Checklist

• App update process has been followed
• Target branch is develop
• Application version has been bumped

Summary / Notes

Two builds + link

The Makefile can build nanopb separately with -fPIC (without -fropi/-frwpi) and add those .o files to the link. Compilation will succeed.

Link / loader

Code built with -fPIC requires a GOT (Global Offset Table); the compiler places it in the .data section.

In Ledger firmware (nanos2), script.ld requires the .data section to be empty (ASSERT), and .data is anyway directed to DISCARD.

Result: the linker reports ".data section must be empty", or, if the assertion is disabled, the GOT is discarded and the application crashes at runtime.

GOT cannot be disabled

In GCC/Clang there is no flag like -fPIC -fno-got. With -fPIC, the GOT is always generated and cannot be turned off by compiler options alone.

Conclusion

The Makefile alone is not enough: nanopb cannot be built with -fPIC and linked into this application on nanos2 using only flags, because the firmware model (empty .data, ROPI/RWPI) is incompatible with the GOT.