{
 "number": 36534,
 "repo": "bitcoin/bitcoin",
 "url": "https://github.com/bitcoin/bitcoin/pull/36534",
 "title": "build: pass hardening flags to secp256k1",
 "author": "fametrano",
 "author_association": "FIRST_TIME_CONTRIBUTOR",
 "created_at": "2026-10-15T07:04:51Z",
 "updated_at": "2026-11-01T18:50:06Z",
 "description_hash": "f2c949bff3e95fc1",
 "age_days": 17,
 "draft": false,
 "labels": [
  "Build system"
 ],
 "milestone": null,
 "base": "master",
 "head_sha": "08bd06ccd488d5a40b1b29b0a3052663668c8f52",
 "head_ref": "build-secp256k1-hardening",
 "head_repo": "fametrano/bitcoin",
 "head_history": [
  {
   "t": "2026-11-01T18:49:12Z",
   "sha": "08bd06ccd488d5a40b1b29b0a3052663668c8f52"
  }
 ],
 "additions": 61,
 "deletions": 20,
 "changed_files": 2,
 "commit_count": 1,
 "size_bucket": "S",
 "mergeable_state": "clean",
 "bot": {
  "drahtbot": {
   "present": true,
   "reviews": {},
   "conflicts": []
  }
 },
 "acks_parsed": {},
 "acks_tally": {
  "ack": 0,
  "stale_ack": 0,
  "concept_ack": 0,
  "approach_ack": 0,
  "nack": 0,
  "concept_nack": 0,
  "approach_nack": 0
 },
 "reviews": {
  "approved": 0,
  "changes_requested": 0,
  "distinct_reviewers": [
   "hebasto"
  ]
 },
 "signals": {
  "needs_rebase": false,
  "ci_failed": false,
  "mergeable_state": "clean",
  "last_author_activity": "2026-11-01T18:50:06Z",
  "last_reviewer_activity": "2026-10-27T14:07:01Z",
  "last_reviewer": "hebasto",
  "author_silent_days": 0,
  "waiting_on_author_days": 0,
  "days_since_update": 0
 },
 "refs": {
  "mentioned": [
   30677,
   30685
  ],
  "depends_on": [],
  "fixes": [],
  "linked_issues": [],
  "references": [
   {
    "number": 30677,
    "type": "issue",
    "state": "open",
    "merged": false,
    "merged_at": null,
    "title": "Control-flow application capabilities for `x86_64-linux-gnu` release binaries"
   },
   {
    "number": 30685,
    "type": "pull",
    "state": "closed",
    "merged": false,
    "merged_at": null,
    "title": "build: Mark `x86_64-linux-gnu` release binaries as CET-enabled"
   }
  ],
  "conflicts": []
 },
 "stack": {
  "shares_commits_with": [],
  "based_on": [],
  "base_for": []
 },
 "review_paths": [],
 "body": "The secp256k1 subtree is built without our hardening flags: they are on `core_interface`, which the subtree does not use, so unless the compiler enables them by default its objects miss FORTIFY, the stack protector, stack clash protection and control flow protection. On aarch64 Ubuntu 26.04 with GCC 15, the three secp256k1 objects are the only ones in the build tree without the control flow property, so master's `bitcoind` has no `AArch64 feature` note.\n\nThis PR moves the flags back to a `hardening_interface` library, which `core_interface` links (reverting 77e553ab6a), and `cmake/secp256k1.cmake` passes the subtree those its C compiler accepts. The same build then shows `AArch64 feature: BTI, PAC, GCS` on `bitcoind`. The depends libraries still lack `-fcf-protection` (#30677, #30685).",
 "commits": [
  {
   "sha": "08bd06ccd488d5a40b1b29b0a3052663668c8f52",
   "date": "2026-10-29T13:48:32Z",
   "message": "build: pass hardening flags to secp256k1\n\nThe hardening flags are added to core_interface, which the secp256k1\nsubtree does not use: cmake/secp256k1.cmake passes it only the\nsanitizer and APPEND_* flags. Its objects are therefore built without\n_FORTIFY_SOURCE, -fstack-protector-all, -fstack-clash-protection,\n-fcf-protection and -mbranch-protection, unless the compiler enables\nthem by default.\n\nThis also drops the control flow property from the binaries. The\nlinker marks an executable as BTI/PAC (aarch64) or IBT/SHSTK (x86_64)\nenabled only when every object it links has the property. On aarch64\nUbuntu 26.04 with GCC 15, bitcoind built from master has no AArch64\nfeature property, and the secp256k1 objects are the only objects in\nthe build tree without it.\n\nMove the hardening flags to a hardening_interface library, which\ncore_interface links, and pass its compile and link options to the\nsubtree in the same way as sanitize_interface. This brings back the\nhardening_interface that was folded into core_interface in 77e553ab6a,\nnow that the flags have a second user.\n\nThe hardening flags are checked with the C++ compiler, and the subtree\nis built with the C compiler. Check them again with the C compiler and\npass on only those it accepts, so that a C compiler rejecting one of\nthem cannot break the subtree's build. Each flag is checked together\nwith those accepted before it, because -D_FORTIFY_SOURCE=3 alone fails\nwith -Werror where CFLAGS already define _FORTIFY_SOURCE, and dropping\nit while keeping -U_FORTIFY_SOURCE would build secp256k1 without\nFORTIFY at all."
