ncpus_max}; \\\
-        if [ -n "$ncpus_max" ] && [ "$ncpus_max" -gt 0 ] && [ "$RPM_BUILD_NCPUS" -gt "$ncpus_max" ]; then RPM_BUILD_NCPUS="$ncpus_max"; fi; \\\
-        if [ "$RPM_BUILD_NCPUS" -gt 1 ]; then echo "-j$RPM_BUILD_NCPUS"; fi)
-
 #==============================================================================
 # ---- Build policy macros.
 #
@ -155,15 +221,19 @@ print(result)
 %__brp_ldconfig /usr/lib/rpm/redhat/brp-ldconfig
 %__brp_compress /usr/lib/rpm/brp-compress
 %__brp_strip /usr/lib/rpm/brp-strip %{__strip}
+%__brp_strip_lto /usr/lib/rpm/redhat/brp-strip-lto %{__strip}
 %__brp_strip_comment_note /usr/lib/rpm/brp-strip-comment-note %{__strip} %{__objdump}
 %__brp_strip_static_archive /usr/lib/rpm/brp-strip-static-archive %{__strip}
-%__brp_python_bytecompile /usr/lib/rpm/brp-python-bytecompile "" %{?_python_bytecompile_errors_terminate_build}
+%__brp_python_bytecompile /usr/lib/rpm/redhat/brp-python-bytecompile "" "%{?_python_bytecompile_errors_terminate_build}" "%{?_python_bytecompile_extra}"
+%__brp_fix_pyc_reproducibility /usr/lib/rpm/redhat/brp-fix-pyc-reproducibility
 %__brp_python_hardlink /usr/lib/rpm/brp-python-hardlink
 # __brp_mangle_shebangs_exclude - shebangs to exclude
 # __brp_mangle_shebangs_exclude_file - file from which to get shebangs to exclude
 # __brp_mangle_shebangs_exclude_from - files to ignore
 # __brp_mangle_shebangs_exclude_from_file - file from which to get files to ignore
-%__brp_mangle_shebangs PYTHON3="%{__python3}" /usr/lib/rpm/redhat/brp-mangle-shebangs %{?__brp_mangle_shebangs_exclude:--shebangs "%{?__brp_mangle_shebangs_exclude}"} %{?__brp_mangle_shebangs_exclude_file:--shebangs-from "%{__brp_mangle_shebangs_exclude_file}"} %{?__brp_mangle_shebangs_exclude_from:--files "%{?__brp_mangle_shebangs_exclude_from}"} %{?__brp_mangle_shebangs_exclude_from_file:--files-from "%{__brp_mangle_shebangs_exclude_from_file}"}
+%__brp_mangle_shebangs /usr/lib/rpm/redhat/brp-mangle-shebangs %{?__brp_mangle_shebangs_exclude:--shebangs "%{?__brp_mangle_shebangs_exclude}"} %{?__brp_mangle_shebangs_exclude_file:--shebangs-from "%{__brp_mangle_shebangs_exclude_file}"} %{?__brp_mangle_shebangs_exclude_from:--files "%{?__brp_mangle_shebangs_exclude_from}"} %{?__brp_mangle_shebangs_exclude_from_file:--files-from "%{__brp_mangle_shebangs_exclude_from_file}"}
+
+%__brp_llvm_compile_lto_elf /usr/lib/rpm/redhat/brp-llvm-compile-lto-elf %{build_cflags} %{build_ldflags}

 %__os_install_post    \
    %{?__brp_ldconfig} \
@ -172,13 +242,16 @@ print(result)
    %{?__brp_strip} \
    %{?__brp_strip_comment_note} \
    } \
+    %{?__brp_strip_lto} \
    %{?__brp_strip_static_archive} \
    %{?py_auto_byte_compile:%{?__brp_python_bytecompile}} \
+    %{?py_reproducible_pyc_path:%{?__brp_fix_pyc_reproducibility} "%{py_reproducible_pyc_path}"} \
    %{?__brp_python_hardlink} \
    %{?__brp_mangle_shebangs} \
 %{nil}

 %__spec_install_post\
+    %[ "%{toolchain}" == "clang" ? "%{?__brp_llvm_compile_lto_elf}" : "%{nil}" ] \
    %{?__debug_package:%{__debug_install_post}}\
    %{__arch_install_post}\
    %{__os_install_post}\
@ -199,40 +272,77 @@ print(result)
 #
 ## Should python bytecompilation errors terminate a build?
 %_python_bytecompile_errors_terminate_build 1
+## Should python bytecompilation compile outisde python specific directories?
+%_python_bytecompile_extra 0

 # Use SHA-256 for FILEDIGESTS instead of default MD5
 %_source_filedigest_algorithm 8
 %_binary_filedigest_algorithm 8

-# Use XZ compression for binary payloads
-%_binary_payload w2.xzdio
+# Use Zstandard compression for binary payloads
+%_binary_payload w19.zstdio

-%_hardening_cflags	-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
+%_hardening_gcc_cflags   -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
+%_hardening_clang_cflags --config /usr/lib/rpm/redhat/redhat-hardened-clang.cfg
+%_hardening_cflags	 %{expand:%%{_hardening_%{toolchain}_cflags}} -fstack-protector-strong
 # we don't escape symbols '~', '"', etc. so be careful when changing this
-%_hardening_ldflags	-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
+%_hardening_ldflags	 -Wl,-z,now %[ "%{toolchain}" == "gcc" ? "-specs=/usr/lib/rpm/redhat/redhat-hardened-ld" : "" ]

-# Harden packages by default for Fedora 23:
+# Harden packages by default for Fedora 23+:
 # https://fedorahosted.org/fesco/ticket/1384 (accepted on 2014-02-11)
 # Use "%undefine _hardened_build" to disable.
 %_hardened_build	1
 %_hardened_cflags	%{?_hardened_build:%{_hardening_cflags}}
 %_hardened_ldflags	%{?_hardened_build:%{_hardening_ldflags}}

-%_annobin_cflags	-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1
-
-# Add extra information to binary objects created by gcc for Fedora 28:
+# Add extra information to binary objects created by the compiler:
 # https://pagure.io/fesco/issue/1780 (accepted on 2017-10-30)
 # Use "%undefine _annotated_build" to disable.
 %_annotated_build	1
-%_annotated_cflags	%{?_annotated_build:%{_annobin_cflags}}
+%_annobin_gcc_plugin	-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1
+# The annobin plugin is not built for clang yet
+%_annobin_clang_plugin	%dnl-fplugin=/usr/lib64/clang/`clang -dumpversion`/lib/annobin.so
+%_annotation_cflags     %{?_annotated_build:%{expand:%%{_annobin_%{toolchain}_plugin}}}
+%_annotation_ldflags	%{?_lto_cflags:%{_annotation_cflags}}
+# Use the remove-section option to force the find-debuginfo script
+# to move the annobin notes into the separate debuginfo file.
+%_find_debuginfo_vendor_opts %{?_annotated_build:--remove-section .gnu.build.attributes}

 # Fail linking if there are undefined symbols.  Required for proper
 # ELF symbol versioning support.  Disabled by default.
-# Use "%define _strict_symbol_defs_build 1" to enable.
-#%_strict_symbol_defs_build	1
-%_ld_symbols_flags		%{?_strict_symbol_defs_build:-Wl,-z,defs}
+# Use "%define _ld_strict_symbol_defs 1" to enable.
+#%_ld_strict_symbol_defs		1
+%_ld_symbols_flags		%{?_ld_strict_symbol_defs:-Wl,-z,defs}

-%__global_compiler_flags	-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches %{_hardened_cflags} %{_annotated_cflags}
+# https://fedoraproject.org/wiki/Changes/RemoveExcessiveLinking
+# use "%undefine _ld_as_needed" to disable.
+%_ld_as_needed		1
+%_ld_as_needed_flags	%{?_ld_as_needed:-Wl,--as-needed}
+
+# LTO is the default in Fedora.
+#   "%define _lto_cflags %{nil}"  to opt out
+#
+# We currently have -ffat-lto-objects turned on out of an abundance of
+# caution.  To remove it we need to do a check of the installed .o/.a files
+# to verify they have real sections/symbols after LTO stripping.  That
+# way we can detect installing an unusable .o/.a file.  This is on the TODO
+# list for F34.
+%_gcc_lto_cflags	-flto=auto -ffat-lto-objects
+%_clang_lto_cflags	-flto=thin
+%_lto_cflags		%{expand:%%{_%{toolchain}_lto_cflags}}
+
+%_general_options       -O2 %{?_lto_cflags} -fexceptions -g -grecord-gcc-switches -pipe
+%_warning_options       -Wall -Werror=format-security
+%_preprocessor_defines  -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS
+
+# Common variables are no longer generated by default by gcc and clang
+# If they are needed then add "%define _legacy_common_support 1" to the spec file.
+%_legacy_options	%{?_legacy_common_support: -fcommon}
+
+%__global_compiler_flags %{_general_options} %{_warning_options} %{_preprocessor_defines} %{_hardened_cflags} %{_annotation_cflags} %{_legacy_options}
+
+# Automatically trim changelog entries after 2 years
+%_changelog_trimtime	%{lua:print(os.time() - 2 * 365 * 86400)}

 #==============================================================================
 # ---- Generic auto req/prov filtering macros
--- a/SOURCES/macros.fedora-misc
+++ b/SOURCES/macros.fedora-misc
@ -1,16 +1,16 @@
-# Some miscellaneous Fedora-related macros
+# Fedora macros, safe to use after the SRPM build stage

-# List files matching inclusion globs, excluding files matching exclusion blogs
-# Optional parameters:
-#  – -i "<globs>" inclusion globs
-#  – -x "<globs>" exclusion globs
-# Globs are space-separated lists of shell globs. Such lists require %{quote:}
-# use for safe rpm argument passing.
-# Alternatively, set the following rpm variables before calling the macro:
-#  – “listfiles_include” inclusion globs
-#  — “listfiles_exclude” exclusion globs
-# Arguments passed to the macro without flags will be interpreted as inclusion
-# globs.
+# Lists files matching inclusion globs, excluding files matching exclusion
+# globs
+#   – globs are space-separated lists of shell globs. Such lists require
+#     %{quote:} use when passed as rpm arguments or flags.
+# Control variables, flags and arguments:
+#   %{listfiles_include}  inclusion globs
+#   %{listfiles_exclude}  exclusion globs
+#   -i <globs>            inclusion globs
+#   -x <globs>            exclusion globs
+#   …                     arguments passed to the macro without flags will be
+#                         interpreted as inclusion globs
 %listfiles(i:x:) %{expand:
 %if %{lua: print(string.len(rpm.expand("%{?-i*}%{?listfiles_include}%*")))}
  listfiles_include=$(realpath -e --relative-base=. %{?-i*} %{?listfiles_include} %* | sort -u)
@ -26,9 +26,11 @@
 }

