doc

.github/workflows/macos.yml

@@ -7,12 +7,14 @@ on:
       - 'docker/**'
       - 'traces/**'
       - '.vscode/**'
+      - '**.md'
   pull_request:
     paths-ignore:
       - 'doc/**'
       - 'docker/**'
       - 'traces/**'
       - '.vscode/**'
+      - '**.md'
 
 jobs:
   macos-make:

.github/workflows/ubuntu.yml

@@ -7,13 +7,14 @@ on:
       - 'docker/**'
       - 'traces/**'
       - '.vscode/**'
+      - '**.md'
   pull_request:
     paths-ignore:
       - 'doc/**'
       - 'docker/**'
       - 'traces/**'
       - '.vscode/**'
-
+      - '**.md'
 
 jobs:
   ubuntu-make:

.github/workflows/windows.yml

@@ -7,13 +7,14 @@ on:
       - 'docker/**'
       - 'traces/**'
       - '.vscode/**'
+      - '**.md'
   pull_request:
     paths-ignore:
       - 'doc/**'
       - 'docker/**'
       - 'traces/**'
       - '.vscode/**'
-
+      - '**.md'
 
 jobs:
   proxspace:

CHANGELOG.md

@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+- Added hardening for all host binaries. Exact level of hardening depends on the OS (@doegox)
 - Added `hf aliro read` command (@kormax)
 - Added `hf aliro info` command (@kormax)
 - Added Qt6 support for the client (@doegox)

doc/md/Development/Maintainers.md

@@ -89,6 +89,10 @@ Some unittests are available via `make check`, which is actually triggering indi
 
 * `SKIPUV=1 tools/pm3_tests.sh` to skip usage of `uv` even if `uv` is present, and force usage of `python3` (in which case you must take care of installing the script dependencies yourself)
 
+Host binaries are compiled with hardening flags (only with Makefile, not with cmake). Exact level of hardening depends on the OS.
+
+* `make host NOHARDENING=1` to disable hardening flags.
+
 `make install` is actually triggering the following individual targets which can be accessed individually:
 
 * `make client/install`

doc/md/Development/Makefile-vs-CMake.md

@@ -34,6 +34,7 @@ At the moment both are maintained because they don't perfectly overlap yet.
 | extra GCC warnings | `GCCEXTRA=1` | **no** |   |
 | extra Clang warnings | `CLANGEXTRA=1` | **no** | only on host |
 | AddressSanitize | `SANITIZE=1` | **no** | only on host |
+| Hardening | yes (1) | **no** | only on host; disable it with `NOHARDENING=1` |
 | compilation | in place | in build dir | |
 | user `CFLAGS`/`LDFLAGS` | envvars honored (1) | envvars honored (2) | (1) also `LDLIBS` and `INCLUDES_CLIENT` for more tuning (2) only at first cmake call |
 | Mingw gnu printf | `_ISOC99_SOURCE` | `_ISOC99_SOURCE` | and in cbor.h: `__attribute__((format (__MINGW_PRINTF_FORMAT, 2, 3)))`|