From b894ae7a8057bfe61ef34347c995c47d67c967d2 Mon Sep 17 00:00:00 2001
From: Andrew Noyes <andrew@weaselab.dev>
Date: Sun, 14 Jun 2026 16:31:08 -0400
Subject: [PATCH] Fix arch-specific hardening_check ignore flags

hardening-check tests both CET (x86-only) and branch protection
(arm64-only). Pass the ignore flag for whichever doesn't apply to the
build arch so the test passes on all supported architectures.
---
 CMakeLists.txt | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 252a2fd..cd65155 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -206,9 +206,18 @@ endif()
 if(NOT CMAKE_CROSSCOMPILING)
   find_program(HARDENING_CHECK hardening-check)
   if(HARDENING_CHECK)
-    add_test(NAME hardening_check
-             COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}>
-                     --nofortify --nostackprotector)
+    # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI)
+    # is arm64-only, so ignore whichever doesn't apply.
+    if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
+                                                  STREQUAL arm64)
+      set(hardening_check_arch_flags --nocfprotection)
+    else()
+      set(hardening_check_arch_flags --nobranchprotection)
+    endif()
+    add_test(
+      NAME hardening_check
+      COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}> --nofortify
+              --nostackprotector ${hardening_check_arch_flags})
   endif()
 endif()