 # https://github.com/rpm-software-management/rpm/issues/581
-# Write the contents of a list of rpm variables to a macro file.
-# The target file must contain the corresponding anchors.
-# For example %writevars -f myfile foo bar will replace:
+# Writes the contents of a list of rpm variables to a macro file
+# Control variables, flags and arguments:
+#   -f <filename>  the macro file to process:
+#                    – it must contain corresponding anchors
+#                    – for example %writevars -f myfile foo bar will replace:
 #                        @@FOO@@ with the rpm evaluation of %{foo} and
 #                        @@BAR@@ with the rpm evaluation of %{bar}
 #                      in myfile
@ -59,21 +61,3 @@ if data ~= "" then
  print(rpm.expand("--data='%{SOURCE" .. data ..  "}' "))
 end
 }
-
-# gpgverify verifies signed sources. There is documentation in the script.
-%gpgverify(k:s:d:) %{lua:
-local script = rpm.expand("%{_rpmconfigdir}/redhat/gpgverify ")
-local keyring = rpm.expand("%{-k*}")
-local signature = rpm.expand("%{-s*}")
-local data = rpm.expand("%{-d*}")
-print(script)
-if keyring ~= "" then
-  print(rpm.expand("--keyring='%{SOURCE" .. keyring ..  "}' "))
-end
-if signature ~= "" then
-  print(rpm.expand("--signature='%{SOURCE" .. signature ..  "}' "))
-end
-if data ~= "" then
-  print(rpm.expand("--data='%{SOURCE" .. data ..  "}' "))
-end
-}
--- a/SOURCES/macros.fedora-misc-srpm
+++ b/SOURCES/macros.fedora-misc-srpm
@ -1,4 +1,4 @@
-# Some miscellaneous Fedora-related macros
+# Fedora macros, safe to use at SRPM build stage

