https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79677
--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
It is not a GCC bug, the general rule is that the options that enable
suboptions don't change those (either way) if that option has been specified
explicitly.
So, -Wformat -Wformat-security -Wno-format does not disable -Wformat-security,
but e.g. disables -Wformat-y2k because that option has not been set explicitly.
So, either you change that
set(CMAKE_${lang}_FLAGS "${CMAKE_${lang}_FLAGS} -Wno-format")
to
set(CMAKE_${lang}_FLAGS "${CMAKE_${lang}_FLAGS} -Wno-format
-Wno-format-security")
or e.g. strip off -Werror=format-security from RPM_OPT_FLAGS.
