xbps-src: move compiler/linker defaults to env/hardening.sh.

The user can still set his/her defaults via etc/conf, and per
package in the templates.

common/environment/build/build-pie.sh

@@ -1 +0,0 @@
-../configure/build-pie.sh

common/environment/build/hardening.sh

@@ -0,0 +1 @@
+../configure/hardening.sh

common/environment/configure/build-pie.sh

@@ -1,8 +0,0 @@
-_GCCSPECSDIR=${XBPS_COMMONDIR}/environment/configure/gccspecs
-
-if [ -z "$nopie" ]; then
-	CFLAGS+=" -specs=$_GCCSPECSDIR/hardened-cc1"
-	CXXFLAGS+=" -specs=$_GCCSPECSDIR/hardened-cc1"
-	# We pass -z relro -z now here too, because libtool drops -specs...
-	LDFLAGS+=" -specs=$_GCCSPECSDIR/hardened-ld -Wl,-z,relro -Wl,-z,now"
-fi

common/environment/configure/hardening.sh

@@ -0,0 +1,13 @@
+# Enable SSP and FORITFY_SOURCE=2 by default.
+XBPS_CFLAGS+=" -fstack-protector-strong -D_FORTIFY_SOURCE=2"
+XBPS_CXXFLAGS+=" ${XBPS_CFLAGS}"
+# Enable as-needed and relro by default.
+XBPS_LDFLAGS+=" -Wl,--as-needed -Wl,-z,relro"
+
+if [ -z "$nopie" ]; then
+	_GCCSPECSDIR=${XBPS_COMMONDIR}/environment/configure/gccspecs
+	XBPS_CFLAGS+=" -specs=${_GCCSPECSDIR}/hardened-cc1"
+	XBPS_CXXFLAGS+=" -specs=${_GCCSPECSDIR}/hardened-cc1"
+	# We pass -z relro -z now here too, because libtool drops -specs...
+	XBPS_LDFLAGS+=" -specs=${_GCCSPECSDIR}/hardened-ld -Wl,-z,relro -Wl,-z,now"
+fi