gh-156764: Fix safety configure option defaults

Doc/tools/removed-ids.txt

@@ -45,6 +45,9 @@ tutorial/modules.html: packages-in-multiple-directories
 # Removed libmpdec
 using/configure.html: cmdoption-with-system-libmpdec
 
+--disable-safety is the default, documented under --enable-safety
+using/configure.html: cmdoption-disable-safety
+
 # Removed APIs
 library/symtable.html: symtable.Class.get_methods
 library/sys.html: sys._enablelegacywindowsfsencoding

Doc/using/configure.rst

@@ -1271,13 +1271,12 @@ Security Options
       The settings ``python`` and *STRING* also set TLS 1.2 as minimum
       protocol version.
 
-.. option:: --disable-safety
+.. option:: --enable-safety
 
-   Disable compiler options that are `recommended by OpenSSF`_ for security reasons with no performance overhead.
-   If this option is not enabled, CPython will be built based on safety compiler options with no slow down.
-   When this option is enabled, CPython will not be built with the compiler options listed below.
+   Enable compiler options that are `recommended by OpenSSF`_ for security reasons
+   with no performance overhead. This option is disabled by default.
 
-   The following compiler options are disabled with :option:`!--disable-safety`:
+   Compiler options enabled with :option:`!--enable-safety` include:
 
    * `-fstack-protector-strong`_: Enable run-time checks for stack-based buffer overflows.
    * `-Wtrampolines`_: Enable warnings about trampolines that require executable stacks.
@@ -1291,7 +1290,7 @@ Security Options
 .. option:: --enable-slower-safety
 
    Enable compiler options that are `recommended by OpenSSF`_ for security reasons which require overhead.
-   If this option is not enabled, CPython will not be built based on safety compiler options which performance impact.
+   If this option is not enabled, CPython will not be built with safety compiler options that have a performance impact.
    When this option is enabled, CPython will be built with the compiler options listed below.
 
    The following compiler options are enabled with :option:`!--enable-slower-safety`:

Doc/whatsnew/3.14.rst

@@ -3154,11 +3154,10 @@ Build changes
   with :c:expr:`Py_NO_LINK_LIB`.
   (Contributed by Jean-Christophe Fillion-Robin in :gh:`82909`.)
 
-* CPython now enables a set of recommended compiler options by default
-  for improved security.
-  Use the :option:`--disable-safety` :file:`configure` option to disable them,
-  or the :option:`--enable-slower-safety` option for a larger set
-  of compiler options, albeit with a performance cost.
+* The :option:`--enable-safety` :file:`configure` option enables a set of
+  recommended compiler options for improved security. The
+  :option:`--enable-slower-safety` option enables additional compiler options
+  with a performance cost. Both options are disabled by default.
 
 * The ``WITH_FREELISTS`` macro and ``--without-freelists`` :file:`configure`
   option have been removed.

Misc/NEWS.d/next/Build/2026-09-01-17-44-34.gh-issue-156764.SF2573.rst

@@ -0,0 +1,2 @@
+Honor ``--disable-safety`` and ``--disable-slower-safety`` without enabling
+their compiler options. Both options remain disabled by default.

configure.ac

@@ -2588,12 +2588,15 @@ AS_VAR_IF([with_strict_overflow], [yes],
           [BASECFLAGS="$BASECFLAGS $NO_STRICT_OVERFLOW_CFLAGS"])
 
 # Enable flags that warn and protect for potential security vulnerabilities.
-# These flags should be enabled by default for all builds.
+# These flags are opt-in to avoid additional compiler warnings.
 
 AC_MSG_CHECKING([for --enable-safety])
 AC_ARG_ENABLE([safety],
   [AS_HELP_STRING([--enable-safety], [enable usage of the security compiler options with no performance overhead])],
-  [AS_VAR_IF([disable_safety], [yes], [enable_safety=no], [enable_safety=yes])], [enable_safety=no])
+  [AS_CASE([$enableval],
+    [yes|no], [enable_safety=$enableval],
+    [AC_MSG_ERROR([invalid --enable-safety option: expected "yes" or "no"])])],
+  [enable_safety=no])
 AC_MSG_RESULT([$enable_safety])
 
 if test "$enable_safety" = "yes"
@@ -2609,7 +2612,10 @@ fi
 AC_MSG_CHECKING([for --enable-slower-safety])
 AC_ARG_ENABLE([slower-safety],
   [AS_HELP_STRING([--enable-slower-safety], [enable usage of the security compiler options with performance overhead])],
-  [AS_VAR_IF([disable_slower_safety], [yes], [enable_slower_safety=no], [enable_slower_safety=yes])], [enable_slower_safety=no])
+  [AS_CASE([$enableval],
+    [yes|no], [enable_slower_safety=$enableval],
+    [AC_MSG_ERROR([invalid --enable-slower-safety option: expected "yes" or "no"])])],
+  [enable_slower_safety=no])
 AC_MSG_RESULT([$enable_slower_safety])
 
 if test "$enable_slower_safety" = "yes"