so we're giving up on the install hooks in CrOS to try and make sure all objects are built as PIC/PIE and built with SSP ?

I don't remember all the details but using this mechanism has not been very successful.

Some things I remember:
- It aggregates all the flags across all compilation units. So, if one object file in the executable as flag A and the rest don't, then flag A will appear in the note section in the executable. It makes it look as it the whole executable was built with flag A.
- For an object file, if it has been compiled with flags "A -no-A", they both appear in the note section. And you cannot trust the order. So, it is not clear what the final result is (A or no-A?)

I think it is probably better to implement some kind of logging in the wrapper? 
And checks at link time?

 Issue 722901  has been merged into this issue.

Out of curiosity, is this being worked on?

clang does not support (ignores it) the -frecord-gcc-switches flag. 

We recently added functionality to clang to save this info into the debug info because the debug info keeps the flags per link unit (as opposed to the section in the executable which just merges them). 
But we have not modified users of this info to pick it from the debug info.

qa-elf.sh (in ~/trunk/src/scripts/hooks/intall)

tries to use the information generated by -frecord-gcc-switches. 
This info is now in the debug info (as in #5). We need to provide similar functionality based on that. 

[It appears that a bunch of old cros issues bulk-added the "Infra" component recently, but they should probably be "Infra>Client>ChromeOS".]