ci: re-enable gcc-14 + FIPS build in gcc-14-hardened job

.github/workflows/actions-ci.yml

@@ -523,39 +523,44 @@ jobs:
   gcc-14-hardened:
     if: github.repository_owner == 'aws'
     needs: [sanity-test-run]
+    env:
+      GOFLAGS: "-buildvcs=false"
     strategy:
       fail-fast: false
       matrix:
-        gccversion:
-          - "14"
         fips:
           - "0"
           - "1"
     runs-on: ubuntu-24.04
+    container: gcc:14.4
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: ">=1.18"
+      - name: Install build deps
+        # perl is needed for perlasm in the FIPS build; Go comes from setup-go above.
+        run: |
+          apt-get update
+          apt-get install -y cmake ninja-build perl
+          gcc --version
+          cmake --version
+          go version
+          perl --version
       - name: Setup CMake
         uses: threeal/cmake-action@v2.1.0
         with:
           generator: Ninja
-          c-compiler: gcc-${{ matrix.gccversion }}
-          cxx-compiler: g++-${{ matrix.gccversion }}
+          c-compiler: gcc
+          cxx-compiler: g++
           options: FIPS=${{ matrix.fips }} CMAKE_BUILD_TYPE=Release
       - name: Build Project
-        # -Wno-error=hardened gives us warning but no errors if options implied by -fhardened are downgraded or disabledAdd commentMore actions
-        # Ubuntu sets FORTIFY_SOURCE automatically which is one of the options implemented by hardened so this warning is
-        # generated on every compiler call.
-        # TODO: Re-enable gcc-14/FIPS build once delocator updated
-        if: ${{ !( matrix.gccversion == '14' && matrix.fips == '1' ) }}
+        # Keep -Whardened config noise (e.g. jitterentropy's -O0 compiles disabling
+        # _FORTIFY_SOURCE) from becoming fatal under the project's blanket -Werror.
         run: |
           cmake -DCMAKE_C_FLAGS='-O2 -fhardened -Wno-error=hardened' -S. -Bbuild
           cmake --build ./build --target all
       - name: Run tests
-        # TODO: Re-enable gcc-14/FIPS build once delocator updated
-        if: ${{ !( matrix.gccversion == '14' && matrix.fips == '1' ) }}
         run: cmake --build ./build --target run_tests
 
   pedantic-tests:

CMakeLists.txt

@@ -1317,6 +1317,17 @@ if(BUILD_TESTING)
     add_compile_definitions(GTEST_HAS_STREAM_REDIRECTION=0)
   endif()
 
+  # GCC's object-access warnings periodically produce false positives in
+  # heavily-inlined test code (e.g. x509_test.cc under GCC 14, see #3201).
+  # PUBLIC on boringssl_gtest demotes them for test targets only; library
+  # targets keep -Werror. -Wstringop-overread requires GCC >= 11.
+  if(GCC AND NOT CMAKE_CXX_COMPILER_VERSION VERSION_LESS "11")
+    target_compile_options(boringssl_gtest PUBLIC
+      -Wno-error=stringop-overflow
+      -Wno-error=stringop-overread
+      -Wno-error=array-bounds
+    )
+  endif()
   # Declare a dummy target to build all unit tests. Test targets should inject
   # themselves as dependencies next to the target definition.
   add_custom_target(all_tests)