diff --git a/CMakeLists.txt b/CMakeLists.txt
index af552ab..4213914 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -174,3 +174,107 @@ endif()
 add_executable(validate src/validate.cpp)
 target_link_libraries(validate ${PROJECT_NAME}-static)
 target_include_directories(validate PRIVATE include)
+
+# symbol visibility tests
+if(NOT CMAKE_BUILD_TYPE STREQUAL Debug)
+  if(APPLE)
+    set(symbol_exports ${CMAKE_CURRENT_SOURCE_DIR}/apple-symbol-exports.txt)
+    set(symbol_imports ${CMAKE_CURRENT_SOURCE_DIR}/apple-symbol-imports.txt)
+  else()
+    set(symbol_exports ${CMAKE_CURRENT_SOURCE_DIR}/symbol-exports.txt)
+    if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64)
+      set(symbol_imports ${CMAKE_CURRENT_SOURCE_DIR}/aarch64-symbol-imports.txt)
+    else()
+      set(symbol_imports ${CMAKE_CURRENT_SOURCE_DIR}/symbol-imports.txt)
+    endif()
+  endif()
+  add_test(
+    NAME conflict_set_shared_symbols
+    COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/test_symbols.sh
+            $<TARGET_FILE:${PROJECT_NAME}> ${symbol_exports} ${symbol_imports})
+  add_test(
+    NAME conflict_set_static_symbols
+    COMMAND
+      ${CMAKE_CURRENT_SOURCE_DIR}/test_symbols.sh
+      $<TARGET_FILE:${PROJECT_NAME}-static> ${symbol_exports} ${symbol_imports})
+endif()
+
+if(NOT CMAKE_CROSSCOMPILING)
+  find_program(HARDENING_CHECK hardening-check)
+  if(HARDENING_CHECK)
+    add_test(NAME hardening_check
+             COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}>
+                     --nofortify --nostackprotector)
+  endif()
+endif()
+
+# packaging
+
+set(CPACK_PACKAGE_CONTACT andrew@weaselab.dev)
+set(CMAKE_INSTALL_DEFAULT_COMPONENT_NAME all)
+
+set(CPACK_PACKAGE_VENDOR "Weaselab")
+set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_CURRENT_SOURCE_DIR}/LICENSE")
+set(CPACK_RESOURCE_FILE_README "${CMAKE_CURRENT_SOURCE_DIR}/README.md")
+
+# rpm
+set(CPACK_RPM_PACKAGE_ARCHITECTURE ${CMAKE_SYSTEM_PROCESSOR})
+set(CPACK_RPM_SPEC_INSTALL_POST "/bin/true") # avoid stripping
+set(CPACK_RPM_PACKAGE_LICENSE "Apache 2.0")
+set(CPACK_RPM_FILE_NAME RPM-DEFAULT)
+
+# deb
+set(CPACK_DEBIAN_FILE_NAME DEB-DEFAULT)
+# see *-imports.txt - dependency versions need to be synced with symbol versions
+if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64)
+  set(CPACK_DEBIAN_PACKAGE_DEPENDS "libc6 (>= 2.17)")
+else()
+  set(CPACK_DEBIAN_PACKAGE_DEPENDS "libc6 (>= 2.14)")
+endif()
+
+# macos
+set(CMAKE_OSX_DEPLOYMENT_TARGET 11.0)
+if(APPLE)
+  find_program(PANDOC_EXE pandoc)
+  if(PANDOC_EXE)
+    execute_process(COMMAND ${PANDOC_EXE} ${CMAKE_CURRENT_SOURCE_DIR}/README.md
+                            -o ${CMAKE_CURRENT_BINARY_DIR}/README.txt)
+    set(CPACK_RESOURCE_FILE_README ${CMAKE_CURRENT_BINARY_DIR}/README.txt)
+  endif()
+  configure_file(${CMAKE_CURRENT_SOURCE_DIR}/LICENSE
+                 ${CMAKE_CURRENT_BINARY_DIR}/LICENSE.txt COPYONLY)
+  set(CPACK_RESOURCE_FILE_LICENSE ${CMAKE_CURRENT_BINARY_DIR}/LICENSE.txt)
+endif()
+
+include(CPack)
+
+include(GNUInstallDirs)
+
+target_include_directories(
+  ${PROJECT_NAME}
+  PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
+         $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/${PROJECT_NAME}>)
+
+target_include_directories(
+  ${PROJECT_NAME}-static
+  PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
+         $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/${PROJECT_NAME}>)
+
+set_target_properties(
+  ${PROJECT_NAME} PROPERTIES VERSION ${PROJECT_VERSION}
+                             SOVERSION ${PROJECT_VERSION_MAJOR})
+
+install(
+  TARGETS ${PROJECT_NAME} ${PROJECT_NAME}-static
+  EXPORT ${PROJECT_NAME}Config
+  ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+
+install(DIRECTORY include/
+        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/${PROJECT_NAME})
+
+install(EXPORT ${PROJECT_NAME}Config
+        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/${PROJECT_NAME}/cmake)
+
+cpack_add_component(all)