>>666 (checked)
>LDFLAGS="-Wl,-z,now -Wl,-z,relro"
That's sloppy code, you only need the one -Wl.

Here's what mine currently has:
LDFLAGS="-Wl,-O1,--sort-common,--hash-style=gnu,--as-needed,-z,combreloc,-z,relro,-z,now"