#36534 build: pass hardening flags to secp256k1

Move compiler and linker hardening flags into a dedicated CMake interface library (`hardening_interface`) linked by `core_interface`, and pass those flags down to the secp256k1 subtree build.

Problem: The secp256k1 subtree does not inherit flags from `core_interface`, so its objects are built without hardening flags such as FORTIFY, stack protection, stack clash protection, and branch/control-flow protection unless compiler defaults provide them. Because linkers drop binary-wide control-flow protection markers (like AArch64 BTI/PAC/GCS or x86_64 CET) if any linked object lacks them, the unhardened secp256k1 objects cause the final executable to lose hardware control-flow protections.

Evidence of importance:

• Author notes: 'On aarch64 Ubuntu 26.04 with GCC 15 this also costs the whole binary its control flow property: master\'s bitcoind has no AArch64 feature note, and the three secp256k1 objects are the only ones in the build tree without it.'
• Author verifies: 'With it, the same build shows AArch64 feature: BTI, PAC, GCS on bitcoind.'

Scope: Small build-system change reverting commit 77e553ab6a to re-introduce `hardening_interface` and forward its options to `cmake/secp256k1.cmake`.

Risk of a mistake: medium (build). Passing additional compiler and linker flags to libsecp256k1 could cause build failures on esoteric platforms or toolchain configurations.

Changed since the previous assessment: Diff provided; the implementation matches the previous description.

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

• reviewer: hebasto to review the update in 08bd06ccd4 addressing Ralph's feedback 2026-11-01
• reviewer: hebasto to check the update addressing Ralph's feedback 2026-11-01

Crickets

no substantive comment either way

Thread notes: Initial record. hebasto asked that Ralph's feedback be addressed; fametrano pushed commit 08bd06ccd4 to check hardening flags with the C compiler and replied. / Initial record. hebasto noted that Ralph's feedback should be addressed; fametrano pushed an update addressing it.

Objections, suggestions, and questions:

Participants:

• hebasto (member, neutral, 1 statements 2026-10-27 to 2026-10-27): asked to address Ralph's feedback

0 lines under test/bench/ci.

• CMakeLists.txt +22/-19
• cmake/secp256k1.cmake +5/-1

The short text the ranking pass compares across PRs.

This pull request passes Bitcoin Core's compiler and linker hardening flags to the embedded libsecp256k1 subtree build by re-introducing a `hardening_interface` CMake target. Previously, secp256k1 objects were built without flags like stack protection and branch protection. Because linkers drop binary-wide control-flow integrity flags if even a single linked object lacks them, secp256k1 objects stripped control-flow markers from release binaries on toolchains that do not enable them by default. Testing on Ubuntu 26.04 with GCC 15 confirms this change restores the `AArch64 feature: BTI, PAC, GCS` elf note on bitcoind.

P2 · bug fix

Fixes a regression where secp256k1 objects omit hardening flags, causing linkers to drop binary-wide hardware control-flow protections (like AArch64 BTI/PAC/GCS or x86_64 CET) from bitcoind. As the author notes, 'the unhardened secp256k1 objects cause the final executable to lose hardware control-flow protections' on master.

Membership: Carries the 'Build system' label and modifies CMakeLists.txt and cmake/secp256k1.cmake to manage compiler flags passed to secp256k1.

Factors: security/stability 2, bug 2, performance 0, user value 0, leverage 0