1 file changed, 20 insertions, 13 deletions
diff --git a/tools/build-release.sh b/tools/build-release.sh
index ade979c..b5e6faa 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -1,8 +1,9 @@
 #!/bin/sh
 
-# Build cgit for a release with Linux hardening flags, which are ELF and GCC or
-# Clang specific. The flags add a stack protector, fortified libc calls, a
-# position independent executable, and full RELRO. By default Lua is pinned off
+# Build cgit for a release with hardening flags: a stack protector, fortified
+# libc calls, a position independent executable, and full RELRO. Each flag a
+# toolchain may lack is probed first and left out where it is missing, so the
+# script builds on Linux, the BSDs and macOS alike. By default Lua is pinned off
 # so the binary needs no Lua at runtime, and running it as
 # ./tools/build-release.sh lua links in the backend behind the "lua:" filter
 # prefix instead, which needs a Lua dev package installed.
@@ -27,7 +28,6 @@ lua)
 	;;
 esac
 
-# Every make target below is written relative to the repository root.
 cd "$(dirname "$0")/.."
 
 CC=${CC:-cc}
@@ -71,17 +71,24 @@ then
 	CFLAGS="$CFLAGS -ffile-prefix-map=$PWD=."
 fi
 
-LDFLAGS="-pie -Wl,-z,relro,-z,now -Wl,-z,noexecstack"
+# The linker flags are probed the same way, since Apple's linker has no -z
+# options and makes a position independent executable unasked.
+LDFLAGS=""
+if supports "-fPIE -pie"
+then
+	LDFLAGS="-pie"
+fi
+for flag in -Wl,-z,relro,-z,now -Wl,-z,noexecstack
+do
+	if supports "$flag"
+	then
+		LDFLAGS="$LDFLAGS $flag"
+	fi
+done
 
 # These reach only the cgit objects, so git's own sources are not held to them.
 # -Wformat-security is an error because a non-literal format with no arguments
-# is never intentional. -Wformat-nonliteral would catch the module-link shape,
-# a non-literal that does take arguments, but it also fires on va_list
-# forwarding and on local format constants, so it is left to manual runs when
-# touching anything that formats.
-#
-#     make cgit CGIT_EXTRA_CFLAGS=-Wformat-nonliteral
-#
+# is never intentional.
 CGIT_EXTRA_CFLAGS="-Wformat -Wformat-security -Werror=format-security"
 
 # The build starts from clean so the bundled git objects pick up the same
@@ -90,5 +97,5 @@ CGIT_EXTRA_CFLAGS="-Wformat -Wformat-security -Werror=format-security"
 # which would override the one from the environment the flags were probed
 # with.
 make cleanall
-exec make "$@" CC="$CC" CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS" \
+make "$@" CC="$CC" CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS" \
 	CGIT_EXTRA_CFLAGS="$CGIT_EXTRA_CFLAGS"