Description of problem: The CFLAGS hard code the fortification level to 2, use the %_fortify_level macro instead, see "Fortification level" in the build flags guide: https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/rawhide/f/buildflags.md#source-fortification This way, fortification will follow the default level chosen for the distribution.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 38 development cycle. Changing version to 38.