weaselbot/weaseljson
1
Fork 0
forked from weaselab/weaseljson
Code Pull Requests Activity

Guard --nobranchprotection behind a version check

Browse Source 
Older versions of hardening-check (as shipped by some Ubuntu releases)
don't support --nobranchprotection and error out. Probe --help at
configure time and only add the flag when it's available; old versions
that lack the flag also don't check for branch protection, so omitting
it is safe.
This commit is contained in:
andrew
2026-06-14 20:34:29 -04:00
parent 9ea798dba4
commit e8f51eff53
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CMakeLists.txt
+11 -1
View File
@@ -212,7 +212,17 @@ if(NOT CMAKE_CROSSCOMPILING)
STREQUAL arm64) STREQUAL arm64)
set(hardening_check_arch_flags --nocfprotection) set(hardening_check_arch_flags --nocfprotection)
else() else()
set(hardening_check_arch_flags --nobranchprotection) # --nobranchprotection was added in a newer version of hardening-check;
# older versions don't check for it either, so omitting the flag is safe.
execute_process(
COMMAND ${HARDENING_CHECK} --help
OUTPUT_VARIABLE _hardening_check_help
ERROR_VARIABLE _hardening_check_help)
if(_hardening_check_help MATCHES "nobranchprotection")
set(hardening_check_arch_flags --nobranchprotection)
else()
set(hardening_check_arch_flags "")
endif()
endif() endif()
add_test( add_test(
NAME hardening_check NAME hardening_check