 # A directory for rpm macros
 %rpmmacrodir /usr/lib/rpm/macros.d
@ -6,3 +6,38 @@
 # A directory for appdata metainfo.  This has changed between releases so a
 # macro is useful.
 %_metainfodir %{_datadir}/metainfo
+
+# A directory for SWID tag files describing the installation
+%_swidtagdir %{_prefix}/lib/swidtag/fedoraproject.org
+
+# Applies the fedora.wordwrap filter to the content of an rpm variable, and
+# prints the result.
+#   – putting multiple lines of UTF-8 text inside a variable is usually
+#     accomplished with %{expand:some_text}
+# Control variables, flags and arguments:
+#   -v <variable_name>  (default value: _description)
+%wordwrap(v:) %{lua:
+local   fedora = require "fedora.common"
+local variable = "%{?" .. rpm.expand("%{-v*}%{!-v:_description}") .. "}"
+print(fedora.wordwrap(variable))
+}
+
+# A single Name: and %package substitute
+# Control variables, flags and arguments:
+#   %{source_name}         the SRPM name
+#   %{source_summary}      the SRPM summary
+#   %{source_description}  the SRPM description
+#   -n <name>              declare a package named <name>
+#                          (%package-like behavior)
+#   -v                     be verbose
+#   %1                     declare a package named %{source_name}-%{%1}
+#                          (%package-like behavior)
+%new_package(n:v) %{lua:
+local      fedora = require "fedora.common"
+local    pkg_name = fedora.readflag("n")
+local     verbose = fedora.hasflag("v")
+local name_suffix = fedora.read("1")
+local source_name = fedora.read("source_name")
+local       first = not ( fedora.read("name") or fedora.read("currentname") )
+fedora.new_package(source_name, pkg_name, name_suffix, first, verbose)
+}
--- a/SOURCES/macros.forge
+++ b/SOURCES/macros.forge
@ -1,282 +1,70 @@
-# Map forge information to rpm metadata. This macro will compute default spec
-# variable values.
-#
-# The following spec variables SHOULD be set before calling the macro:
-#
-#   forgeurl  the project url on the forge, strongly recommended;
-#             alternatively, use -u <url>
-#   Version   if applicable, set it with Version: <version>
-#   tag       if applicable
-#   commit    if applicable
-#
-# The macro will attempt to compute and set the following variables if they are
-# not already set by the packager:
-#
-#   forgesource    an URL that can be used as SourceX: value
-#   forgesetupargs the correct arguments to pass to %setup for this source
-#                  used by %forgesetup and %forgeautosetup
-#   archivename    the source archive filename, without extentions
-#   archiveext     the source archive filename extensions, without leading dot
-#   archiveurl     the url that can be used to download the source archive,
-#                  without renaming
-#   scm            the scm type, when packaging code snapshots: commits or tags
-#
-# If the macro is unable to parse your forgeurl value set at least archivename
-# and archiveurl before calling it.
-#
-# Most of the computed variables are both overridable and optional. However,
-# the macro WILL REDEFINE %{dist} when packaging a snapshot (commit or tag).
-# The previous %{dist} value will be lost. Don’t call the macro if you don’t
-# wish %{dist} to be changed.
-#
-# Optional parameters:
-#   -u <url>  Ignore forgeurl even if it exists and use <url> instead. Note
-#             that the macro will still end up setting <url> as the forgeurl
-#             spec variable if it manages to parse it.
-#   -s  Silently ignore problems in forgeurl, use it if it can be parsed,
-#       ignore it otherwise.
-#   -p  Restore problem handling, override -s.
-#   -v  Be verbose and print every spec variable the macro sets.
-#   -i  Print some info about the state of spec variables the macro may use or
-#       set at the end of the processing.
-%forgemeta(u:spvi) %{lua:
-local forgeurl    = rpm.expand("%{?-u*}")
-if (forgeurl == "") then
-  forgeurl        = rpm.expand("%{?forgeurl}")
-end
-local silent      = false
-local verbose     = false
-local informative = false
-if (rpm.expand("%{?-s}") ~= "") then
-  silent          = true
-end
-if (rpm.expand("%{?-p}") ~= "") then
-  silent          = false
-end
-if (rpm.expand("%{?-v}") ~= "") then
-  verbose         = true
-end
-if (rpm.expand("%{?-i}") ~= "") then
-  informative     = true
-end
-local tag         = rpm.expand("%{?tag}")
-local commit      = rpm.expand("%{?commit}")
-- Be explicit about the spec variables we’re setting
-local function explicitset(rpmvariable,value)
-  rpm.define(rpmvariable .. " " .. value)
-  if verbose then
-    rpm.expand("%{echo:Setting %%{" .. rpmvariable .. "} = " .. value .. "\\n}")
+# Computes forge-related variables for use in the rest of the spec file
+# Control variables, flags and arguments:
+#   %{forgeurl<number>}  the project url on the target forge
+#   %{tag<number>}       the packaged tag, OR
+#   %{commit<number>}    the packaged commit, OR
+#   %{version<number>}   the packaged version
+#                          – %{version}/%{version0} are set via:
+#                              Version:
+#                          – because git is lacking a built-in version
+#                            reference, %{version<number>} will be translated
+#                            into %{tag<number>} using unreliable heuristics;
+#                            set %{tag<number>} directly if those fail
+#   %{date<number>}      the packaged timestamp
+#   …                    %forgemeta will compute a huge number of variables:
+#                          — the packager can override it by setting some of
+#                            those before the %forgemeta call
+#                          – use the -i flag to list those variables
+#   -z <number>          only process the zth block of definitions
+#                        "" for the no-suffix block
+#   -i                   list the resulting variable values
+#   -s                   silently ignore problems in %{forgeurl<number>}
+#   -v                   be verbose
+#   -a                   process all sources in one go, instead of using
+#                        separate -z calls
+%forgemeta(z:isva) %{lua:
+local      fedora = require "fedora.common"
+local       forge = require "fedora.srpm.forge"
+local     verbose =  rpm.expand("%{-v}") ~= ""
+local informative =  rpm.expand("%{-i}") ~= ""
+local      silent =  rpm.expand("%{-s}") ~= ""
+local  processall = (rpm.expand("%{-a}") ~= "") and (rpm.expand("%{-z}") == "")
+if processall then
+  for _,s in pairs(fedora.getsuffixes("forgeurl")) do
+    forge.meta(s,verbose,informative,silent)
  end
-end
-- Never ever stomp on a spec variable the packager already set
-local function safeset(rpmvariable,value)
-  if (rpm.expand("%{?" .. rpmvariable .. "}") == "") then
-    explicitset(rpmvariable,value)
-  end
-end
-- Set spec variable values for each known software publishing service
-if (forgeurl ~= "") then
-  local forge          = string.match(forgeurl, "^[^:]+://([^/]+)/")
-  if (forge == nil) then
-    if not silent then
-      rpm.expand("%{error:URLs must include a protocol such as https:// and a path starting with / !\\n}")
-    end
-  else
-    if (string.match(forge, "^gitlab[%.-]") or string.match(forge, "[%.-]gitlab[%.]")) then
-      forgeurl = string.match(forgeurl, "https://[^/]+/[^/]+/[^/#?]+")
-      if (forgeurl == nil) then
-        if not silent then
-          rpm.expand("%{error:Gitlab URLs must match https://(…[-.])gitlab[-.]…/owner/repo !\\n}")
-        end
-      else
-        explicitset("forgeurl",   forgeurl)
-        if (commit == "") then
-          rpm.expand("%{error:All Gitlab URLs require commit value knowledge: you need to define %{commit}!\\nPlease vote on https://gitlab.com/gitlab-org/gitlab-ce/issues/38830\\n}")
-        end
-        safeset("archiveext",     "tar.bz2")
-        safeset("forgesetupargs", "-n %{archivename}")
-        if (commit ~= "") or (tag ~= "") then
-          safeset("scm", "git")
-        end
-        local owner   = string.match(forgeurl, "^[^:]+://[^/]+/([^/]+)")
-        local repo    = string.match(forgeurl, "^[^:]+://[^/]+/[^/]+/([^/]+)")
-        local version = rpm.expand("%{?version}")
-        if (version ~= "") and (version ~= "0") and (tag == "") then
-          -- GitLab does not have strong versionning semantics
-          -- Some projects use "version" as release tag, others "v" + "version"
-          -- Tag value needs to be explicitly declared before calling the macro
-          -- in the second case
-          tag = version
-          safeset("tag", tag)
-        end
-        if (tag ~= "") then
-          safeset("archivename", repo .. "-%{tag}-%{commit}")
-          safeset("archiveurl",  "%{forgeurl}/repository/%{tag}/archive.%{archiveext}")
-        else
-          safeset("archivename", repo .. "-%{commit}")
-          safeset("archiveurl",  "%{forgeurl}/repository/%{commit}/archive.%{archiveext}")
-        end
-      end
-    end
-    if (string.match(forge, "^github[%.-]") or string.match(forge, "[%.-]github[%.]")) then
-      forgeurl = string.match(forgeurl, "https://[^/]+/[^/]+/[^/#?]+")
-      if (forgeurl == nil) then
-        if not silent then
-          rpm.expand("%{error:GitHub URLs must match https://(…[-.])github[-.]…/owner/repo !\\n}")
-        end
-      else
-        explicitset("forgeurl",   forgeurl)
-        safeset("archiveext",     "tar.gz")
-        local forgesetupargs = "-n %{archivename}"
-        if (commit ~= "") or (tag ~= "") then
-          safeset("scm", "git")
-        end
-        local owner = string.match(forgeurl, "^[^:]+://[^/]+/([^/]+)")
-        local repo  = string.match(forgeurl, "^[^:]+://[^/]+/[^/]+/([^/]+)")
-        if (tag ~= "") then
-          -- if upstream used a version suffix such as -rc1 or -beta it will not
-          -- be a valid version string for rpm but github will accept it fine and
-          -- use the same naming as for other versions: v prefix in the tag and
-          -- archivename, no v prefix in the topdir naming inside the archive
-          local version = rpm.expand("%{?version}")
-          if version ~= "" and
-             (string.match(tag, "^v" .. version .. "[^%d]") or
-              string.match(tag, "^v" .. version .. "$"))    then
-            forgesetupargs = "-n " .. repo .. "-" .. string.gsub(tag, "^v", "")
-          end
-          safeset("archivename",   repo .. "-%{tag}")
-          safeset("archiveurl",    "%{forgeurl}/archive/%{tag}.%{archiveext}")
-        else
-          if (commit ~= "") then
-            safeset("archivename", repo .. "-%{commit}")
-            safeset("archiveurl",  "%{forgeurl}/archive/%{commit}/" .. repo .. "-%{commit}.%{archiveext}")
-          else
-            safeset("archivename", repo .. "-%{version}")
-            safeset("archiveurl",   "%{forgeurl}/archive/v%{version}.%{archiveext}")
-          end
-        end
-        safeset("forgesetupargs", forgesetupargs)
-      end
-    end
-    if (forge == "code.googlesource.com") then
-      forgeurl = string.match(forgeurl, "https://code.googlesource.com/[^#?]*[^/#?]+")
-      if (forgeurl == nil) then
-        if not silent then
-          rpm.expand("%{error:Googlesource URLs must match https://code.googlesource.com/…/repo !\\n}")
-        end
-      else
-        explicitset("forgeurl",   forgeurl)
-        safeset("archiveext",     "tar.gz")
-        safeset("forgesetupargs", "-c")
-        if (commit ~= "") or (tag ~= "") then
-          safeset("scm", "git")
-        end
-        local repo = string.match(forgeurl, "^[^:]+://.+/([^/?#]+)")
-        if (tag ~= "") then
-          safeset("archivename",   repo .. "-%{tag}")
-          safeset("archiveurl",    "%{forgeurl}/+archive/%{tag}.%{archiveext}")
-        else
-          if (commit ~= "") then
-            safeset("archivename", repo .. "-%{commit}")
-            safeset("archiveurl",  "%{forgeurl}/+archive/%{commit}.%{archiveext}")
-          else
-            safeset("archivename", repo .. "-v%{version}")
-            safeset("archiveurl",  "%{forgeurl}/+archive/v%{version}.%{archiveext}")
-          end
-        end
-      end
-    end
-    if (forge == "bitbucket.org") then
-      forgeurl = string.match(forgeurl, "https://[^/]+/[^/]+/[^/#?]+")
-      if (forgeurl == nil) then
-        if not silent then
-          rpm.expand("%{error:BitBucket URLs must match https://bitbucket.org/owner/repo !\\n}")
-        end
-      else
-        explicitset("forgeurl",   forgeurl)
-        if (commit == "") then
-          rpm.expand("%{error:All BitBucket URLs require commit value knowledge: you need to define %{commit}!\\n}")
-        end
-        local shortcommit = string.sub(commit, 1, 12)
-        safeset("archiveext", "tar.bz2")
-        -- Default to git even though BitBucket allows choosing between several SCMs
-        -- Set scm to hg for example before calling the macro if your project does not use git
-        safeset("scm", "git")
-        local owner = string.match(forgeurl, "^[^:]+://[^/]+/([^/]+)")
-        local repo  = string.match(forgeurl, "^[^:]+://[^/]+/[^/]+/([^/]+)")
-        safeset("archivename",    owner .. "-" .. repo .. "-" .. shortcommit)
-        safeset("forgesetupargs", "-n %{archivename}")
-        if (tag ~= "") then
-          safeset("archiveurl",  "%{forgeurl}/get/%{tag}.%{archiveext}")
-        else
-          safeset("archiveurl",  "%{forgeurl}/get/%{commit}.%{archiveext}")
-        end
-      end
-    end
-    if (forge == "pagure.io") then
-      if not silent then
-        rpm.expand("%{error:https://pagure.io/pagure/issue/861 needs to be resolved before the “pagure.io”\\nsoftware publishing service can be supported.\\n}")
-      end
-    end
-    -- Final tests to check forgeurl was successfuly parsed
-    if not silent then
-      if (rpm.expand("%{?archivename}") == "") or (rpm.expand("%{?archiveurl}") == "") then
-        rpm.expand("%{error:Automation for the “" .. forge .. "”\\nsoftware publishing service is not implemented yet.\\nPlease extend the %%forgemeta macro!\\n}")
-      end
-    end
-  end
-end
-- Set defaults if forgeurl is missing or does not parse
-local archivename = rpm.expand("%{?archivename}")
-safeset("archiveext",       "tar.gz")
-if (archivename ~= "") then
-  safeset("forgesetupargs", "-n %{archivename}")
-end
-if (commit ~= "") or (tag ~= "") then
-  safeset("scm",            "git")
-end
-- Source URL processing (computing the forgesource spec variable)
-local archiveurl  = rpm.expand("%{?archiveurl}")
-local archiveext  = rpm.expand("%{?archiveext}")
-if (archivename ~= "") and (archiveurl ~= "") then
-  if (string.match(archiveurl, "/([^/]+)$") == archivename .. "." .. archiveext) then
-    safeset("forgesource", "%{archiveurl}")
-  else
-    safeset("forgesource", "%{?archiveurl}#/%{?archivename}.%{archiveext}")
-  end
-end
-- dist processing (computing the correct pefix for snapshots)
-local distprefix = rpm.expand("%{?tag}")
-local version    = rpm.expand("%{?version}")
-if (distprefix == version) or (distprefix == "v" .. version) then
-  distprefix = ""
-end
-if (distprefix == "") then
-  distprefix = string.sub(rpm.expand("%{?commit}"), 1, 7)
-end
-if (distprefix ~= "") then
-  local dist = ".%([ -r %{_sourcedir}/%{archivename}.%{archiveext} ] && date +%Y%m%d -u -r %{_sourcedir}/%{archivename}.%{archiveext})%{scm}" .. string.gsub(distprefix, "-",".") .. rpm.expand("%{?dist}")
-  explicitset("dist", dist)
-end
-- Final spec variable summary if the macro was called with -i
-if informative then
-  rpm.expand("%{echo:Forge-specific packaging variables\\n}")
-  rpm.expand("%{echo:  forgeurl:        %{?forgeurl}\\n}")
-  rpm.expand("%{echo:  forgesource:     %{?forgesource}\\n}")
-  rpm.expand("%{echo:  forgesetupargs:  %{?forgesetupargs}\\n}")
-  rpm.expand("%{echo:Generic variables\\n}")
-  rpm.expand("%{echo:  archivename:     %{?archivename}\\n}")
-  rpm.expand("%{echo:  archiveext:      %{?archiveext}\\n}")
-  rpm.expand("%{echo:  archiveurl:      %{?archiveurl}\\n}")
-  rpm.expand("%{echo:  scm:             %{?scm}\\n}")
-  rpm.expand("%{echo:  tag:             %{?tag}\\n}")
-  rpm.expand("%{echo:  commit:          %{?commit}\\n}")
-  rpm.expand("%{echo:  dist:            %{?dist} (snapshot date is computed once %%{_sourcedir}/%%{archivename}.%%{archiveext} is available)\\n}")
+else
+  forge.meta(rpm.expand("%{-z*}"),verbose,informative,silent)
 end
 }

-# Convenience macro to relay computed arguments to %setup
-%forgesetup(a:b:cDn:Tq) %setup %{?forgesetupargs} %{-a} %{-b} %{-c} %{-D} %{-n} %{-T} %{-q}
+# Unpacks sources computed by %forgemeta
+# Control variables, flags and arguments:
+#   %{forgesource<number>}       the source archive that will be processed
+#   %{forgesetupargs<number>}    %setup arguments

