1 file changed, 10 insertions, 5 deletions
diff --git a/tools/release-build.sh b/tools/release-build.sh
index a6d10dc..fc280ae 100755
--- a/tools/release-build.sh
+++ b/tools/release-build.sh
@@ -50,7 +50,8 @@ CFLAGS="-O2 -g -Wall -fstack-protector-strong -fPIE -fno-plt"
 
 # Level 3 adds the bounds checks level 2 could not prove, and needs GCC 12 or
 # Clang 15. Fall back rather than lose fortification altogether.
-if supports "-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -O2"; then
+if supports "-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -O2"
+then
 	CFLAGS="$CFLAGS -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"
 else
 	CFLAGS="$CFLAGS -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2"
@@ -58,13 +59,15 @@ fi
 
 # Without this a large stack frame can step over a guard page rather than
 # touch it.
-if supports "-fstack-clash-protection"; then
+if supports "-fstack-clash-protection"
+then
 	CFLAGS="$CFLAGS -fstack-clash-protection"
 fi
 
 # The debug info otherwise records the absolute build directory, so the same
 # sources built in two checkouts would differ.
-if supports "-ffile-prefix-map=/x=."; then
+if supports "-ffile-prefix-map=/x=."
+then
 	CFLAGS="$CFLAGS -ffile-prefix-map=$PWD=."
 fi
 
@@ -83,7 +86,9 @@ CGIT_EXTRA_CFLAGS="-Wformat -Wformat-security -Werror=format-security"
 
 # The build starts from clean so the bundled git objects pick up the same
 # flags, and cleanall rather than clean because only cleanall descends into
-# vendor/git.
+# vendor/git. CC goes on the command line because git's Makefile sets it,
+# which would override the one from the environment the flags were probed
+# with.
 make cleanall
-exec make "$@" CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS" \
+exec make "$@" CC="$CC" CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS" \
 	CGIT_EXTRA_CFLAGS="$CGIT_EXTRA_CFLAGS"