Description of problem: Instead of twiddling CFLAGS, use the %_fortify_level macro instead, see "Fortification level" in the build flags guide: https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/rawhide/f/buildflags.md#source-fortification To disable fortification, simply undefine the %_fortify_level macro: %undefine _fortify_level
fixed in 17.2.5-6 in f38/rawhide