-# Convenience macro to relay computed arguments to %autosetup
-%forgeautosetup(a:b:cDn:TvNS:p:) %autosetup %{?forgesetupargs} %{-a} %{-b} %{-c} %{-D} %{-n} %{-T} %{-v} %{-N} %{-S} %{-p}
+#   -z <number>                  only process the zth block of definitions
+#                                "" for the no-suffix block
+#   -v                           be verbose
+#   -a                   process all sources in one go, instead of using
+#                        separate -z calls
+%forgesetup(z:va) %{lua:
+local fedora = require "fedora.common"
+if (rpm.expand("%{-z}") == "") and (rpm.expand("%{-a}") ~= "") then
+  for _,s in pairs(fedora.getsuffixes("forgesetupargs")) do
+    print(rpm.expand("%setup %{!-v:-q} %{?forgesetupargs" .. s                     .. "}\\n"))
+  end
+else
+  print(  rpm.expand("%setup %{!-v:-q} %{?forgesetupargs" .. rpm.expand("%{-z*}") .. "}\\n"))
+end
+}
+
+# Calls %autosetup using %forgemeta results
+#   – this will probably be removed since it is unsafe in presence of multiple
+#     sources
+# Control variables, flags and arguments:
+#   -z <number>  process the zth block of definitions
+#   -v -N -S -p  relayed to %autosetup
+%forgeautosetup(z:vNS:p:q) %{lua:
+print(rpm.expand("%autosetup %{-v} %{-N} %{?-S} %{?-p} %{?forgesetupargs" .. rpm.expand("%{-z*}") .. "}\\n"))
+}
--- a/SOURCES/macros.kernel-srpm
+++ b/SOURCES/macros.kernel-srpm
@ -1,3 +0,0 @@
-# kernel_arches lists what arches the full kernel is built for.
-
-%kernel_arches x86_64 s390x ppc64le aarch64 %{arm}
--- a/SOURCES/macros.kmp
+++ b/SOURCES/macros.kmp
@ -1,97 +0,0 @@
-# Use these macros to differentiate between RH and other KMP implementation(s).
-%global redhat_kernel_module_package	1
-%global kernel_module_package_release	1
-
-%global redhat_kmp_has_post_hooks	1
-
-%__brp_kmod_set_exec_bit  /usr/lib/rpm/redhat/brp-kmod-set-exec-bit
-%__brp_kmod_restore_perms /usr/lib/rpm/redhat/brp-kmod-restore-perms
-
-%__kmod_brps_added 0
-
-%__find_provides        /usr/lib/rpm/redhat/find-provides
-%__find_requires        /usr/lib/rpm/redhat/find-requires
-
-#kernel_module_package [ -n name ] [ -v version ] [ -r release ] [ -s script ]
-#                      [ -f filelist] [ -x ] [ -p preamble ] flavor flavor ...
-
-%kernel_module_package_buildreqs	%global kmodtool_generate_buildreqs 1 \
-					kernel-devel kernel-abi-whitelists redhat-rpm-config kernel-rpm-macros elfutils-libelf-devel kmod
-
-%kernel_module_package(n:v:r:s:f:xp:) %{expand:%( \
-	## An ugly hack: we want kmods to be processed by find-debuginfo,
-	## but it processes only files with executable permission set.
-	## It is important now since, as of now, if debuginfo package
-	## is enabled (and it is enabled), there's an RPM build error
-	## as a result of lack of ether absence or emptiness of
-	## debugsourcefiles.list (which is likely a bug in RPM, but it looks
-	## like that there's no obvious fix and apparently no one have
-	## any issues with this).
-	## In order to minimise intrusiveness, usually (in Red Hat-built kmod
-	## RPMs) *.ko files just have executable permission being set as a part
-	## of %build section. There are two caveats with kmp, however:
-	##  * We have no control over %build section itself (and it wasn't
-	##    required previously)
-	##  * Changing the criteria used in find-debuginfo.sh/brp-strip
-	##    for selecting files that have to undergo debug section separation
-	##    may introduce regression.
-	## As a result, we insert additional hooks in __spec_install_post
-	## (__brp_kmod_set_exec_bit in the beginning and
-	## __brp_kmod_restore_perms in the end) that (temporarily) set
-	## executable permission for *.ko files so find-debuginfo.sh will pick
-	## them up.
-	## Unfortunately, __spec_install_post's body is copied here since
-	## we want that __debug_package macro expansion has been performed
-	## lazily and  it looks like RPM has no ability to provide a body
-	## of a macro verbatim.
-	if [ 0 = "%{__kmod_brps_added}" ]; then \
-		echo "%%global __spec_install_post \\\\" \
-		echo "	%%{?__brp_kmod_set_exec_bit} \\\\" \
-		echo "	%%%%{?__debug_package:%%%%{__debug_install_post}} \\\\" \
-		echo "	%%{__arch_install_post} \\\\" \
-		echo "	%%{__os_install_post} \\\\" \
-		echo "	%%{?__brp_kmod_pre_sign_process} \\\\" \
-		echo "	%%{?__brp_kmod_sign} \\\\" \
-		echo "	%%{?__brp_kmod_post_sign_process} \\\\" \
-		echo "	%%{?__brp_kmod_compress} \\\\" \
-		echo "	%%{?__brp_kmod_post_compress_process} \\\\" \
-		echo "	%%{?__brp_kmod_restore_perms} \\\\" \
-		echo "%%{nil}" \
-	fi \
-	%global __kmod_brps_added 1 \
-	%global kmodtool %{-s*}%{!-s:/usr/lib/rpm/redhat/kmodtool} \
-	%global kmod_version %{-v*}%{!-v:%{version}} \
-	%global kmod_release %{-r*}%{!-r:%{release}} \
-	%global latest_kernel %({ rpm -q --qf '%%{VERSION}-%%{RELEASE}.%%{ARCH}\\\\n' `rpm -qa | egrep "^kernel(-rt|-aarch64)?-devel" | /usr/lib/rpm/redhat/rpmsort -r | head -n 1`; echo '%%%%{nil}'; } | head -n 1) \
-	%{!?kernel_version:%{expand:%%global kernel_version %{latest_kernel}}} \
-	%global kverrel %(%{kmodtool} verrel %{?kernel_version} 2>/dev/null) \
-	flavors="default" \
-	if [ -z "%*" ]; then \
-		flavors_to_build=$flavors \
-	elif [ -z "%{-x}" ]; then \
-		flavors_to_build="%*" \
-	else \
-		flavors_to_build=" $flavors "\
-		for i in %* \
-		do \
-			flavors_to_build=${flavors_to_build//$i /}
-		done \
-	fi \
-	echo "%%global flavors_to_build ${flavors_to_build:-%%nil}" \
-	echo "%%global kernel_source() \\\$([ default = \"%%%%{1}\" ] && echo \"/usr/src/kernels//%%%%kverrel\" || %{kmodtool} kernel_source \"%%%%{kverrel}\" \"%%%%{1}\" 2>/dev/null || { ls -Ud \"/usr/src/kernels///%%%%{kverrel}\"[.+]\"%%%%{1}\" | sort -V | tail -n 1; } || echo \"/usr/src/kernels////%%%%kverrel.%%%%1\")" \
-	echo "%%global kernel_module_package_moddir() extra" \
-	if [ ! -z "%{-f*}" ] \
-	then \
-		filelist="%{-f*}" \
-	fi \
-	if [ ! -z "%{-p*}" ] \
-	then \
-		preamble="%{-p*}" \
-	fi \
-	nobuildreqs="yes" \
-	if [ "x%{kmodtool_generate_buildreqs}" != "x1" ] \
-	then \
-		nobuildreqs="no" \
-	fi \
-	override_filelist="$filelist" override_preamble="$preamble" nobuildreqs="$nobuildreqs" kmod_version=%kmod_version kmod_release=%kmod_release %{kmodtool} rpmtemplate %{-n*}%{!-n:%name} %{kverrel} $flavors_to_build 2>/dev/null \
-)}
--- a/SOURCES/macros.ldc-srpm
+++ b/SOURCES/macros.ldc-srpm
@ -1,2 +1,2 @@
 # arches that ldc builds on
-%ldc_arches %{ix86} x86_64 %{arm} %{power64}
+%ldc_arches %{ix86} x86_64 %{arm} aarch64
--- a/SOURCES/macros.valgrind-srpm
+++ b/SOURCES/macros.valgrind-srpm
@ -1,3 +1,3 @@
 # valgrind_arches lists what arches Valgrind works on

-%valgrind_arches %{ix86} x86_64 ppc ppc64 ppc64le armv7hl aarch64 s390x
+%valgrind_arches %{ix86} x86_64 ppc ppc64 ppc64le s390x armv7hl aarch64
--- a/SOURCES/macros.vpath
+++ b/SOURCES/macros.vpath
@ -4,4 +4,4 @@
 %_vpath_srcdir .

 # directory (doesn't need to exist) where all generated build files will be placed
-%_vpath_builddir %_target_platform
+%_vpath_builddir %{_vendor}-%{_target_os}-build
--- a/SOURCES/modalias.prov
+++ b/SOURCES/modalias.prov
@ -1,78 +0,0 @@
-#! /bin/bash -efu
-
-# heavily based upon find-suggests.ksyms by Andreas Gruenbacher <agruen@suse.de>.
-# with modifications by Michael Brown <Michael_E_Brown@dell.com>
-#
-# -- added module versioning info to modalias() symbols
-# -- removed code which inspects spec files.
-
-IFS=$'\n'
-
-#
-# Initially, dont generate modalias() lines for kernel package. This needs
-# additional discussion. Would like to eventually add them for
-# completeness, so that we can determine when drivers are folded into
-# mainline kernel.
-#
-is_kernel_package=""
-case "${1:-}" in
-kernel-module-*)    ;; # Fedora kernel module package names start with
-		       # kernel-module.
-kernel*)	   is_kernel_package=1 ;;
-esac
-
-if ! [ -z "$is_kernel_package" ]; then
-    cat > /dev/null
-    exit 0
-fi
-
-# Check for presence of the commands used
-which /sbin/modinfo >/dev/null || exit 0
-which sed >/dev/null || exit 0
-which sort >/dev/null || exit 0
-
-print_modaliases() {
-    declare class=$1 variants=$2 pos=$3
-    if [ -n "$variants" ]; then
-	echo "${class:0:pos}[$variants]${class:pos+1}"
-    else
-	[ -z "$class" ] || echo "$class"
-    fi
-}
-
-combine_modaliases() {
-    declare tag class variants="" pos="" n
-    read class
-    while read tag; do
-	for ((n=0; n<${#class}; n++)); do
-	    if [ "*" != "${class:n:1}" -a \
-		 "${class:0:n}" = "${tag:0:n}" -a \
-		 "${class:n+1}" = "${tag:n+1}" ] &&
-	       ( [ -z "$pos" ] || [ $n = $pos ] ); then
-		variants="${variants:-${class:n:1}}${tag:n:1}"
-		pos=$n
-		break
-	    fi
-	done
-	if [ $n -eq ${#class} ]; then
-	    print_modaliases "$class" "$variants" "$pos"
-	    variants=
-	    pos=
-	    class=$tag
-	fi
-    done
-    print_modaliases "$class" "$variants" "$pos"
-}
-
-for module in $(grep -E '/lib/modules/.+\.ko(\.gz|\.bz2|\.xz)?$') "$@"; do
-    # | head -n1 because some modules have *two* version tags. *cough*b44*cough*
-    modver=$(/sbin/modinfo -F version "$module"| head -n1)
-    modver=${modver//[^0-9a-zA-Z._]/_}
-    # only add version tag if it has a version
-    [ -z "$modver" ] || modver=" = $modver"
-
-    /sbin/modinfo -F alias "$module" \
-    | sed -nre "s,[^][0-9a-zA-Z._:*?/-],_,g; s,(.+),modalias(\\1)$modver,p"
-done \
-| sort -u \
-| combine_modaliases
--- a/SOURCES/redhat-annobin-plugin-select.sh
+++ b/SOURCES/redhat-annobin-plugin-select.sh
@ -3,7 +3,7 @@
 # should be the destination of the redhat-annobin-cc1 symlink.

 # Author: Nick Clifton  <nickc@redhat.com>
-# Copyright (c) 2021 Red Hat.
+# Copyright (c) 2021-2022 Red Hat.
 #
 # This is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published
--- a/SOURCES/redhat-hardened-cc1
+++ b/SOURCES/redhat-hardened-cc1
@ -1,2 +1,5 @@
 *cc1_options:
 + %{!r:%{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}}
+
+*cpp_options:
+ %{!r:%{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}}
--- a/SOURCES/redhat-hardened-clang.cfg
+++ b/SOURCES/redhat-hardened-clang.cfg
@ -0,0 +1 @@
+-fPIE
--- a/SOURCES/rpmrc
+++ b/SOURCES/rpmrc
@ -3,10 +3,10 @@ include: /usr/lib/rpm/rpmrc
 optflags: i386 %{__global_compiler_flags} -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: i486 %{__global_compiler_flags} -m32 -march=i486 -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: i586 %{__global_compiler_flags} -m32 -march=i586 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
-optflags: i686 %{__global_compiler_flags} -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
+optflags: i686 %{__global_compiler_flags} -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
 optflags: athlon %{__global_compiler_flags} -m32 -march=athlon -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: ia64 %{__global_compiler_flags}
-optflags: x86_64 %{__global_compiler_flags} -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
+optflags: x86_64 %{__global_compiler_flags} -m64 %{__cflags_arch_x86_64} -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection

 optflags: alpha %{__global_compiler_flags} -mieee
 optflags: alphaev5 %{__global_compiler_flags} -mieee -mcpu=ev5
@ -24,12 +24,12 @@ optflags: sparc64v %{__global_compiler_flags} -m64 -mcpu=niagara

 optflags: m68k %{__global_compiler_flags}

-optflags: ppc %{__global_compiler_flags} -m32 -funwind-tables
+optflags: ppc %{__global_compiler_flags} -m32 -fasynchronous-unwind-tables
 optflags: ppciseries %{__global_compiler_flags} -m32
 optflags: ppcpseries %{__global_compiler_flags} -m32
-optflags: ppc64 %{__global_compiler_flags} -m64 -funwind-tables -fstack-clash-protection
-optflags: ppc64p7 %{__global_compiler_flags} -m64 -O3 -mcpu=power7 -mtune=power7 -funwind-tables -fstack-clash-protection
-optflags: ppc64le %{__global_compiler_flags} -m64 -mcpu=power8 -mtune=power8 -funwind-tables -fstack-clash-protection
+optflags: ppc64 %{__global_compiler_flags} -m64 -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: ppc64p7 %{__global_compiler_flags} -m64 -O3 -mcpu=power7 -mtune=power7 -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: ppc64le %{__global_compiler_flags} -m64 %{__cflags_arch_ppc64le} -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: ppc64iseries %{__global_compiler_flags} -m64
 optflags: ppc64pseries %{__global_compiler_flags} -m64
 optflags: ppc8260 %{__global_compiler_flags} -m32
@ -71,12 +71,12 @@ optflags: atariclone %{__global_compiler_flags}
 optflags: milan %{__global_compiler_flags}
 optflags: hades %{__global_compiler_flags}

-optflags: s390 %{__global_compiler_flags} -m31 -march=z13 -mtune=z14 -fasynchronous-unwind-tables
-optflags: s390x %{__global_compiler_flags} -m64 -march=z13 -mtune=z14 -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: s390 %{__global_compiler_flags} -m31 %{__cflags_arch_s390x} -fasynchronous-unwind-tables
+optflags: s390x %{__global_compiler_flags} -m64 %{__cflags_arch_s390x} -fasynchronous-unwind-tables -fstack-clash-protection

-optflags: aarch64 %{__global_compiler_flags} -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: aarch64 %{__global_compiler_flags} -fasynchronous-unwind-tables %[ "%{toolchain}" == "gcc" ? "-fstack-clash-protection" : "" ]

-optflags: riscv64 %{__global_compiler_flags}
+optflags: riscv64 %{__global_compiler_flags} -fasynchronous-unwind-tables %[ "%{toolchain}" == "gcc" ? "-fstack-clash-protection" : "" ]

 # set build arch to fedora buildarches on hardware capable of running it
 # saves having to do rpmbuild --target=
--- a/SOURCES/rpmsort
+++ b/SOURCES/rpmsort
@ -1,76 +0,0 @@
-#! /usr/bin/perl -w
-
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License
-# as published by the Free Software Foundation; either version 2
-# of the License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
-# USA.
-
-use Getopt::Long qw(:config gnu_getopt);
-
-sub rpm_cmp_versions {
-    my ($evr1, $evr2) = @_;
-
-    sub _rpm_cmp {
-	my ($s1, $s2) = @_;
-
-	return defined $s1 <=> defined $s2
-	    unless defined $s1 && defined $s2;
-
-	my ($r, $x1, $x2);
-	do {
-	    $s1 =~ s/^[^a-zA-Z0-9]+//;
-	    $s2 =~ s/^[^a-zA-Z0-9]+//;
-	    if ($s1 =~ /^\d/ || $s2 =~ /^\d/) {
-		$s1 =~ s/^0*(\d*)//;  $x1 = $1;
-		$s2 =~ s/^0*(\d*)//;  $x2 = $1;
-		$r = length $x1 <=> length $x2 || $x1 cmp $x2;
-	    } else {
-		$s1 =~ s/^([a-zA-Z]*)//;  $x1 = $1;
-		$s2 =~ s/^([a-zA-Z]*)//;  $x2 = $1;
-		return 0
-		    if $x1 eq '' && $x2 eq '';
-		$r = $x1 cmp $x2;
-	    }
-	} until $r;
-	return $r;
-    }
-
-    my ($e1, $v1, $r1) = $evr1 =~ /^(?:(\d*):)?(.*?)(?:-([^-]*))?$/;
-    my ($e2, $v2, $r2) = $evr2 =~ /^(?:(\d*):)?(.*?)(?:-([^-]*))?$/;
-    my $r = _rpm_cmp($e1 || 0, $e2 || 0);
-    $r = _rpm_cmp($v1, $v2)
-	unless $r;
-    $r = _rpm_cmp($r1, $r2)
-	unless $r;
-    return $r;
-}
-
-my $reorder = sub { return @_ };
-my $key = 0;
-
-GetOptions ("r|reverse"	    => sub { $reorder = sub { return reverse @_ } },
-	    "k|key=i"	    => \$key)
-or do {
-    print STDERR "Usage\n";
-    exit 1;
-};
-
-if ($key == 0) {
-    # Sort by entire lines
-    map { print } &$reorder(sort { rpm_cmp_versions($a, $b) } <>);
-} else {
-    # Sort by field $key
-    my @data = map { [(split)[$key-1], $_] } <>;
-    map { print } &$reorder(map { $_->[1] }
-        sort { rpm_cmp_versions($a->[0], $b->[0]) } @data);
-}
--- a/SOURCES/symset-table
+++ b/SOURCES/symset-table
@ -1,40 +0,0 @@
-#! /bin/sh
-
-# Create a table of all symbol sets defined in all /boot/symsets*.tar.gz
-# files.
-#
-# Format:
-#   kernelrelease/modver/symbol <tab> symset <tab> symset_hash
-#
-# This table is needed for computing the appropriate Requires: tags for
-# kernel module packages.
-
-tmpdir=$(mktemp -t -d ${0##*/}.XXXXXX)
-trap "cd / ; rm -rf $tmpdir" EXIT
-cd $tmpdir
-
-shopt -s nullglob
-for symsets in /boot/symsets-*.tar.gz; do
-    zcat $symsets \
-    | tar xf -
-done
-
-for symsets in /usr/src/kernels/*/symsets-*.tar.gz; do
-    zcat $symsets \
-    | tar xf -
-done
-
-for symsets in *; do
-    krel=${symsets#symsets-}
-    for symset in $symsets/*; do
-	class=${symset##*/} ; class=${class%.*}
-	hash=${symset##*.}
-	awk '
-	BEGIN { FS = "\t" ; OFS = "\t" }
-	{ sub(/0x0*/, "", $1)
-	  print krel "/" $1 "/" $2, class, hash }
-	' krel="$krel" class="$class" hash="$hash" $symset
-    done
-done
-
-# vim:shiftwidth=4 softtabstop=4
--- a/SPECS/redhat-rpm-config.spec
+++ b/SPECS/redhat-rpm-config.spec
@ -6,30 +6,26 @@

 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
-Version: 131
-Release: 1%{?dist}
+Version: 208
+Release: 1%{?dist}.alma.1
 # No version specified.
 License: GPL+
-Group: Development/System
 URL: https://src.fedoraproject.org/rpms/redhat-rpm-config

 # Core rpm settings
 Source0: macros
 Source1: rpmrc

-# kabi provides generator
-Source20: kabi.attr
-Source21: kabi.sh
-
 # gcc specs files for hardened builds
 Source50: redhat-hardened-cc1
 Source51: redhat-hardened-ld
+Source52: redhat-hardened-clang.cfg

 # gcc specs files for annobin builds
-Source52: redhat-annobin-cc1
-Source53: redhat-annobin-select-gcc-built-plugin
-Source54: redhat-annobin-select-annobin-built-plugin
-Source55: redhat-annobin-plugin-select.sh
+Source60: redhat-annobin-cc1
+Source61: redhat-annobin-select-gcc-built-plugin
+Source62: redhat-annobin-select-annobin-built-plugin
+Source63: redhat-annobin-plugin-select.sh

 # The macros defined by these files are for things that need to be defined
 # at srpm creation time when it is not feasible to require the base packages
@ -44,12 +40,10 @@ Source105: macros.valgrind-srpm

 # Other misc macros
 Source150: macros.dwz
-Source151: macros.kmp
 Source152: macros.vpath
 Source153: macros.forge
 Source154: macros.ldconfig
-Source155: macros.kernel-srpm
-Source156: macros.fedora-misc
+Source155: macros.fedora-misc

 # Build policy scripts
 # this comes from https://github.com/rpm-software-management/rpm/pull/344
@ -57,19 +51,23 @@ Source156: macros.fedora-misc
 # and an echo when the mangling happens
 Source201: brp-mangle-shebangs

+# this comes from rpm itself
+# however, now we can do Fedora changes within
+Source202: brp-python-bytecompile
+
+# for fixing pyc files reproducibility with marshalparser
+# https://github.com/fedora-python/marshalparser
+Source203: brp-fix-pyc-reproducibility
+
+# for converting llvm LTO bitcode objects into ELF
+Source204: brp-llvm-compile-lto-elf
+
 # Dependency generator scripts (deprecated)
 Source300: find-provides
-Source301: find-provides.ksyms
 Source304: find-requires
-Source305: find-requires.ksyms
-Source308: firmware.prov
-Source309: modalias.prov

 # Misc helper scripts
 Source400: dist.sh
-Source401: rpmsort
-Source402: symset-table
-Source403: kmodtool
 Source404: gpgverify

 # 2016-10-02 snapshots from http://git.savannah.gnu.org/gitweb/?p=config.git
@ -77,14 +75,15 @@ Source500: config.guess
 Source501: config.sub

 # Dependency generators & their rules
-Source600: kmod.attr
-Source601: kmod.prov
 Source602: libsymlink.attr

 # BRPs
 Source700: brp-ldconfig
-Source701: brp-kmod-set-exec-bit
-Source702: brp-kmod-restore-perms
+Source701: brp-strip-lto
+
+# Convenience lua functions
+Source800: common.lua
+Source801: forge.lua

 # Documentation
 Source900: buildflags.md
@ -94,20 +93,31 @@ BuildRequires: perl-generators
 Requires: coreutils

 Requires: efi-srpm-macros
+Requires: fonts-srpm-macros
 Requires: ghc-srpm-macros
 Requires: go-srpm-macros
+# ↓ Provides kmod.attr originally shipped by us
+Requires: kernel-srpm-macros >= 1.0-6
+Requires: lua-srpm-macros
 Requires: ocaml-srpm-macros
 Requires: openblas-srpm-macros
 Requires: perl-srpm-macros
-Requires: python-srpm-macros
-Requires: python3-rpm-macros
-Requires: rust-srpm-macros
+# ↓ Provides compileall2 Python module
+Requires: python-srpm-macros >= 3-46
 Requires: qt5-srpm-macros
+Requires: rust-srpm-macros
+Requires: pyproject-srpm-macros
+
+%if ! 0%{?rhel}
+Requires: fpc-srpm-macros
+Requires: gnat-srpm-macros
+Requires: nim-srpm-macros
+%endif

 Requires: rpm >= 4.11.0
 Requires: dwz >= 0.4
 Requires: zip
-Requires: (annobin if gcc)
+Requires: (annobin if (gcc or clang))
 Requires: (gcc-plugin-annobin if gcc)

 # for brp-mangle-shebangs
@ -117,13 +127,12 @@ Requires: %{_bindir}/grep
 Requires: %{_bindir}/sed
 Requires: %{_bindir}/xargs

-# iconv modules have been split out of glibc into a separate package (#1971664)
-# so let's ensure packages that require them at build time but haven't yet
-# added an explicit BuildRequires will continue to work (#2013328)
-Requires: glibc-gconv-extra
+# for brp-llvm-compile-lto-elf
+Requires: (llvm if clang)
+Requires: (gawk if clang)

 # -fstack-clash-protection and -fcf-protection require GCC 8.
-Conflicts: gcc < 8
+Conflicts: gcc < 8.0.1-0.22

 Provides: system-rpm-config = %{version}-%{release}

@ -132,16 +141,6 @@ Provides: system-rpm-config = %{version}-%{release}
 %description
 Red Hat specific rpm configuration files.

-%package -n kernel-rpm-macros
-Summary: Macros and scripts for building kernel module packages.
-Requires: redhat-rpm-config >= 13
-
-# for brp-kmod-set-exec-bit
-Requires: %{_bindir}/find
-
-%description -n kernel-rpm-macros
-Macros and scripts for building kernel module packages.
-
 %prep
 # Not strictly necessary but allows working on file names instead
 # of source numbers in install section
@ -154,13 +153,12 @@ install -p -m 644 -t %{buildroot}%{rrcdir} macros rpmrc
 install -p -m 444 -t %{buildroot}%{rrcdir} redhat-hardened-*
 install -p -m 444 -t %{buildroot}%{rrcdir} redhat-annobin-*
 install -p -m 755 -t %{buildroot}%{rrcdir} config.*
-install -p -m 755 -t %{buildroot}%{rrcdir} dist.sh rpmsort symset-table kmodtool
+install -p -m 755 -t %{buildroot}%{rrcdir} dist.sh
 install -p -m 755 -t %{buildroot}%{rrcdir} gpgverify
 install -p -m 755 -t %{buildroot}%{rrcdir} brp-*

 install -p -m 755 -t %{buildroot}%{rrcdir} find-*
 mkdir -p %{buildroot}%{rrcdir}/find-provides.d
-install -p -m 755 -t %{buildroot}%{rrcdir}/find-provides.d firmware.prov modalias.prov

 install -p -m 755 -t %{buildroot}%{rrcdir} brp-*

@ -169,10 +167,10 @@ install -p -m 644 -t %{buildroot}%{_rpmconfigdir}/macros.d macros.*

 mkdir -p %{buildroot}%{_fileattrsdir}
 install -p -m 644 -t %{buildroot}%{_fileattrsdir} *.attr
-install -p -m 755 -t %{buildroot}%{_rpmconfigdir} kmod.prov

-install -p -m 644 %{SOURCE20} %{buildroot}%{_fileattrsdir}/kabi.attr
-install -p -m 755 %{SOURCE21} %{buildroot}%{_rpmconfigdir}/kabi.sh
+mkdir -p %{buildroot}%{_rpmluadir}/fedora/{rpm,srpm}
+install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora common.lua
+install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora/srpm forge.lua

 # This trigger is used to decide which version of the annobin plugin for gcc
 # should be used.  See comments in the script for full details.
@ -226,8 +224,7 @@ install -p -m 755 %{SOURCE21} %{buildroot}%{_rpmconfigdir}/kabi.sh
 %dir %{rrcdir}
 %{rrcdir}/macros
 %{rrcdir}/rpmrc
-%{rrcdir}/brp-mangle-shebangs
-%{rrcdir}/brp-ldconfig
+%{rrcdir}/brp-*
 %{rrcdir}/dist.sh
 %{rrcdir}/gpgverify
 %{rrcdir}/redhat-hardened-*
@ -237,15 +234,17 @@ install -p -m 755 %{SOURCE21} %{buildroot}%{_rpmconfigdir}/kabi.sh
 %{rrcdir}/find-requires
 %{rrcdir}/brp-ldconfig
 %{_fileattrsdir}/*.attr
-%{_rpmconfigdir}/kmod.prov
 %{_rpmconfigdir}/macros.d/macros.*-srpm
 %{_rpmconfigdir}/macros.d/macros.dwz
 %{_rpmconfigdir}/macros.d/macros.forge
 %{_rpmconfigdir}/macros.d/macros.ldconfig
 %{_rpmconfigdir}/macros.d/macros.vpath
-%{_rpmconfigdir}/macros.d/macros.kernel-srpm
 %{_rpmconfigdir}/macros.d/macros.fedora-misc
-%{_rpmconfigdir}/kabi.sh
+%dir %{_rpmluadir}/fedora
+%dir %{_rpmluadir}/fedora/srpm
+%dir %{_rpmluadir}/fedora/rpm
+%{_rpmluadir}/fedora/*.lua
+%{_rpmluadir}/fedora/srpm/*lua

 %attr(0755,-,-) %{rrcdir}/redhat-annobin-plugin-select.sh
 %verify(owner group mode) %{rrcdir}/redhat-annobin-cc1
@ -254,129 +253,356 @@ install -p -m 755 %{SOURCE21} %{buildroot}%{_rpmconfigdir}/kabi.sh

 %doc buildflags.md

-%files -n kernel-rpm-macros
-%dir %{rrcdir}/find-provides.d
-%{rrcdir}/brp-kmod-set-exec-bit
-%{rrcdir}/brp-kmod-restore-perms
-%{rrcdir}/kmodtool
-%{rrcdir}/rpmsort
-%{rrcdir}/symset-table
-%{rrcdir}/find-provides.ksyms
-%{rrcdir}/find-requires.ksyms
-%{rrcdir}/find-provides.d/firmware.prov
-%{rrcdir}/find-provides.d/modalias.prov
-%{_rpmconfigdir}/macros.d/macros.kmp
-
 %changelog
-* Wed Feb 08 2023 Nick Clifton  <nickc@redhat.com> - 131-1
- Fix triggers for the installation and removal of gcc-plugin-annobin.  (#2168233)
+* Mon Sep 30 2024 Eduard Abdullin <eabdullin@almalinux.org> - 208-1.alma.1
+- Fix AlmaLinux detection

-* Tue Apr 05 2022 Nick Clifton <nickc@redhat.com> = 130-1
+* Fri Jul 19 2024 Michal Domonkos <mdomonko@redhat.com> - 208-1
+- brp-mangle-shebangs: Strip env flags when mangling shebangs (RHEL-26961)
+- Fix automatic soname requires on non-versioned symlink targets (RHEL-28767)
+* Thu Jan 18 2024 Miro Hrončok <mhroncok@redhat.com> - 207-1
+- brp-python-bytecompile: Pass --invalidation-mode=timestamp to compileall
+- Resolves: RHEL-22139
+
+* Mon Oct 02 2023 Nikita Popov <npopov@redhat.com> - 206-1
+- Use correct format specifier in brp-llvm-compile-lto-elf
+
+* Fri Sep 29 2023 Nikita Popov <npopov@redhat.com> - 205-1
+- Fix the fix for brp-llvm-compile-lto-elf
+
+* Tue Sep 26 2023 Florian Weimer <fweimer@redhat.com> - 204-1
+- Enable PIC mode for assembler files (RHEL-6298)
+
+* Wed Sep 13 2023 Florian Weimer <fweimer@redhat.com> - 203-1
+- Rebuild against more recent downstream branch (#2234024)
+
+* Fri Aug 25 2023 Nikita Popov <npopov@redhat.com> - 202-1
+- Fix brp-llvm-compile-lto-elf parallelism with hardlinks
+- Resolves: rhbz#2234024
+
+* Mon May 08 2023 Nikita Popov <npopov@redhat.com> - 201-1
+- Add llvm dependency if clang toolchain used
+- Resolves: rhbz#2193406
+
+* Wed Apr 19 2023 Nikita Popov <npopov@redhat.com> - 200-1
+- Change clang LTO default to ThinLTO
+- Resolves: rhbz#2178788
+
+* Mon Feb 13 2023 Miro Hrončok <mhroncok@redhat.com> - 199-1
+- Add pyproject-srpm-macros to the default buildroot
+- Related: rhbz#2168193
+
+* Tue Feb 07 2023 Nick Clifton  <nickc@redhat.com> - 198-1
+- Fix triggers for the installation and removal of gcc-plugin-annobin.  (#2167713)
+
+* Wed Sep 21 2022 Timm Bäder <tbaeder@redhat.com> - 197-1
+- Ship brp-llvm-compile-lto-elf script
+
+* Mon Jun 27 2022 Nick Clifton  <nickc@redhat.com> - 196-1
+- Pass "--remove section .gnu.build.attributes" to the find-debuginfo script.
+- Resolves: rhbz#2099613
+
+* Wed Jun 15 2022 Florian Festi <ffesti@redhat.com> - 195-1
+- Detect compressed kernel modules
+- Resolves: rhbz#2008544
+
+* Thu Feb 17 2022 Nick Clifton  <nickc@redhat.com> - 194-1
+- Use the correct package names for the triggers.
+- Resolves: rhbz#2030671
+
+* Tue Feb 15 2022 Nick Clifton  <nickc@redhat.com> - 193-1
+- Fix bugs in plugin selection script.
+- Resolves: rhbz#2030671
+
+* Tue Feb 01 2022 Nick Clifton  <nickc@redhat.com> - 192-1
 - Select between gcc-built and annobin-built versions of the annobin plugin.
-  (#2067153)
+- Resolves: rhbz#2030671

