BTW your example is pretty poor, there is no valid reason to need to debug i and j as they're never referenced, and the main() will always return 2 with even the most basic optimisation. The argument to debug something that is never used makes incredibly little sense, and you should consider forcing the hand of the compiler with static volatile int. Also note you can force local optimisation levels with a #pragma. Poorly written code shouldn't really be a defence.

I feel fairly confident in stating that very little software is written under Solus, except for that which is part of the Solus project itself, and most of that is likely derived from upstream software that was not developed under Solus

So, this isn't a security issue in the slightest tbh. And many features like FORTIFY only work with an optimisation level set, regardless of what the manpage leads you to believe. The patch is there due to inconsistent build systems that remove or ignore flags entirely, for this very reason, to ensure builds are consistent and secure. Likewise, -g2 is set as the default for proper debug symbols and we build separate dbginfo packages, which have never presented an issue before.

LGTM!

Note to self: Patch out D-key-handling in systemd-boot. Cuz its stupid

I dislike being shamed on their unsupported distros list :P Think the support runs in the other direction...