From ac38638dd43a2fbcb62e3e381648d1607f6bf832 Mon Sep 17 00:00:00 2001
From: Felitendo <95575686+Felitendo@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:18:39 +0200
Subject: [PATCH] ci: build the arch tarball with arch's flags

---
 packaging/build-opencv.sh  | 11 +++++++++--
 packaging/build-tarball.sh |  7 +++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/packaging/build-opencv.sh b/packaging/build-opencv.sh
index 43d5f8c..430c482 100755
--- a/packaging/build-opencv.sh
+++ b/packaging/build-opencv.sh
@@ -25,8 +25,15 @@ prefix="${1:-$here/build/opencv-static}"
 version=4.14.0
 sha256=ee8fb9b30eb60850431b4656447080e3737b56e45719c92b67f245950609f86e
 
-# A change to this script is a different build.
-stamp="$(sha256sum "${BASH_SOURCE[0]}" | cut -d' ' -f1)"
+# The flags Arch builds its own packages with: hardening, and full RELRO.
+if [[ -f /etc/makepkg.conf ]]; then
+	# shellcheck source=/dev/null
+	source /etc/makepkg.conf
+	export CFLAGS CXXFLAGS LDFLAGS
+fi
+
+# A change to this script or to the flags is a different build.
+stamp="$({ cat "${BASH_SOURCE[0]}"; echo "${CFLAGS:-} ${CXXFLAGS:-} ${LDFLAGS:-}"; } | sha256sum | cut -d' ' -f1)"
 if [[ -f $prefix/.stamp && $(<"$prefix/.stamp") == "$stamp" ]]; then
 	echo "$prefix already has this OpenCV"
 	exit 0
diff --git a/packaging/build-tarball.sh b/packaging/build-tarball.sh
index d1dc4bc..593e0a8 100755
--- a/packaging/build-tarball.sh
+++ b/packaging/build-tarball.sh
@@ -21,6 +21,13 @@ version="${1:-$(make -s -C "$here" version)}"
 opencv="${OPENCV_PREFIX:-$here/build/opencv-static}"
 name="face-unlock-$version-arch-$(uname -m)"
 
+# The flags Arch builds its own packages with: hardening, and full RELRO.
+if [[ -f /etc/makepkg.conf ]]; then
+	# shellcheck source=/dev/null
+	source /etc/makepkg.conf
+	export CFLAGS CXXFLAGS LDFLAGS
+fi
+
 for tool in msgfmt scdoc cmake readelf zstd; do
 	command -v "$tool" > /dev/null || { echo "$0: $tool is not installed" >&2; exit 1; }
 done