Pass critical CFLAGS/CXXFLAGS to more build steps

contrib/guix/libexec/build.sh

@@ -213,10 +213,30 @@ CONFIGFLAGS="$CONFIGFLAGS -DCMAKE_SKIP_BUILD_RPATH=TRUE"  # check-symbols is fus
 # CFLAGS
 HOST_CFLAGS="-O2 -g"
 HOST_CFLAGS+=$(find /gnu/store -maxdepth 1 -mindepth 1 -type d -exec echo -n " -ffile-prefix-map={}=/usr" \;)
-case "$HOST" in
-    *mingw*)  HOST_CFLAGS+=" -fno-ident" ;;
-    *darwin*) unset HOST_CFLAGS ;;
-esac
+HOST_CFLAGS+=" -fstack-reuse=none"
+if [ -z "${NO_HARDEN}" ]; then
+    HOST_CFLAGS+=" -fstack-protector-all -fcf-protection=full"
+    case "$HOST" in
+        *mingw*)  HOST_CFLAGS+=" -fno-ident" ;;
+        *darwin*)
+            case "$(uname -m)" in
+                arm64|aarch64) HOST_CFLAGS+=" -mbranch-protection=bti" ;;
+            esac
+            unset HOST_CFLAGS
+            ;;
+        *linux*)
+            HOST_CFLAGS+=" -fstack-clash-protection"
+            case "$HOST" in
+                aarch64-*) HOST_CFLAGS+=" -mbranch-protection=standard" ;;
+            esac
+            ;;
+    esac
+else
+    case "$HOST" in
+        *mingw*)  HOST_CFLAGS+=" -fno-ident" ;;
+        *darwin*) unset HOST_CFLAGS ;;
+    esac
+fi
 
 # CXXFLAGS
 HOST_CXXFLAGS="$HOST_CFLAGS"
@@ -230,6 +250,13 @@ case "$HOST" in
     *linux*)  HOST_LDFLAGS="-Wl,--as-needed -Wl,--dynamic-linker=$glibc_dynamic_linker -static-libstdc++ -Wl,-O2" ;;
     *mingw*)  HOST_LDFLAGS="-Wl,--no-insert-timestamp" ;;
 esac
+if [ -z "${NO_HARDEN}" ]; then
+    case "$HOST" in
+        *linux*)  HOST_LDFLAGS="${HOST_LDFLAGS} -Wl,-z,relro -Wl,-z,now -Wl,-z,separate-code" ;;
+        *mingw*)  HOST_LDFLAGS="${HOST_LDFLAGS} -Wl,--dynamicbase -Wl,--nxcompat -Wl,--high-entropy-va" ;;
+        *darwin*) HOST_LDFLAGS="${HOST_LDFLAGS} -Wl,-fixup_chains" ;;
+    esac
+fi
 
 mkdir -p "$DISTSRC"
 (

depends/hosts/default.mk

@@ -41,3 +41,36 @@ endef
 
 $(foreach tool,CC CXX AR RANLIB STRIP NM OBJCOPY OBJDUMP DSYMUTIL,$(eval $(call add_host_tool_func,$(tool))))
 $(foreach flags,CFLAGS CXXFLAGS CPPFLAGS LDFLAGS, $(eval $(call add_host_flags_func,$(flags))))
+
+# GCC bug workaround (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111843)
+ifneq (,$(findstring gcc,$(host_CC))$(findstring g++,$(host_CXX)))
+$(host_arch)_$(host_os)_CFLAGS += -fstack-reuse=none
+$(host_arch)_$(host_os)_CXXFLAGS += -fstack-reuse=none
+endif
+
+ifeq ($(NO_HARDEN),)
+$(host_arch)_$(host_os)_CFLAGS += -fstack-protector-all
+$(host_arch)_$(host_os)_CXXFLAGS += -fstack-protector-all
+ifneq (,$(findstring gcc,$(host_CC))$(findstring clang,$(host_CC)))
+$(host_arch)_$(host_os)_CFLAGS += -fcf-protection=full
+$(host_arch)_$(host_os)_CXXFLAGS += -fcf-protection=full
+endif
+ifneq ($(host_os),mingw32)
+$(host_arch)_$(host_os)_CFLAGS += -fstack-clash-protection
+$(host_arch)_$(host_os)_CXXFLAGS += -fstack-clash-protection
+endif
+ifeq ($(host_arch),aarch64)
+$(host_arch)_$(host_os)_CFLAGS += -mbranch-protection=standard
+$(host_arch)_$(host_os)_CXXFLAGS += -mbranch-protection=standard
+endif
+ifeq ($(host_arch),arm64)
+ifeq ($(host_os),darwin)
+$(host_arch)_$(host_os)_CFLAGS += -mbranch-protection=bti
+$(host_arch)_$(host_os)_CXXFLAGS += -mbranch-protection=bti
+else
+$(host_arch)_$(host_os)_CFLAGS += -mbranch-protection=standard
+$(host_arch)_$(host_os)_CXXFLAGS += -mbranch-protection=standard
+endif
+endif
+$(host_arch)_$(host_os)_LDFLAGS += -Wl,-z,relro -Wl,-z,now -Wl,-z,separate-code
+endif

src/CMakeLists.txt

@@ -47,8 +47,20 @@ include(GetTargetInterface)
 get_target_interface(SECP256K1_APPEND_CFLAGS "" sanitize_interface COMPILE_OPTIONS)
 string(STRIP "${SECP256K1_APPEND_CFLAGS} ${APPEND_CPPFLAGS}" SECP256K1_APPEND_CFLAGS)
 string(STRIP "${SECP256K1_APPEND_CFLAGS} ${APPEND_CFLAGS}" SECP256K1_APPEND_CFLAGS)
+
+# Also pass -fstack-reuse=none and hardening flags from core_interface.
+get_target_interface(core_compile_options "" core_interface COMPILE_OPTIONS)
+if(core_compile_options)
+  string(STRIP "${SECP256K1_APPEND_CFLAGS} ${core_compile_options}" SECP256K1_APPEND_CFLAGS)
+endif()
+
 set(SECP256K1_APPEND_CFLAGS ${SECP256K1_APPEND_CFLAGS} CACHE STRING "" FORCE)
 get_target_interface(SECP256K1_APPEND_LDFLAGS "" sanitize_interface LINK_OPTIONS)
+get_target_interface(core_link_options "" core_interface LINK_OPTIONS)
+if(core_link_options)
+  string(STRIP "${SECP256K1_APPEND_LDFLAGS} ${core_link_options}" SECP256K1_APPEND_LDFLAGS)
+endif()
+
 string(STRIP "${SECP256K1_APPEND_LDFLAGS} ${APPEND_LDFLAGS}" SECP256K1_APPEND_LDFLAGS)
 set(SECP256K1_APPEND_LDFLAGS ${SECP256K1_APPEND_LDFLAGS} CACHE STRING "" FORCE)
 # We want to build libsecp256k1 with the most tested RelWithDebInfo configuration.