#!/bin/sh
# Build cgit for a release with Linux hardening flags.
#
# These are ELF and GCC/Clang specific, so this targets a Linux deploy
# rather than local macOS development, where `make NO_LUA=1` is enough.
# The flags add a stack protector, fortified libc calls, a position
# independent executable, and full RELRO. Lua is pinned off here; drop
# NO_LUA=1 and install the Lua dev package if you use lua filters.
#
# Usage: ./tools/release-build.sh   (run from the repository root)

set -eu

CFLAGS="-O2 -g -Wall \
  -fstack-protector-strong \
  -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 \
  -fPIE \
  -fno-plt"

LDFLAGS="-pie \
  -Wl,-z,relro,-z,now \
  -Wl,-z,noexecstack"

# A full rebuild so the bundled git objects pick up the same flags.
# cleanall also descends into git/, which plain clean does not.
make NO_LUA=1 cleanall
exec make NO_LUA=1 CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS"