cc-wrapper: add support for libcxxhardeningfast & libcxxhardeningextensive hardening flags
#442945
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nixpkgs-ci
bot
added
10.rebuild-linux: 501+
nix-owners
bot
requested review from
Artturin,
Ericson2314,
RossComputerGuy,
azahi,
emilazy,
lovesegfault,
philiptaron,
reckenrode and
toonn
risicle
force-pushed
the
ris-libcxx-hardening
branch
2 times, most recently
from
8de8347 to
2b6ab40
Compare
nixpkgs-ci
bot
added
8.has: changelog
risicle
force-pushed
the
ris-libcxx-hardening
branch
from
2b6ab40 to
4d10181
Compare
nix-owners
bot
requested review from
GetPsyched,
fricklerhandwerk and
hsjobeki
nixpkgs-ci
bot
added
the
2.status: merge conflict
risicle
force-pushed
the
ris-libcxx-hardening
branch
from
4d10181 to
825000a
Compare
nixpkgs-ci
bot
removed
the
2.status: merge conflict
philiptaron
approved these changes
Oct 7, 2025
Contributor
philiptaron
left a comment
philiptaron
left a comment
There was a problem hiding this comment.
I'm running the tests. Couple of comments, nothing blocking.
nixpkgs-ci
bot
added
the
12.approvals: 1
Contributor
|
Contributor
|
Four PIE tests (see the nixpkgs-review) fail. The logs are there. Could you take a look? |
nixpkgs-ci
bot
added
the
2.status: merge conflict
Contributor
Author
|
I suspect those broke when pie got enabled at the toolchain level. Anyway, looks like you've just merged the pie flag's removal ;) |
risicle
force-pushed
the
ris-libcxx-hardening
branch
2 times, most recently
from
e58826f to
b20ee00
Compare
nixpkgs-ci
bot
removed
the
2.status: merge conflict
Contributor
Yes, it's those failures that made me look more information... and voila, they disappear in a poof of excellence. |
philiptaron
reviewed
Oct 7, 2025
Contributor
philiptaron
left a comment
philiptaron
left a comment
There was a problem hiding this comment.
One more removal from the release notes then I move to merge.
…lags as with glibcxxassertions, we don't yet have a nice mechanism for deferring support decisions to the c++ library in use, so for now at least enabling this hardening flag will cause _LIBCPP_HARDENING_MODE to be defined on all compilers
ld built with this fails to link glib's gio on x86_64 darwin
risicle
force-pushed
the
ris-libcxx-hardening
branch
from
b20ee00 to
422942c
Compare
philiptaron
approved these changes
Oct 8, 2025
3 tasks
13 tasks
DDoSolitary
added a commit
to DDoSolitary/nixpkgs
that referenced
this pull request
Nov 19, 2025
The libcxxhardeningfast and libcxxhardeingextensive hardening flags introduced by NixOS#442945 add _LIBCPP_HARDENING_MODE definitions to compiler invocations, but zig already sets it automatically. This causes macro re-definition warnings (or errors if -Werror is enabled) when compiling C++ projects with zigStdenv.
13 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See https://libcxx.llvm.org/Hardening.html
These two flags are mutually exclusive in the same way
fortify/fortify3andstrictflexarrays1/strictflexarrays3are.As with
glibcxxassertions(#414987), we don't yet have a nice mechanism for deferring support decisions to the c++ library in use, so for now at least enabling this hardening flag will cause_LIBCPP_HARDENING_MODEto be defined on all compilers.Not yet finished: release notes and docs entries, but this is ready for review in its current state.Things done
passthru.tests.nixpkgs-reviewon this PR. See nixpkgs-review usage../result/bin/.Add a 👍 reaction to pull requests you find important.