-* Wed Mar 23 2022 Michal Domonkos <mdomonko@redhat.com> - 129-1
- Fix handling of files without newlines in brp-mangle-shebang (#2063036)
+* Wed Dec 08 2021 Miro Hrončok <mhroncok@redhat.com> - 191-1
+- brp-mangle-shebangs: also mangle shebangs of JavaScript executables
+- Resolves: rhbz#2030427

-* Wed Jan 05 2022 Eugene Syromiatnikov <esyr@redhat.com> - 128-1
- modalias.prov: handle compressed kmods, sanitise alias/version strings
-  (#1976000)
+* Thu Dec 02 2021 Neal Gompa <ngompa@centosproject.org> - 190-1
+- Make vpath builddir not include arch-specific info
+  Resolves: rhbz#1984679

-* Mon Dec 13 2021 Michal Domonkos <mdomonko@redhat.com> - 127-1
- Add Requires: glibc-gconv-extras to cover for the split (#2013328)
+* Tue Nov 16 2021 Florian Weimer <fweimer@redhat.com> - 189-1
+- buildflags.md: Documentation updates (#2005080)

-* Mon Nov 29 2021 Florian Weimer <fweimer@redhat.com> - 126-1
- buildflags.md: Documentation updates (#2005079)
+* Tue Aug 24 2021 Florian Weimer <fweimer@redhat.com> - 188-1
+- redhat-rpm-config: Enable x86-64-v2 baseline for Clang/LLVM (#1890170)

-* Fri Nov 27 2020 Florian Festi <ffesti@redhat.com> - 125-1
- Add missing macros.fedora-misc file (#1874576)
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 187-2
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688

-* Mon Nov 09 2020 Florian Festi <ffesti@redhat.com> - 124-1
- Add macros.kernel-srpm (#1874578)
- Added gpgverify (#1874576)
+* Fri Jul 30 2021 Florian Weimer <fweimer@redhat.com> - 187-1
+- Active GCC plugin during LTO linking (#1983727)

-* Tue Jun 16 2020 Florian Festi <ffesti@redhat.com> - 123-1
- Update kmod.prov for better performance (#1794491)
- Backport performance improvements for brp-mangle-shebangs (#1794779)
+* Thu Jul 22 2021 Florian Weimer <fweimer@redhat.com> - 186-1
+- aarch64: Do not build with -mbranch-protection=standard (#1984652)

-* Mon Feb 24 2020 Michal Domonkos <mdomonko@redhat.com> - 122-1
- Fix argument shift in %%__brp_python_bytecompile (#1724567)
+* Tue May 25 2021 Michal Domonkos <mdomonko@redhat.com> - 185-3
+- Bump release for a rebuild in a sidetag

-* Tue Nov 26 2019 Eugene Syromiatnikov <esyr@redhat.com> - 121-1
- macros.kmp: add post-install hooks for kmod processing (#1664478, #1673200)
+* Wed May 12 2021 Michal Domonkos <mdomonko@redhat.com> - 185-1
+- Drop kernel-rpm-macros subpackage & kmod.attr
+- Resolves: #1959924

-* Thu Jul 04 2019 Florian Festi <ffesti@redhat.com> - 120-1
- Fix permission for various build scripts (#1719363)
+* Wed Apr 21 2021 Michal Domonkos <mdomonko@redhat.com> - 184-1
+- Drop {fpc,gnat,nim}-srpm-macros dependencies on RHEL

-* Tue Jun 04 2019 Florian Festi <ffesti@redhat.com> - 119-1
- Remove -eu param from shell scripts (#1686413)
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 183-2
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

-* Mon May 20 2019 Florian Weimer <fweimer@redhat.com> - 118-1
- Build flags: Add support for extension builders (#1661186)
+* Thu Apr 15 2021 Florian Weimer <fweimer@redhat.com> - 183-1
+- ppc64le: Update ISA baseline to POWER9 (#1876584)
+- s390x: Update ISA baseline to z14 (#1876479)

-* Wed Apr 17 2019 Panu Matilainen <pmatilai@redhat.com> - 117-1
- Add s390x to valgrind supported architectures (#1659106)
+* Mon Mar 22 2021 Lumír Balhar <lbalhar@redhat.com> - 182-1
+- Fix handling of files without newlines in brp-mangle-shebang

-* Wed Feb 06 2019 Eugene Syromiatnikov <esyr@redhat.com> - 116-1
- Forward-port RHEL-specific kmodtool/macros.kmp changes from RHEL 7,
-  update kmodtool script for RHEL 8 (#1658414, #1666162)
+* Wed Mar 10 2021 Kalev Lember <klember@redhat.com> - 181-1
+- BRP Python Bytecompile: Avoid hardcoding /usr/bin prefix for python

-* Sat Sep 15 2018 Eugene Syromiatnikov <esyr@redhat.com> - 115-1
- Revert back to usage of join in find-requires.ksym:mod_requires()
-  as generated "Requires:" and "Provides:" lists have different format
-  and unsuitable for processing with comm (#1622016)
+* Tue Jan 19 2021 Florian Weimer <fweimer@redhat.com> - 180-1
+- Use -march=x86-64-v2 only for the gcc toolchain

-* Fri Aug 24 2018 Eugene Syromiatnikov <esyr@redhat.com> - 114-1
- Add support for compressed kernel modules to find-provides,
-  find-provides.ksyms, find-requires, find-requires.ksyms, firmware.prov
-  (#1622019)
+* Tue Jan 19 2021 Florian Weimer <fweimer@redhat.com> - 179-1
+- x86_64: Enable -march=x86-64-v2 for ELN, following GCC.

-* Mon Aug 20 2018 Eugene Syromiatnikov <esyr@redhat.com> - 113-1
- Fix generation for kernel module symbol version dependencies for the case
-  when module depends on the symbol with the same name as one present in kernel
-  but a different version (#1622016)
+* Sun Nov 29 2020 Miro Hrončok <mhroncok@redhat.com> - 178-1
+- BRP Python Bytecompile: Also detect Python files in /app/lib/pythonX.Y

-* Mon Aug 13 2018 Eugene Syromiatnikov <esyr@redhat.com> - 112-1
- Re-instantiate support for old symvers path (#1571186)
+* Tue Oct 27 2020 Tom Stellard <tstellar@redhat.com> - 177-1
+- Add back -fcf-protection flag for x86_64

-* Mon Aug 13 2018 Eugene Syromiatnikov <esyr@redhat.com> - 111-1
- Add dependency generator for kABI provides (#1571186)
+* Tue Oct 20 2020 Florian Weimer <fweimer@redhat.com> - 176-1
+- s390x: Tune for z14 (as in Red Hat Enterprise Linux 8)

-* Thu Aug  9 2018 Marek Polacek <polacek@redhat.com> - 110-1
- Use -march=z13 -mtune=z14 for s390{,x} (#1573944)
- Drop s390x from %%{valgrind_arches}
+* Mon Oct  5 2020 Florian Weimer <fweimer@redhat.com> - 175-1
+- s390x: Switch Fedora ELN to z13 baseline

