Merge #74: cmake: Fix and improve hardening for Windows

d889870 fixup! build: Generate `share/toolchain.cmake` in depends (Hennadii Stepanov)
8abb5fd fixup! cmake: Build `bitcoind` executable (Hennadii Stepanov)
861361c fixup! cmake: Add `SANITIZERS` option (Hennadii Stepanov)
402d2bf fixup! cmake: Add `WERROR` option (Hennadii Stepanov)
90dad92 fixup! cmake: Add `HARDENING` option (Hennadii Stepanov)
9913a24 fixup! cmake: Add platform-specific compiler flags (Hennadii Stepanov)
a18f905 fixup! cmake: Add `TryAppendCXXFlags` module (Hennadii Stepanov)

Pull request description:

  Some compile flags, for example `-fstack-protector-all`, might impact the linking stage as well. Instead of guessing, this PR makes the `try_append_cxx_flags` function add new flags in both compile and link contexts.

Top commit has no ACKs.

Tree-SHA512: 0e73e1f81bbb9d0afb3b08783cbd51128919c2f0b11ad9afbe963afef882ffff2332f9f6f47d2bda7ded9a15d4d6dd8e3a40460736c95eb7f2bed2325d42bdba

Author: hebasto

CMakeLists.txt

@@ -156,12 +156,12 @@ if(WIN32)
     # See: https://devblogs.microsoft.com/cppblog/improved-parallelism-in-msbuild/.
     list(APPEND CMAKE_VS_GLOBALS "UseMultiToolTask=true")
 
-    try_append_cxx_flags("/W3" TARGET core_interface)
-    try_append_cxx_flags("/wd4018" TARGET core_interface)
-    try_append_cxx_flags("/wd4244" TARGET core_interface)
-    try_append_cxx_flags("/wd4267" TARGET core_interface)
-    try_append_cxx_flags("/wd4715" TARGET core_interface)
-    try_append_cxx_flags("/wd4805" TARGET core_interface)
+    try_append_cxx_flags("/W3" TARGET core_interface SKIP_LINK)
+    try_append_cxx_flags("/wd4018" TARGET core_interface SKIP_LINK)
+    try_append_cxx_flags("/wd4244" TARGET core_interface SKIP_LINK)
+    try_append_cxx_flags("/wd4267" TARGET core_interface SKIP_LINK)
+    try_append_cxx_flags("/wd4715" TARGET core_interface SKIP_LINK)
+    try_append_cxx_flags("/wd4805" TARGET core_interface SKIP_LINK)
     target_compile_definitions(core_interface INTERFACE
       _CRT_SECURE_NO_WARNINGS
       _SILENCE_CXX17_CODECVT_HEADER_DEPRECATION_WARNING
@@ -176,7 +176,7 @@ if(WIN32)
     )
     # Avoid the use of aligned vector instructions when building for Windows.
     # See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=54412.
-    try_append_cxx_flags("-Wa,-muse-unaligned-vector-move" TARGET core_interface)
+    try_append_cxx_flags("-Wa,-muse-unaligned-vector-move" TARGET core_interface SKIP_LINK)
     try_append_linker_flag("-static" TARGET core_interface)
     # We require Windows 7 (NT 6.1) or later.
     try_append_linker_flag("-Wl,--major-subsystem-version,6" TARGET core_interface)
@@ -221,6 +221,7 @@ if(SANITIZERS)
   # fail if a bad argument is passed, e.g. -fsanitize=undfeined
   try_append_cxx_flags("-fsanitize=${SANITIZERS}" TARGET sanitizing_interface
     RESULT_VAR cxx_supports_sanitizers
+    SKIP_LINK
   )
   if(NOT cxx_supports_sanitizers)
     message(FATAL_ERROR "Compiler did not accept requested flags.")
@@ -320,7 +321,7 @@ if(HARDENING)
       $<$<NOT:$<CONFIG:Debug>>:-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3>
     )
 
-    try_append_cxx_flags("-Wstack-protector" TARGET hardening_interface)
+    try_append_cxx_flags("-Wstack-protector" TARGET hardening_interface SKIP_LINK)
     try_append_cxx_flags("-fstack-protector-all" TARGET hardening_interface)
     try_append_cxx_flags("-fcf-protection=full" TARGET hardening_interface)
 
