The error is
tools/kconfig/conf.c:77:3: error: format not a string literal and no format arguments [-Werror=format-security]
   printf(_("aborted!\n\n"));
which looks like a conflict with the rawhide version of gcc and the gettext format. I am assigning this to gcc for investigation.

Please attach preprocessed sources.  Thanks.

On my local Rawhide machine this builds OK for me with:

glibc-2.26.9000-28.fc28.x86_64
gcc-7.2.1-4.fc28.x86_64
binutils-2.29.1-5.fc28.x86_64
gettext-0.19.8.1-11.fc27.x86_64

I'm still upgrading packages in the hope of reproducing the
Koji result ...

Created attachment 1362108 [details]
conf.i

$ gcc -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -Wp,-MD,tools/kconfig/.conf.o.d    -D_GNU_SOURCE -D_DEFAULT_SOURCE  -DCURSES_LOC="<ncurses.h>" -DNCURSES_WIDECHAR=1 -DLOCALE -DKBUILD_NO_NLS  -c -o tools/kconfig/conf.o tools/kconfig/conf.c -save-temps
gcc: warning: -pipe ignored because -save-temps specified
tools/kconfig/conf.c: In function ‘check_stdin’:
tools/kconfig/conf.c:77:3: error: format not a string literal and no format arguments [-Werror=format-security]
   printf(_("aborted!\n\n"));
   ^~~~~~
tools/kconfig/conf.c:78:3: error: format not a string literal and no format arguments [-Werror=format-security]
   printf(_("Console input/output is redirected. "));
   ^~~~~~
tools/kconfig/conf.c:79:3: error: format not a string literal and no format arguments [-Werror=format-security]
   printf(_("Run 'make oldconfig' to update configuration.\n\n"));
   ^~~~~~
tools/kconfig/conf.c: In function ‘conf_askvalue’:
tools/kconfig/conf.c:89:3: error: format not a string literal and no format arguments [-Werror=format-security]
   printf(_("(NEW) "));
   ^~~~~~
tools/kconfig/conf.c: In function ‘conf_choice’:
tools/kconfig/conf.c:290:5: error: format not a string literal and no format arguments [-Werror=format-security]
     printf(_(" (NEW)"));
     ^~~~~~
tools/kconfig/conf.c: In function ‘check_conf’:
tools/kconfig/conf.c:438:6: error: format not a string literal and no format arguments [-Werror=format-security]
      printf(_("*\n* Restart config...\n*\n"));
      ^~~~~~
tools/kconfig/conf.c: In function ‘main’:
tools/kconfig/conf.c:640:6: error: format not a string literal and no format arguments [-Werror=format-security]
      _("\n*** The configuration requires explicit update.\n\n"));
      ^~~~~~~
tools/kconfig/conf.c:693:17: error: format not a string literal and no format arguments [-Werror=format-security]
    fprintf(stderr, _("\n*** Error during writing of the configuration.\n\n"));
                 ^
tools/kconfig/conf.c:697:17: error: format not a string literal and no format arguments [-Werror=format-security]
    fprintf(stderr, _("\n*** Error during update of the configuration.\n\n"));
                 ^
tools/kconfig/conf.c:708:17: error: format not a string literal and no format arguments [-Werror=format-security]
    fprintf(stderr, _("\n*** Error during writing of the configuration.\n\n"));
                 ^
cc1: some warnings being treated as errors

If we take a particular function where this happens, in the
preprocessed output the function is:

  static void check_stdin(void)
  {
   if (!valid_stdin) {
    printf(gettext("aborted!\n\n"));
    printf(gettext("Console input/output is redirected. "));
    printf(gettext("Run 'make oldconfig' to update configuration.\n\n"));
    exit(1);
   }
  }

The only previous mention of "gettext" in the same preprocessed output is:

  static inline const char *gettext(const char *txt) { return txt; }

Clearly a bug in the package.  You are trying to emulate what gettext does, but not properly:

tools/kconfig/lkc.h has:

static inline const char *gettext(const char *txt) { return txt; }
static inline void textdomain(const char *domainname) {}
static inline void bindtextdomain(const char *name, const char *dir) {}
static inline char *bind_textdomain_codeset(const char *dn, char *c) { return c; }

If you don't want these warnings, that is not sufficient, either you need to
#define gettext(str) str
or need to use __attribute__ ((__format_arg__ (1))) on the gettext inline, so that the compiler knows it is a pass-through for format strings.
The -Wformat warnings are done early, before any inlining etc. (and after all, e.g. at -O0 there is no inlining anyway except for always_inline).

This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle.
Changing version to '28'.

This problem seems to have gone away (I am not entirely sure why but I am guessing something at the gcc end) so I am closing this bug.