Test that the debug build has the proper -O flags set

Fixes https://src.fedoraproject.org/tests/python/issue/12

flags/assertflags.py

@@ -0,0 +1,40 @@
+"""
+This script asserts that Python config vars with compiler options including
+one or more -O flags have the last specified -O flag equal to the script's
+first argument.
+
+We use it to check that the debug build (as well as extension modules) was
+built with a desired optimization level (usually -Og or -O0).
+
+About -O flags: https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
+"If you use multiple -O options, with or without level numbers,
+the last such option is the one that is effective."
+"""
+
+import sys
+import sysconfig
+
+# The flags that currently don't have the -Og flag on the debug build
+# and we consider it OK, because we don't know any better :)
+WHITELIST = [
+    'CONFIGURE_CFLAGS',
+    'CONFIGURE_CFLAGS_NODIST',
+    'CONFIG_ARGS',
+    'OPT',
+]
+
+print('Expecting that {} is the last -O flag:\n'.format(sys.argv[1]))
+ret = 0
+
+for key, flags in sysconfig.get_config_vars().items():
+    if key in WHITELIST:
+        continue
+    if isinstance(flags, str):
+        oflags = [f for f in flags.split(' ') if f.startswith('-O')]
+        if oflags and oflags[-1] != sys.argv[1]:
+            print('Problem in {} -O flags: {}'.format(key, ' '.join(oflags)))
+            ret = 1
+        elif oflags:
+            print('{} are OK'.format(key))
+
+sys.exit(ret)

tests.yml

@@ -40,6 +40,9 @@
     - debugtest38:
         dir: selftest
         run: VERSION=3.8 PYTHON="python3-debug" X="test_ssl" ./parallel.sh
+    - debugflags:
+        dir: flags
+        run: python3-debug ./assertflags.py -Og
     required_packages:
     - gcc
     - virtualenv