aarch64/macros: Build gnulib with -mbranch-protection=standard

Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>

grub.macros

@@ -15,7 +15,12 @@
 %endif
 
 # gnulib actively ignores CFLAGS because it's terrible
+# build aarch64 gnulib with branch protection
+%ifarch aarch64
+%global cc_equals "CC=%{ccpath} -fPIE -Wl,-z,noexecstack -Wl,--no-warn-rwx-segments -mbranch-protection=standard"
+%else
 %global cc_equals "CC=%{ccpath} -fPIE -Wl,-z,noexecstack -Wl,--no-warn-rwx-segments"
+%endif
 
 %global cflags_sed						\\\
 	sed							\\\

grub2.spec

@@ -17,7 +17,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.12
-Release:	6%{?dist}
+Release:	7%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPL-3.0-or-later
 URL:		http://www.gnu.org/software/grub/
@@ -560,6 +560,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
+* Tue Sep 17 2024 Nicolas Frayer <nfrayer@redhat.com> - 2.12-7
+- aarch64/macros: Build gnulib with -mbranch-protection=standard
+
 * Thu Sep 5 2024 Leo Sandoval <lsandova@redhat.com> - 2.12-6
 - load EFI commands inside test expressions
 - Resolves: #2305291