boot: Only build with debug symbols in developer mode

The debug symbols are of very limited use in proper deployments
unlike with regular userspace. Unless someone goes through the pain
of setting up an EFI debugger (assuming their firmware even supports
this in the first place) any provided debug symbols will just be
useless.
Debugging under QEMU is possible, but even then it is non-trivial
to set up, so anyone willing to go that far can just build in
developer mode.

Meanwhile, at least x86 firmware tends to refuse binaries that contain
debug symbols. We do strip the files when converted to PE anyway, but
the elf file needs to stay around on other arches as objcopy does not
support PE as input there.

Also, the generated debug symbols seem to be not reproducible when
building with LTO. Whether this is an issue in tooling or our side
is unclear. This works around this issue.

Fixes: #22157

diff --git a/src/boot/efi/meson.build b/src/boot/efi/meson.build
index 22485f6581f0c73fbbe3026ab6397f13a7e31350..b6bf6af21b9ffaba689be459790ae0877089547a 100644 (file)
--- a/src/boot/efi/meson.build
+++ b/src/boot/efi/meson.build
@@ -195,7 +195,7 @@ efi_cflags += cc.get_supported_arguments({
 if get_option('werror')
         efi_cflags += ['-Werror']
 endif
-if get_option('debug')
+if get_option('debug') and get_option('mode') == 'developer'
         efi_cflags += ['-ggdb', '-DEFI_DEBUG']
 endif
 if get_option('optimization') != '0'
@@ -213,13 +213,15 @@ foreach arg : get_option('c_args')
         if arg in [
                 '-DNDEBUG',
                 '-fno-lto',
-                '-g', '-ggdb',
                 '-O1', '-O2', '-O3', '-Og', '-Os',
                 '-Werror',
            ] or arg.split('=')[0] in [
                 '-ffile-prefix-map',
                 '-flto',
-           ]
+           ] or (get_option('mode') == 'developer' and arg in [
+                '-DEFI_DEBUG',
+                '-g', '-ggdb',
+           ])
 
                 message('Using "@0@" from c_args for EFI compiler'.format(arg))
                 efi_cflags += arg