  }
 ],
 "timeline": [
  {
   "t": "2026-10-27T14:07:01Z",
   "kind": "comment",
   "who": "hebasto",
   "assoc": "MEMBER",
   "text": "I think that Ralph's feedback should be addressed.",
   "id": "c:6444090309",
   "url": "https://github.com/bitcoin/bitcoin/pull/36534#issuecomment-6444090309",
   "hash": "535ce04f6ddf205b",
   "edited": null
  },
  {
   "t": "2026-11-01T18:49:12Z",
   "kind": "force_push",
   "who": "fametrano",
   "commit": "08bd06ccd488d5a40b1b29b0a3052663668c8f52",
   "id": "push:08bd06ccd488d5a40b1b29b0a3052663668c8f52"
  },
  {
   "t": "2026-11-01T18:50:06Z",
   "kind": "comment",
   "who": "fametrano",
   "assoc": "NONE",
   "text": "@hebasto, Ralph's finding is addressed in 08bd06ccd4: `cmake/secp256k1.cmake` now checks each hardening flag with the C compiler, together with those accepted before it, and passes secp256k1 only those it accepts.\n\nI tested it with a C compiler wrapper that rejects `-fstack-protector-all`: master builds, 09509dde1d fails to build secp256k1, and 08bd06ccd4 drops the flag at configure time and builds. The wrapper, the commands and their output: https://gist.github.com/fametrano/6c0ed42765b0fc0a0d7cc9d3ae4fceb3/0f0ddc7b9b05391659c3ed92b8a74893b263a377\n\nI filter rather than stop configuration, so a toolchain that builds on master keeps building. secp256k1 then lacks only the flags its C compiler rejects, as Core's own targets lack those the C++ compiler rejects.",
   "id": "c:6562328475",
   "url": "https://github.com/bitcoin/bitcoin/pull/36534#issuecomment-6562328475",
   "hash": "5b05907ff6d0a06f",
   "edited": null
  }
 ],
 "labels_log": [
  {
   "t": "2026-10-15T07:04:56Z",
   "action": "labeled",
   "label": "Build system",
   "who": "DrahtBot"
  },
  {
   "t": "2026-10-15T07:08:46Z",
   "action": "labeled",
   "label": "DrahtBot Guix build requested",
   "who": "maflcko"
  },
  {
   "t": "2026-10-25T01:49:47Z",
   "action": "unlabeled",
   "label": "DrahtBot Guix build requested",
   "who": "DrahtBot"
  }
 ],
 "state_log": [],
 "text_chars": 3236,
 "text_tokens_estimate": 809,
 "changed_paths": [
  "CMakeLists.txt",
  "cmake/secp256k1.cmake"
 ],
 "files": [
  {
   "path": "CMakeLists.txt",
   "add": 22,
   "del": 19
  },
  {
   "path": "cmake/secp256k1.cmake",
   "add": 5,
   "del": 1
  }
 ],
 "test_lines": 0,
 "git": {
  "head": "09509dde1d69a002774103a30549982ac3502f3e",
  "head_matches_backup": true,
  "base": "649bc0a645eb127a9b1e6d078f8d129be6380c87",
  "patch_id": "77e902981baa1014",
  "commits": [
   {
    "sha": "09509dde1d",
    "subject": "build: pass hardening flags to secp256k1",
    "files": 2,
    "add": 27,
    "del": 20
   }
  ],
  "patch_truncated": false
 },
 "patch_id": "77e902981baa1014",
 "input_hash": "afd8808bc20e0393",
 "extracted_at": "2026-11-02T01:09:49+00:00"
}