From 8a5168f2329556911930d4e61b550ed12e4b527a Mon Sep 17 00:00:00 2001 From: Andrew Noyes Date: Sun, 21 Jun 2026 21:07:26 -0400 Subject: [PATCH] CMakeLists: only pass hardening-check arch flags the tool supports The amd64 CI runner's hardening-check does not recognize --nobranchprotection, causing the hardening_check test to fail at configure time. Query the tool's help output and only include the architecture-specific skip flags when they are advertised. --- CMakeLists.txt | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 150f179..c1a6b4c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -383,13 +383,28 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND BUILD_TESTING) if(NOT CMAKE_CROSSCOMPILING) find_program(HARDENING_CHECK hardening-check) if(HARDENING_CHECK) - # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI) - # is arm64-only, so ignore whichever doesn't apply. - if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR - STREQUAL arm64) - set(hardening_check_arch_flags --nocfprotection) - else() - set(hardening_check_arch_flags --nobranchprotection) + # Not all versions of hardening-check support the same options, so query + # the help output before using architecture-specific skips. + execute_process( + COMMAND ${HARDENING_CHECK} --help + OUTPUT_VARIABLE hardening_check_help + ERROR_VARIABLE hardening_check_help + OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_STRIP_TRAILING_WHITESPACE + RESULT_VARIABLE hardening_check_help_result) + set(hardening_check_arch_flags "") + if(hardening_check_help_result EQUAL 0) + # Control flow integrity (CET) is x86-only and branch protection + # (PAC/BTI) is arm64-only, so ignore whichever doesn't apply. + if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR + STREQUAL arm64) + if(hardening_check_help MATCHES "nocfprotection") + list(APPEND hardening_check_arch_flags --nocfprotection) + endif() + else() + if(hardening_check_help MATCHES "nobranchprotection") + list(APPEND hardening_check_arch_flags --nobranchprotection) + endif() + endif() endif() add_test( NAME hardening_check