From e8f51eff53bb6fe41400bd3d472ad2fad52faa6d Mon Sep 17 00:00:00 2001 From: Andrew Noyes Date: Sun, 14 Jun 2026 20:34:29 -0400 Subject: [PATCH] Guard --nobranchprotection behind a version check Older versions of hardening-check (as shipped by some Ubuntu releases) don't support --nobranchprotection and error out. Probe --help at configure time and only add the flag when it's available; old versions that lack the flag also don't check for branch protection, so omitting it is safe. --- CMakeLists.txt | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 6c53f00..085f084 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -212,7 +212,17 @@ if(NOT CMAKE_CROSSCOMPILING) STREQUAL arm64) set(hardening_check_arch_flags --nocfprotection) else() - set(hardening_check_arch_flags --nobranchprotection) + # --nobranchprotection was added in a newer version of hardening-check; + # older versions don't check for it either, so omitting the flag is safe. + execute_process( + COMMAND ${HARDENING_CHECK} --help + OUTPUT_VARIABLE _hardening_check_help + ERROR_VARIABLE _hardening_check_help) + if(_hardening_check_help MATCHES "nobranchprotection") + set(hardening_check_arch_flags --nobranchprotection) + else() + set(hardening_check_arch_flags "") + endif() endif() add_test( NAME hardening_check