Skip to content

Conversation

sueszli
Copy link

@sueszli sueszli commented Oct 1, 2025

Builds on top of: #998

This commit translates the recommendations from Compiler-Options-Hardening-Guide-for-C-and-C++.md
into a universal, script-like CMake configuration that serves as a plug-and-play compiler
hardening template.

Purpose:

Rather than manually selecting and applying flags from the guide, this template automatically
applies the appropriate recommendations based on:

  • Compiler type (GCC vs Clang)
  • Operating system (Linux-specific protections)
  • Architecture (x86_64 vs ARM64)
  • Build type (Release vs Debug)

This improves accessibility by letting developers drop the configuration into their projects and
immediately benefit from the guide's recommendations without needing expertise in compiler
security flags.

Implementation:

  • Enforces latest stable compiler versions (GCC ≥14.0.0, Clang ≥16.0.0)
  • Uses conditional logic to apply the correct flags for each environment
  • Includes Dockerfile and Makefile for testing with both compilers

Directory Restructure:

  • example-minimal/: Original Makefile approach
  • example-cmake/: New universal template approach

This transforms the static guide into an actionable, copy-paste template that makes compiler
hardening accessible regardless of security expertise.

@sueszli
Copy link
Author

sueszli commented Oct 1, 2025

Needs Product: Compiler Hardening Guide label :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant