[rpms/prrte] rawhide: Fix loss of hardening flags (including CET) in some MCA components

[Michal Schmidt <mschmidt@redhat.com>]

            A new commit has been pushed.

            Repo   : rpms/prrte
            Branch : rawhide
            Commit : 21755b421487ae05b50350441013b6a3011f5260
            Author : Michal Schmidt <mschmidt@redhat.com>
            Date   : 2026-09-14T10:02:28+02:00
            Stats  : +77/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/prrte/c/21755b421487ae05b50350441013b6a3011f5260?branch=rawhide

            Log:
            Fix loss of hardening flags (including CET) in some MCA components

src/util/hostfile/Makefile.am and src/mca/rmaps/rank_file/Makefile.am
reset CFLAGS to avoid picky warnings on flex-generated code, but
reference variables that are never AC_SUBST'ed (one of them doesn't
even exist upstream), so CFLAGS silently becomes empty for those
files. This drops all hardening flags there, and since the resulting
objects lack a CET .note.gnu.property, the linker strips CET from
the whole of libprrte.so.

Carries a fix submitted upstream as
https://github.com/openpmix/prrte/pull/2776

Ralph Castain appreciated the PR, but he decided to solve the bug with a
more extensive rework of the parser instead. He removed the use of flex
entirely. The rework consists of 11 commits in the range:
f9ee7c5d57b8..cfc373e95c83
He also backported it to the "v5.0" branch. It's probably not going to
be backported to older branches, so let's use my minimal fix for
Fedora.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---
diff --git a/prrte-fix-cflags-before-picky.patch b/prrte-fix-cflags-before-picky.patch
new file mode 100644
index 0000000..c4fc8f8
--- /dev/null
+++ b/prrte-fix-cflags-before-picky.patch
@@ -0,0 +1,64 @@
+From 1f3646ad28a8ac98b57120999d3967ad8c82f7ef Mon Sep 17 00:00:00 2001
+From: Michal Schmidt <mschmidt@redhat.com>
+Date: Fri, 11 Sep 2026 16:10:51 +0200
+Subject: [PATCH] Fix loss of hardening flags (incl. CET) in hostfile/rank_file
+ lexers
+
+src/util/hostfile/Makefile.am and src/mca/rmaps/rank_file/Makefile.am
+each reset CFLAGS for their directory to avoid "picky" warnings on
+flex-generated code, using $(PRTE_CFLAGS_BEFORE_PICKY) and
+$(PMIX_CFLAGS_BEFORE_PICKY) respectively. Neither variable is ever
+AC_SUBST'ed (and PMIX_CFLAGS_BEFORE_PICKY does not even exist in
+PRRTE -- it was apparently copied from PMIx), so CFLAGS silently
+becomes empty for hostfile.c, hostfile_lex.c, rmaps_rank_file.c,
+rmaps_rank_file_component.c and rmaps_rank_file_lex.c. This drops
+every hardening flag (-O2, -fstack-protector-strong,
+-D_FORTIFY_SOURCE, -fcf-protection, etc.), and since those objects
+lack a CET .note.gnu.property, the linker strips CET (IBT/SHSTK)
+from the whole of libprrte.so.
+
+Fix by AC_SUBST'ing PRTE_CFLAGS_BEFORE_PICKY and having rank_file's
+Makefile.am reference it under its correct name.
+
+Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
+Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+---
+ config/prte_setup_cc.m4             | 8 ++++++++
+ src/mca/rmaps/rank_file/Makefile.am | 2 +-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/config/prte_setup_cc.m4 b/config/prte_setup_cc.m4
+index a3f3f5ee7f1b..f5f5c702faa5 100644
+--- a/config/prte_setup_cc.m4
++++ b/config/prte_setup_cc.m4
+@@ -402,6 +402,14 @@ AC_DEFUN([PRTE_SETUP_CC],[
+     PRTE_ENSURE_CONTAINS_OPTFLAGS("$PRTE_CFLAGS_BEFORE_PICKY")
+     PRTE_CFLAGS_BEFORE_PICKY="$co_result"
+ 
++    # PRTE_CFLAGS_BEFORE_PICKY is used by Makefile.am's in directories
++    # that do not want "picky" compiler flags (e.g., because they
++    # contain flex-generated code).  It must be AC_SUBST'ed so that
++    # those Makefiles actually receive a value instead of silently
++    # compiling with an empty CFLAGS (which drops all hardening
++    # flags, such as those for control-flow protection).
++    AC_SUBST([PRTE_CFLAGS_BEFORE_PICKY])
++
+     AC_MSG_CHECKING([for C optimization flags])
+     PRTE_ENSURE_CONTAINS_OPTFLAGS(["$CFLAGS"])
+     AC_MSG_RESULT([$co_result])
+diff --git a/src/mca/rmaps/rank_file/Makefile.am b/src/mca/rmaps/rank_file/Makefile.am
+index 27703856fc45..ec177d9a89cf 100644
+--- a/src/mca/rmaps/rank_file/Makefile.am
++++ b/src/mca/rmaps/rank_file/Makefile.am
+@@ -31,7 +31,7 @@ AM_LFLAGS = -Pprte_rmaps_rank_file_
+ LEX_OUTPUT_ROOT = lex.prte_rmaps_rank_file_
+ 
+ # we do NOT want picky compilers down here due to flex
+-CFLAGS = $(PMIX_CFLAGS_BEFORE_PICKY)
++CFLAGS = $(PRTE_CFLAGS_BEFORE_PICKY)
+ 
+ sources = \
+         rmaps_rank_file.c \
+-- 
+2.55.0
+

diff --git a/prrte.spec b/prrte.spec
index 048465e..20aeb3a 100644
--- a/prrte.spec
+++ b/prrte.spec
@@ -10,7 +10,16 @@ Summary:        PMIx Reference RunTime Environment (PRRTE)
 License:        BSD-3-Clause-Open-MPI AND BSD-2-Clause
 URL:            https://github.com/openpmix/%{name}
 Source0:        https://github.com/openpmix/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.bz2
-
+# Fix loss of hardening flags (including CET). Submitted as:
+# https://github.com/openpmix/prrte/pull/2776
+# Obsoleted by upstream removal of flex-based parser
+# in 11 commits f9ee7c5d57b8..cfc373e95c83 on master,
+# which were then backported to the "v5.0" branch, but not older branches.
+Patch0:         prrte-fix-cflags-before-picky.patch
+
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  libtool
 BuildRequires:  flex
 BuildRequires:  gcc
 BuildRequires:  make
@@ -68,6 +77,9 @@ find src -name \*.l -print -exec touch --no-create {} \;
 echo '' > src/util/qsort.h
 echo 'typedef int x;' > src/util/qsort.c
 
+# Patch0 touches configure.ac-derived files; regenerate the build system.
+./autogen.pl
+
 
 %build
 # Install into openmpi dir to avoid conflict with putty