build: pass hardening flags to secp256k1 #36534

pull fametrano wants to merge 1 commits into bitcoin:master from fametrano:build-secp256k1-hardening changing 2 files +27 −20

fametrano commented at 7:04 AM on October 15, 2026: contributor

The secp256k1 subtree is built without our hardening flags. They are on core_interface, and cmake/secp256k1.cmake passes the subtree only the sanitizer and APPEND_* flags, so unless the compiler enables them by default its objects miss FORTIFY, the stack protector, stack clash protection and control flow protection. On aarch64 Ubuntu 26.04 with GCC 15 this also costs the whole binary its control flow property: master's bitcoind has no AArch64 feature note, and the three secp256k1 objects are the only ones in the build tree without it.

This PR moves the flags back to a hardening_interface library, which core_interface links; the CMakeLists.txt change is a revert of 77e553ab6a plus one comment. cmake/secp256k1.cmake then passes them to the subtree the same way as sanitize_interface. With it, the same build shows AArch64 feature: BTI, PAC, GCS on bitcoind. It does not fix #30677 on its own: the depends libraries are still built without -fcf-protection, which #30685 tried to change.

build: pass hardening flags to secp256k1

The hardening flags are added to core_interface, which the secp256k1
subtree does not use: cmake/secp256k1.cmake passes it only the
sanitizer and APPEND_* flags. Its objects are therefore built without
_FORTIFY_SOURCE, -fstack-protector-all, -fstack-clash-protection,
-fcf-protection and -mbranch-protection, unless the compiler enables
them by default.

This also drops the control flow property from the binaries. The
linker marks an executable as BTI/PAC (aarch64) or IBT/SHSTK (x86_64)
enabled only when every object it links has the property. On aarch64
Ubuntu 26.04 with GCC 15, bitcoind built from master has no AArch64
feature property, and the secp256k1 objects are the only objects in
the build tree without it.

Move the hardening flags to a hardening_interface library, which
core_interface links, and pass its compile and link options to the
subtree in the same way as sanitize_interface. This brings back the
hardening_interface that was folded into core_interface in 77e553ab6a,
now that the flags have a second user.

09509dde1d

DrahtBot added the label Build system on Oct 15, 2026
DrahtBot commented at 7:05 AM on October 15, 2026: contributor


The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



External sites
- Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36534
- Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36534.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36534#author-ralph


Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.
maflcko added the label DrahtBot Guix build requested on Oct 15, 2026

DrahtBot commented at 1:49 AM on October 25, 2026: contributor

Guix builds (on x86_64) [untrusted test-only build, possibly unsafe, not for production use]

File	commit 3eca89820e1fb152ebf0315e3924fc374cb35958<br>(master)	commit 5d512d01eb1cbfd66bfee2a617619872a5103fed<br>(pull/36534/merge)
*-aarch64-linux-gnu-debug.tar.gz	`3d99f1b5dfe7139d...`	`d32a1b7a380dfeec...`
*-aarch64-linux-gnu.tar.gz	`e119310c231af339...`	`be5015fb57bf02e3...`
*-arm-linux-gnueabihf-debug.tar.gz	`b3611994b1ccc3fc...`	`e7551e2af7575a05...`
*-arm-linux-gnueabihf.tar.gz	`099c30d039fd1ccf...`	`5a3aee80cd81064b...`
*-arm64-apple-darwin-codesigning.tar.gz	`e24595ece52716a3...`	`cd3e83a8e4fe8a0c...`
*-arm64-apple-darwin-unsigned.tar.gz	`886662eba9cd08ba...`	`fcbff104c5f8e548...`
*-arm64-apple-darwin-unsigned.zip	`29e1c0908552b826...`	`2eaf32ff566a0676...`
*-powerpc64-linux-gnu-debug.tar.gz	`8bf7cd9b1d94139a...`	`f2843cff10cfee24...`
*-powerpc64-linux-gnu.tar.gz	`05b93aac6c5c3220...`	`3dfe17710f8a9b33...`
*-riscv64-linux-gnu-debug.tar.gz	`b4d2eda8888b02fd...`	`3a527cf3df9690eb...`
*-riscv64-linux-gnu.tar.gz	`48efc464a63eea29...`	`6e4a267e64064680...`
*-win64-codesigning.tar.gz	`e3027e6bc4ead530...`	`ac239ffb35c099ec...`
*-win64-debug.zip	`3fec05694843befa...`	`7066e35cb9c3868c...`
*-win64-setup-unsigned.exe	`6377610c2a3f66c2...`	`ecf4502ef6ea5004...`
*-win64-unsigned.zip	`f0015cc1ae1f7e90...`	`ef1f3b27d5992b40...`
*-x86_64-apple-darwin-codesigning.tar.gz	`ef4f9a7592fa1658...`	`49e1982fdbe0899b...`
*-x86_64-apple-darwin-unsigned.tar.gz	`913cfdabdeea381f...`	`3005e5682f72aefd...`
*-x86_64-apple-darwin-unsigned.zip	`6c0fe3baad354830...`	`c45f3a484dbdd2e8...`
*-x86_64-linux-gnu-debug.tar.gz	`09c21fb85429895c...`	`a13f2b07948fd349...`
*-x86_64-linux-gnu.tar.gz	`d7ca7386bd38bf30...`	`4153960fdea5f6b7...`
*.tar.gz	`824fb8782d74d318...`	`e2b5060c2f5c24f3...`
SHA256SUMS.part	`37d921b59621a29a...`	`cecaf142faedb223...`
guix_build.log	`7a3293747836a472...`	`d3ac1cecf9aaf3fc...`
guix_build.log.diff		`909ccd87681a4eae...`