https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81400
--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> --- I don't think we should be adding -lssp automatically. -mstack-protector-guard= is meant mainly for kernel or special purpose libraries, libssp.a we build in gcc is just one of the many possible implementations of the _FORTIFY_SOURCE etc. stuff, only if the C library doesn't provide that. The same stuff can come from many other spots, C libraries, kernel, ...
