Force PIE on bootgen with explicit compiler/linker flags, not just the CMake property

Same fix as #3333 (against main), carried forward here since this branch
replaces bootgen's CMakeLists.txt with the 2026.1 upstream-source layout.

The POSITION_INDEPENDENT_CODE property set on bootgen-lib/bootgen doesn't
actually force PIE: this project never calls check_pie_supported(), which
CMake's CMP0083 needs to turn that property into real -fPIE/-pie flags for
an executable target. Confirmed via readelf + strace that the wheel built
from #3327's own commit (main's earlier attempt at this) still ships a
non-PIE `bootgen` and segfaults (SIGSEGV/SEGV_ACCERR jumping into its own
non-executable DYNAMIC segment) once auditwheel repair patches in an RPATH
for vendored OpenSSL -- manylinux_2_28's gcc-toolset doesn't default to
PIE the way a distro's system gcc does.

Pass -fPIC/-fPIE/-pie explicitly, last, so they win over any inherited
-fno-pie/-fno-PIC via ordinary last-flag-wins compiler semantics. Verified
locally under a forced -fno-pie -fno-PIC -no-pie global configuration that
this reliably produces a true PIE (ET_DYN) bootgen, unlike the
property-only approach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: jgmelber

tools/bootgen/CMakeLists.txt

@@ -135,13 +135,15 @@ if(CMAKE_C_COMPILER_ID MATCHES "Clang|GNU")
     -Wno-deprecated-declarations
     -Wno-sign-compare
     -Wno-type-limits
-    -Wno-unused)
+    -Wno-unused
+    # See bootgen-lib below for why -fPIC is also passed explicitly here.
+    -fPIC)
 endif()
 
 add_library(bootgen-lib STATIC ${libsources})
 # bootgen must be compiled with PIE/PIC, irrespective of the remainder of
-# the project, because  auditwheel repair's patchelf-based RPATH rewrite
-# corrupts the non-PIE binary
+# the project, because auditwheel repair's patchelf-based RPATH rewrite
+# corrupts the non-PIE binary.
 set_target_properties(bootgen-lib PROPERTIES POSITION_INDEPENDENT_CODE ON)
 if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
   set(bootgen_warning_ignores
@@ -179,6 +181,18 @@ if (CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
   target_compile_options(bootgen-lib PRIVATE /wd4996 /wd4840 /wd4005 /wd5033)
 endif()
 target_compile_options(bootgen-lib PRIVATE ${bootgen_warning_ignores})
+if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+  # Explicit -fPIC, not just the POSITION_INDEPENDENT_CODE property above:
+  # that property relies on CMake's CMP0083 + the CheckPIESupported module
+  # to inject the right compiler/linker flags, and this project never calls
+  # check_pie_supported(), so the property silently does nothing on some
+  # toolchains (observed on the manylinux_2_28 gcc-toolset used to build
+  # release wheels, which -- unlike a distro's system gcc -- does not
+  # default to PIE/PIC either). Passed last so it wins (compilers apply
+  # "last flag wins" for -fPIC/-fno-PIC) over anything inherited from the
+  # linked MLIR/LLVM package's own build configuration.
+  target_compile_options(bootgen-lib PRIVATE -fPIC)
+endif()
 target_include_directories(bootgen-lib PRIVATE ${bootgen_include_dirs} ${OPENSSL_INCLUDE_DIR})
 # Make C API header available publicly
 target_include_directories(bootgen-lib PUBLIC
@@ -203,6 +217,15 @@ if (CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
   target_compile_options(bootgen PRIVATE /EHsc)
   target_compile_options(bootgen PRIVATE /wd4996 /wd4840 /wd4005 /wd5033)
 endif()
+if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+  # Explicit -fPIE/-pie (see bootgen-lib above for why the
+  # POSITION_INDEPENDENT_CODE property alone can't be trusted). Passed last
+  # so it wins -- compilers apply "last flag wins" for -fPIE/-fno-PIE and
+  # -pie/-no-pie -- over anything inherited from the linked MLIR/LLVM
+  # package's own build configuration.
+  target_compile_options(bootgen PRIVATE -fPIE)
+  target_link_options(bootgen PRIVATE -fPIE -pie)
+endif()
 target_compile_definitions(bootgen PRIVATE OPENSSL_USE_APPLINK)
 target_link_libraries(bootgen PRIVATE bootgen-lib OpenSSL::SSL OpenSSL::applink)
 install(TARGETS bootgen)