The link doesn't use -lgcc either, because it doesn't use -nostdlib. So gcc should be supplying -lssp, which it will with -fstack-protector. I've tweaked the makefile so it should include the options in the linking run. Please test it.