Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Probe the release build's linker flags too
| -rwxr-xr-x | tools/build-release.sh | 22 |
1 file changed, 18 insertions, 4 deletions
diff --git a/tools/build-release.sh b/tools/build-release.sh index 00fa089..cc4cefd 100755 --- a/tools/build-release.sh +++ b/tools/build-release.sh @@ -1,8 +1,9 @@ #!/bin/sh -# Build cgit for a release with Linux hardening flags, which are ELF and GCC or -# Clang specific. The flags add a stack protector, fortified libc calls, a -# position independent executable, and full RELRO. By default Lua is pinned off +# Build cgit for a release with hardening flags: a stack protector, fortified +# libc calls, a position independent executable, and full RELRO. Each flag a +# toolchain may lack is probed first and left out where it is missing, so the +# script builds on Linux, the BSDs and macOS alike. By default Lua is pinned off # so the binary needs no Lua at runtime, and running it as # ./tools/build-release.sh lua links in the backend behind the "lua:" filter # prefix instead, which needs a Lua dev package installed. @@ -70,7 +71,20 @@ then CFLAGS="$CFLAGS -ffile-prefix-map=$PWD=." fi -LDFLAGS="-pie -Wl,-z,relro,-z,now -Wl,-z,noexecstack" +# The linker flags are probed the same way, since Apple's linker has no -z +# options and makes a position independent executable unasked. +LDFLAGS="" +if supports "-fPIE -pie" +then + LDFLAGS="-pie" +fi +for flag in -Wl,-z,relro,-z,now -Wl,-z,noexecstack +do + if supports "$flag" + then + LDFLAGS="$LDFLAGS $flag" + fi +done # These reach only the cgit objects, so git's own sources are not held to them. # -Wformat-security is an error because a non-literal format with no arguments |