From e9c904a86b350fdf1d9c28d3ee722d184600916d Mon Sep 17 00:00:00 2001 From: Andrew Noyes Date: Mon, 22 Jun 2026 13:05:33 -0400 Subject: [PATCH] CMakeLists.txt: don't require hardening-check --help to exit 0 hardening-check --help returns exit code 1, so the previous hardening_check_help_result EQUAL 0 guard skipped parsing the help output entirely. As a result, architecture-specific flags such as --nobranchprotection on x86_64 were never added to the test command. Parse the help output regardless of exit code; the option-string regex checks are sufficient. --- CMakeLists.txt | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c1a6b4c..f05f306 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -389,21 +389,18 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND BUILD_TESTING) COMMAND ${HARDENING_CHECK} --help OUTPUT_VARIABLE hardening_check_help ERROR_VARIABLE hardening_check_help - OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_STRIP_TRAILING_WHITESPACE - RESULT_VARIABLE hardening_check_help_result) + OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_STRIP_TRAILING_WHITESPACE) set(hardening_check_arch_flags "") - if(hardening_check_help_result EQUAL 0) - # Control flow integrity (CET) is x86-only and branch protection - # (PAC/BTI) is arm64-only, so ignore whichever doesn't apply. - if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR - STREQUAL arm64) - if(hardening_check_help MATCHES "nocfprotection") - list(APPEND hardening_check_arch_flags --nocfprotection) - endif() - else() - if(hardening_check_help MATCHES "nobranchprotection") - list(APPEND hardening_check_arch_flags --nobranchprotection) - endif() + # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI) + # is arm64-only, so ignore whichever doesn't apply. + if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR + STREQUAL arm64) + if(hardening_check_help MATCHES "nocfprotection") + list(APPEND hardening_check_arch_flags --nocfprotection) + endif() + else() + if(hardening_check_help MATCHES "nobranchprotection") + list(APPEND hardening_check_arch_flags --nobranchprotection) endif() endif() add_test(