So far, we have not defined any custom compiler flags, but from the reference Autotools build, we remember that the code was compiled with -g -U_FORTIFY_SOURCE
-D_FORTIFY_SOURCE=1 -O2 using the GNU C compiler.

Our first approach could be to define the following:

if(CMAKE_C_COMPILER_ID MATCHES GNU)
    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -g -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1 -O2")
endif()

And, we would place this code on top of src/CMakeLists.txt, right before generating source files (since pathdef.c uses ${CMAKE_C_FLAGS}):

# <- we will define flags right here

include(autogenerate.cmake)
generate_config_h()
generate_pathdef_c()
generate_osdef_h()

A slight improvement to the compiler flag definitions would be to define -O2 as a Release configuration flag and to turn off optimization for a Debug configuration:

if(CMAKE_C_COMPILER_ID MATCHES GNU)
  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -g -U_FORTIFY_SOURCE 
-D_FORTIFY_SOURCE=1")
  set(CMAKE_C_FLAGS_RELEASE "-O2")
  set(CMAKE_C_FLAGS_DEBUG "-O0")
endif()

Please verify with make VERBOSE=1 that the build uses the expected flags.