Spec cleanup, LTO, full RELRO and service hardening

Drop configure flags that no longer exist upstream and unused BuildRequires, remove debug lines from the build section, build with LTO again and link with -z now.
Replace the icon cache scriptlets with the RPM file trigger on /usr/share/icons.
Add IOSchedulingClass=idle, ProtectSystem=full and ProtectControlGroups=true to the service unit to bring it in line with what upstream ships.

boinc-client.changes

@@ -1,3 +1,22 @@
+-------------------------------------------------------------------
+Fri Jul  3 16:50:16 UTC 2026 - KNine <knine@canine.lat>
+
+- Drop configure flags that no longer exist (--enable-optimize,
+  --enable-unicode) and unused BuildRequires: gcc-fortran,
+  sqlite3-devel.
+- Build with LTO again, the asm() problem behind the old
+  "_lto_cflags %%nil" workaround is fixed upstream. Keep
+  -ffat-lto-objects for the static libraries in the devel package.
+- Link with -Wl,-z,now (full RELRO).
+- Tidy up %%build: drop debug echo lines, a no-op "make clean" and
+  a stray DESTDIR.
+- Drop the icon cache scriptlets, the RPM file trigger on
+  /usr/share/icons handles the cache on current releases.
+- boinc-client.service: add IOSchedulingClass=idle like the
+  upstream unit, plus ProtectSystem=full and
+  ProtectControlGroups=true. Neither touches /var, so the data
+  directory keeps working.
+
 -------------------------------------------------------------------
 Thu Jul  2 08:30:37 UTC 2026 - KNine <knine@canine.lat>
 

boinc-client.spec

@@ -23,8 +23,8 @@
   %define _fillupdir /var/adm/fillup-templates
 %endif
 
-# There are some raw asm() statements that interfere with LTO
-%define _lto_cflags %nil
+# The devel package ships static libraries, keep them usable without LTO
+%global _lto_cflags %{?_lto_cflags} -ffat-lto-objects
 %define sonum 8
 %define boinc_dir %{_localstatedir}/lib/boinc
 
@@ -62,7 +62,6 @@ BuildRequires:  docbook_4
 BuildRequires:  fdupes
 BuildRequires:  freeglut-devel
 BuildRequires:  gcc-c++
-BuildRequires:  gcc-fortran
 BuildRequires:  gettext-runtime
 BuildRequires:  libcurl-devel >= 7.17.1
 BuildRequires:  libjpeg-devel
@@ -70,7 +69,6 @@ BuildRequires:  libnotify-devel
 BuildRequires:  libtool
 BuildRequires:  openssl-devel
 BuildRequires:  pkg-config
-BuildRequires:  sqlite3-devel
 BuildRequires:  sysuser-tools
 BuildRequires:  xorg-x11-libXmu-devel
 BuildRequires:  pkgconfig(systemd)
@@ -136,7 +134,6 @@ Provides:       libboinc-devel = %{version}-%{release}
 This package contains development files for libboinc.
 
 %prep
-%global _lto_cflags %{_lto_cflags} -ffat-lto-objects
 %autosetup -p1 -n %{name}_release-%{minor_version}-%{version} -D
 
 %build
@@ -167,18 +164,15 @@ rm -r android drupal mac_build mac_installer win_build
 
 autoreconf -fi
 export CFLAGS="%optflags -W -pipe -fno-strict-aliasing -D_REENTRANT"
-echo %sle_version
 %if 0%{?sle_version} == 120000
-echo enablingcxx
 export CFLAGS="$CFLAGS -std=c++11"
 %endif
 export CXXFLAGS="$CFLAGS"
+export LDFLAGS="-Wl,-z,now"
 %configure \
-  --enable-optimize \
   --enable-shared \
   --disable-static \
   --enable-dynamic-client-linkage \
-  --enable-unicode \
   --disable-server \
   --disable-fcgi \
 %if ! %{with manager}
@@ -190,10 +184,7 @@ export CXXFLAGS="$CFLAGS"
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
 sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 
-# Export Path and make
-%make_build clean
-%make_build libboinc_la_LIBADD="-L%{_libdir} -lssl -ldl" \
-   DESTDIR=%{_prefix} V=1
+%make_build libboinc_la_LIBADD="-L%{_libdir} -lssl -ldl" V=1
 
 %install
 %make_install
@@ -307,18 +298,6 @@ fi
 %postun
 %service_del_postun %{name}.service
 
-%post -n boinc-manager
-%{_bindir}/touch --no-create %{_datadir}/icons/hicolor || :
-if [ -x %{_bindir}/gtk-update-icon-cache ]; then
-  %{_bindir}/gtk-update-icon-cache --quiet %{_datadir}/icons/hicolor || :
-fi
-
-%postun -n boinc-manager
-%{_bindir}/touch --no-create %{_datadir}/icons/hicolor || :
-if [ -x %{_bindir}/gtk-update-icon-cache ]; then
-  %{_bindir}/gtk-update-icon-cache --quiet %{_datadir}/icons/hicolor || :
-fi
-
 %post -n libboinc%{sonum} -p /sbin/ldconfig
 %postun -n libboinc%{sonum} -p /sbin/ldconfig
 

boinc-client.service

@@ -10,7 +10,10 @@ EnvironmentFile=-/etc/sysconfig/boinc-client
 Nice=10
 User=boinc
 ProtectHome=true
+ProtectSystem=full
+ProtectControlGroups=true
 CPUSchedulingPolicy=batch
+IOSchedulingClass=idle
 Slice=background.slice
 ExecStart=/usr/bin/boinc --dir $BOINC_BOINC_DIR $BOINC_BOINC_OPTS
 ExecStop=/usr/bin/boinccmd --quit