@@ -362,7 +363,7 @@ if(WERROR)
   else()
     set(werror_flag "-Werror")
   endif()
-  try_append_cxx_flags(${werror_flag} TARGET core_interface RESULT_VAR compiler_supports_werror)
+  try_append_cxx_flags(${werror_flag} TARGET core_interface RESULT_VAR compiler_supports_werror SKIP_LINK)
   if(NOT compiler_supports_werror)
     message(FATAL_ERROR "WERROR set but ${werror_flag} is not usable.")
   endif()

cmake/module/AddLibeventIfNeeded.cmake

@@ -48,7 +48,7 @@ function(add_libevent_if_needed)
   )
   check_evhttp_connection_get_peer(PkgConfig::libevent)
   target_link_libraries(PkgConfig::libevent INTERFACE
-    $<$<BOOL:${MINGW}>:iphlpapi;ssp;ws2_32>
+    $<$<BOOL:${MINGW}>:iphlpapi;ws2_32>
   )
   add_library(libevent::libevent ALIAS PkgConfig::libevent)
 

cmake/module/TryAppendCXXFlags.cmake

@@ -6,6 +6,9 @@ include_guard(GLOBAL)
 include(CheckCXXSourceCompiles)
 
 #[=[
+Add language-wide flags, which will be passed to all invocations of the compiler.
+This includes invocations that drive compiling and those that drive linking.
+
 Usage examples:
 
   try_append_cxx_flags("-Wformat -Wformat-security" VAR warn_cxx_flags)
@@ -44,7 +47,7 @@ In configuration output, this function prints a string by the following pattern:
 function(try_append_cxx_flags flags)
   cmake_parse_arguments(PARSE_ARGV 1
     TACXXF                            # prefix
-    ""                                # options
+    "SKIP_LINK"                       # options
     "TARGET;VAR;SOURCE;RESULT_VAR"    # one_value_keywords
     "IF_CHECK_PASSED;IF_CHECK_FAILED" # multi_value_keywords
   )
@@ -98,10 +101,33 @@ function(try_append_cxx_flags flags)
   if(DEFINED TACXXF_RESULT_VAR)
     set(${TACXXF_RESULT_VAR} "${${result}}" PARENT_SCOPE)
   endif()
+
+  if(TACXXF_SKIP_LINK)
+    return()
+  endif()
+
+  # This forces running a linker.
+  set(CMAKE_TRY_COMPILE_TARGET_TYPE EXECUTABLE)
+  set(CMAKE_REQUIRED_FLAGS "${flags} ${working_linker_werror_flag}")
+  check_cxx_source_compiles("${source}" ${result})
+
+  if(${result})
+    if(DEFINED TACXXF_IF_CHECK_PASSED)
+      if(DEFINED TACXXF_TARGET)
+        target_link_options(${TACXXF_TARGET} INTERFACE ${TACXXF_IF_CHECK_PASSED})
+      endif()
+    else()
+      if(DEFINED TACXXF_TARGET)
+        target_link_options(${TACXXF_TARGET} INTERFACE ${flags})
+      endif()
+    endif()
+  else()
+    message(WARNING "The ${flags} fail(s) to link.")
+  endif()
 endfunction()
 
 if(MSVC)
-  try_append_cxx_flags("/WX /options:strict" VAR working_compiler_werror_flag)
+  try_append_cxx_flags("/WX /options:strict" VAR working_compiler_werror_flag SKIP_LINK)
 else()
-  try_append_cxx_flags("-Werror" VAR working_compiler_werror_flag)
+  try_append_cxx_flags("-Werror" VAR working_compiler_werror_flag SKIP_LINK)
 endif()

depends/Makefile

@@ -285,6 +285,7 @@ $(host_prefix)/share/toolchain.cmake : toolchain.cmake.in $(host_prefix)/.stamp_
             -e 's|@no_upnp@|$(NO_UPNP)|' \
             -e 's|@no_natpmp@|$(NO_NATPMP)|' \
             -e 's|@no_usdt@|$(NO_USDT)|' \
+            -e 's|@no_harden@|$(NO_HARDEN)|' \
             $< > $@
 	touch $@
 

depends/toolchain.cmake.in

@@ -1,3 +1,7 @@
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
 # This file is expected to be highly volatile and may still change substantially.
 
 set(CMAKE_SYSTEM_NAME @host_system@)
@@ -138,3 +142,7 @@ endif()
 if(NOT WITH_USDT AND "@no_usdt@" STREQUAL "1")
   set(WITH_USDT OFF CACHE STRING "")
 endif()
+
+if(NOT HARDENING AND "@no_harden@" STREQUAL "1")
+  set(HARDENING OFF CACHE STRING "")
+endif()