1 file changed, 18 insertions, 4 deletions
diff --git a/tools/build-release.sh b/tools/build-release.sh
index 00fa089..cc4cefd 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -1,8 +1,9 @@
 #!/bin/sh
 
-# Build cgit for a release with Linux hardening flags, which are ELF and GCC or
-# Clang specific. The flags add a stack protector, fortified libc calls, a
-# position independent executable, and full RELRO. By default Lua is pinned off
+# Build cgit for a release with hardening flags: a stack protector, fortified
+# libc calls, a position independent executable, and full RELRO. Each flag a
+# toolchain may lack is probed first and left out where it is missing, so the
+# script builds on Linux, the BSDs and macOS alike. By default Lua is pinned off
 # so the binary needs no Lua at runtime, and running it as
 # ./tools/build-release.sh lua links in the backend behind the "lua:" filter
 # prefix instead, which needs a Lua dev package installed.
@@ -70,7 +71,20 @@ then
 	CFLAGS="$CFLAGS -ffile-prefix-map=$PWD=."
 fi
 
-LDFLAGS="-pie -Wl,-z,relro,-z,now -Wl,-z,noexecstack"
+# The linker flags are probed the same way, since Apple's linker has no -z
+# options and makes a position independent executable unasked.
+LDFLAGS=""
+if supports "-fPIE -pie"
+then
+	LDFLAGS="-pie"
+fi
+for flag in -Wl,-z,relro,-z,now -Wl,-z,noexecstack
+do
+	if supports "$flag"
+	then
+		LDFLAGS="$LDFLAGS $flag"
+	fi
+done
 
 # These reach only the cgit objects, so git's own sources are not held to them.
 # -Wformat-security is an error because a non-literal format with no arguments