-* Mon Jul 23 2018 Peter Jones <pjones@redhat.com> - 109-1
- Add Requires: efi-srpm-macros for %%{efi}
+* Fri Sep 11 2020 Miro Hrončok <mhroncok@redhat.com> - 172-1
+- Filter out LTO flags from %%extension flags macros
+- Fixes: rhbz#1877652
+
+* Wed Sep  2 2020 Michel Alexandre Salim <salimma@fedoraproject.org> - 171-1
+- Add Requires: lua-srpm-macros
+
+* Fri Aug 21 2020 Tom Stellard <tstellar@redhat.com> - 170-1
+- Enable -fstack-clash-protection for clang on x86, s390x, and ppc64le
+
+* Thu Aug 20 2020 Tom Stellard <tstellar@redhat.com> - 169-1
+- Add -flto to ldflags for clang toolchain
+
+* Thu Aug 20 2020 Neal Gompa <ngompa13@gmail.com> - 168-1
+- Fix CC/CXX exports so arguments are included in exported variable
+- Allow overrides of CC/CXX like CFLAGS and CXXFLAGS from shell variables
+
+* Mon Aug 03 2020 Troy Dawson <tdawson@redhat.com> - 167-1
+- Add Requires: kernel-srpm-macros
+
+* Thu Jul 30 2020 Jeff Law <law@redhat.com> - 166-1
+- Use -flto=auto for GCC to speed up builds
+
+* Tue Jul 28 2020 Tom Stellard <tstellar@redhat.com> - 165-1
+- Only use supported lto flags for clang toolchain
+
+* Thu Jul 23 2020 Lumír Balhar <lbalhar@redhat.com> - 164-1
+- Disable Python hash seed randomization in brp-python-bytecompile
+
+* Tue Jul 21 2020 Jeff Law <law@redhat.com> - 163-1
+- Enable LTO by default
+
+* Thu Jul 16 2020 Lumír Balhar <lbalhar@redhat.com> - 162-1
+- New script brp-fix-pyc-reproducibility
+
+* Tue Jun 16 2020 Lumír Balhar <lbalhar@redhat.com> - 161-2
+- Use stdlib compileall for Python >= 3.9
+
+* Mon Jun 15 2020 Lumír Balhar <lbalhar@redhat.com> - 161-1
+- No more automagic Python bytecompilation (phase 3)
+  https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation_phase_3
+
+* Thu Jun 04 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 160-1
+- Fix broken %%configure
+
+* Wed Jun 03 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 159-1
+- Fixes for new_package macro
+
+* Wed Jun 03 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 158-1
+- Add option to choose C/C++ toolchain
+
+* Sat May 30 2020 Jeff Law <law@redhat.com> - 157-1
+- When LTO is enabled, fix broken configure files.
+
+* Sat May 30 2020 Nicolas Mailhot <nim@fedoraproject.org> - 156-1
+- Add new_package macro and associated lua framework.
+
+* Sat May 23 2020 Nicolas Mailhot <nim@fedoraproject.org> - 155-1
+- forge: add gitea support
+
+* Thu Apr 09 2020 Panu Matilainen <pmatilai@redhat.com> - 154-1
+- Optimize kernel module provides by using a parametric generator
+
+* Thu Feb 20 2020 Jason L Tibbitts III <tibbs@math.uh.edu> - 153-1
+- Add dependency on fonts-srpm-macros, as those have now been approved by FPC.
+
+* Thu Feb 20 2020 Jeff Law <law@redhat.com> - 152-1
+- Use eu-elfclassify to only run strip on ELF relocatables
+  and archive libraries.
+
+* Fri Feb 14 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 151-1
+- Fixup parallel algorithm for brp-strip-lto
+
+* Fri Feb 14 2020 Jeff Law <law@redhat.com> - 150-1
+- Strip LTO sections/symbols from installed .o/.a files
+
+* Thu Jan 23 2020 Jeff Law <law@redhat.com> - 149-1
+- Allow conditionally adding -fcommon to CFLAGS by defining %%_legacy_common_support
+
+* Mon Jan 20 2020 Florian Weimer <fweimer@redhat.com> - 148-1
+- Reenable annobin after GCC 10 integration (#1792892)
+
+* Mon Jan 20 2020 Florian Weimer <fweimer@redhat.com> - 147-1
+- Temporarily disable annobin for GCC 10 (#1792892)
+
+* Thu Dec 05 2019 Denys Vlasenko <dvlasenk@redhat.com> - 146-1
+- kmod.prov: fix and speed it up
+
+* Tue Dec 03 15:48:18 CET 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 145-1
+- %%set_build_flags: define LT_SYS_LIBRARY_PATH
+
+* Thu Nov 21 2019 Denys Vlasenko <dvlasenk@redhat.com> - 144-1
+- Speed up brp-mangle-shebangs.
+
+* Tue Nov 05 2019 Lumír Balhar <lbalhar@redhat.com> - 143-1
+- Fix brp-python-bytecompile with the new features from compileall2
+- Resolves: rhbz#1595265
+
+* Fri Nov 01 2019 Miro Hrončok <mhroncok@redhat.com> - 142-1
+- Fix the simple API of %%gpgverify.
+
+* Thu Aug 22 2019 Jason L Tibbitts III <tibbs@math.uh.edu> - 141-2
+- Simplify the API of %%gpgverify.
+
+* Thu Jul 25 2019 Richard W.M. Jones <rjones@redhat.com> - 140-2
+- Bump version and rebuild.
+
+* Sat Jul 20 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 140-1
+- Fixup python-srpm-macros version
+
+* Wed Jul 17 2019 Lumír Balhar <lbalhar@redhat.com> - 139-1
+- Use compileall2 Python module for byte-compilation in brp-python-bytecompile
+
+* Tue Jul 09 2019 Miro Hrončok <mhroncok@redhat.com> - 138-1
+- Move brp-python-bytecompile from rpm, so we can easily adapt it
+
+* Mon Jul 08 2019 Nicolas Mailhot <nim@fedoraproject.org> - 137-1
+- listfiles: make it robust against all kinds of “interesting” inputs
+- wordwrap: make list indenting smarter, to produce something with enough
+  structure that it can be converted into AppStream metadata
+
+* Mon Jul 08 2019 Robert-André Mauchin <zebob.m@gmail.com> - 136-1
+- Revert "Fix expansion in listfiles_exclude/listfiles_include"
+
+* Mon Jul 08 2019 Nicolas Mailhot <nim@fedoraproject.org> - 135-1
+- Fix expansion in listfiles_exclude/listfiles_include
+
+* Mon Jul 01 2019 Florian Festi <ffesti@redhat.com> - 134-1
+- Switch binary payload compression to Zstandard level 19
+
+* Thu Jun 27 2019 Vít Ondruch <vondruch@redhat.com> - 133-2
+- Enable RPM to set SOURCE_DATE_EPOCH environment variable.
+
+* Tue Jun 25 08:13:50 CEST 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 133-1
+- Expand listfiles_exclude/listfiles_include
+
+* Tue Jun 11 2019 Jitka Plesnikova <jplesnik@redhat.com> - 132-1
+- Remove perl macro refugees
+
+* Mon Jun 10 2019 Panu Matilainen <pmatilai@redhat.com> - 131-1
+- Provide temporary shelter for rpm 4.15 perl macro refugees
+
+* Tue Jun 04 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 130-1
+- New macro for wrapping text — %%wordwrap
+- Smal fix for %%listfiles with no arguments
+
+* Thu May 30 2019 Björn Persson <Bjorn@Rombobjörn.se> - 129-1
+- Added gpgverify.
+
+* Tue Jan 15 2019 Panu Matilainen <pmatilai@redhat.com> - 128-1
+- Drop redundant _smp_mflag re-definition, use the one from rpm instead
+
+* Thu Dec 20 2018 Florian Weimer <fweimer@redhat.com> - 127-1
+- Build flags: Add support for extension builders (#1543394)
+
+* Mon Dec 17 2018 Panu Matilainen <pmatilai@redhat.com> - 126-1
+- Silence the annoying warning from ldconfig brp-script (#1540971)
+
+* Thu Nov 15 2018 Miro Hrončok <mhroncok@redhat.com> - 125-1
+- Make automagic Python bytecompilation optional
+  https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation_phase_2
+
+* Thu Nov 08 2018 Jason L Tibbitts III <tibbs@math.uh.edu> - 124-1
+- forge: add more distprefix cleaning (bz1646724)
+
+* Mon Oct 22 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 123-1
+- Add -q option to %%forgesetup
+
+* Sat Oct 20 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 122-1
+- Allow multiple calls to forge macros
+
+* Thu Oct 11 2018 Jan Pazdziora <jpazdziora@redhat.com> - 121-1
+- Add %_swidtagdir for directory for SWID tag files describing the
+  installation.
+
+* Mon Sep 10 2018 Miro Hrončok <mhroncok@redhat.com> - 120-1
+- Make ambiguous python shebangs error
+  https://fedoraproject.org/wiki/Changes/Make_ambiguous_python_shebangs_error
+
+* Mon Aug 20 2018 Kalev Lember <klember@redhat.com> - 119-1
+- Add aarch64 to ldc arches
+
+* Wed Aug 15 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 118-1
+- Enable --as-needed by default
+
+* Mon Jul 16 2018 Miro Hrončok <mhroncok@redhat.com> - 117-1
+- Mangle /bin shebnags to /usr/bin ones (#1581757)
+
+* Tue Jul 10 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 116-1
+- Add option to add -Wl,--as-needed into LDFLAGS
+
+* Mon Jul 09 2018 Kalev Lember <klember@redhat.com> - 115-1
+- Disable non-functional ppc64 support for ldc packages
+
+* Tue Jun 26 2018 Panu Matilainen <pmatilai@redhat.com> - 114-1
+- Fix kernel ABI related strings (Peter Oros, #26)
+- Automatically trim changelog to two years (Zbigniew Jędrzejewski-Szmek, #22)
+- Cosmetics cleanups (Zbigniew Jędrzejewski-Szmek, #22)
+
+* Mon Jun 18 2018 Florian Weimer <fweimer@redhat.com> - 113-1
+- Build flags: Require SSE2 on i686 (#1592212)
+
+* Mon May 28 2018 Miro Hrončok <mhroncok@redhat.com> - 112-1
+- Add a possibility to opt-out form automagic Python bytecompilation
+  https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation
+
+* Wed May 02 2018 Peter Jones <pjones@redhat.com> - 111-1
 - brp-mangle-shebangs: add %%{__brp_mangle_shebangs_exclude_file} and
  %%{__brp_mangle_shebangs_exclude_from_file} to allow you to specify files
  containing the shebangs to be ignore and files to be ignored regexps,
  respectively, so that they can be generated during the package build.

-* Mon Jul 09 2018 Tomas Orsava <torsava@redhat.com> - 108-1
- Impement changing python3 shebangs in brp-mangle-shebangs
- Added a dependency on python3-rpm-macros
+* Wed May  2 2018 Florian Weimer <fweimer@redhat.com> - 110-1
+- Reflect -fasynchronous-unwind-tables GCC default on POWER (#1550914)

-* Tue Jul 03 2018 Tomas Orsava <torsava@redhat.com> - 107.3-3.1
- Bump release
+* Wed May  2 2018 Florian Weimer <fweimer@redhat.com> - 109-1
+- Use plain -fcf-protection compiler flag, without -mcet (#1570823)

-* Thu Jun 28 2018 Tomas Orsava <torsava@redhat.com> - 107.3-3
- The brp-python-bytecompile script no longer accepts two arguments, as the
-  first argument has been obsoleted
- Modified the definition of %%__brp_python_bytecompile to match the new scheme
-
-* Thu Jun 28 2018 Florian Festi <ffesti@redhat.com> - 107.3-2
- Replace find-provides.ksyms and find-requires.ksyms by RHEL 7.6 versions (#1571186)
-
-* Thu Jun 07 2018 Florian Festi <ffesti@redhat.com> - 107.3-1
- Remove dependencies to fpc-srpm-macros, gnat-srpm-macros and nim-srpm-macros
-
-* Fri Jun  1 2018 Florian Weimer <fweimer@redhat.com> - 107.2-1
- i686: Build with -mstackrealign (#1478332)
- Update documentation for i686 build flags (#1554855)
-
-* Fri May  4 2018 Florian Weimer <fweimer@redhat.com> - 107.1-1
- Use plain -fcf-protection compiler flag, without -mcet (#1574937)
+* Tue May 01 2018 Peter Jones <pjones@redhat.com> - 108-1
+- Add Requires: efi-srpm-macros for %%{efi}

 * Fri Apr 20 2018 Jason L Tibbitts III <tibbs@math.uh.edu> - 107-1
 - Add %%_metainfodir macro.