From 3c0b8124809b39c80fad5a04c48e4ea85d414172 Mon Sep 17 00:00:00 2001
From: xq9mend <267839773+xq9mend@users.noreply.github.com>
Date: Thu, 2 Jul 2026 15:39:54 -0700
Subject: [PATCH] debian/rules: add full OpenSSF compiler hardening baseline

---
 debian/rules | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/debian/rules b/debian/rules
index 2d33f6a..fc17de4 100644
--- a/debian/rules
+++ b/debian/rules
@@ -1,4 +1,18 @@
 #!/usr/bin/make -f
 
+# Provides DEB_HOST_ARCH for arch-conditional compiler flags below.
+include /usr/share/dpkg/architecture.mk
+
+# +bindnow enables -Wl,-z,now (full RELRO); required by OpenSSF hardening baseline.
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all,+bindnow
+# OpenSSF Compiler Options Hardening Guide baseline.
+export DEB_CPPFLAGS_MAINT_APPEND = -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS
+# -ftrivial-auto-var-init=zero requires GCC >= 12; omit on older toolchains.
+GCC_MAJOR := $(shell gcc -dumpversion 2>/dev/null | cut -d. -f1)
+TRIVIAL_INIT := $(shell [ "$(GCC_MAJOR)" -ge 12 ] 2>/dev/null && echo "-ftrivial-auto-var-init=zero" || echo "")
+export DEB_CFLAGS_MAINT_APPEND   = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing $(TRIVIAL_INIT)
+export DEB_CXXFLAGS_MAINT_APPEND = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing $(TRIVIAL_INIT)
+export DEB_LDFLAGS_MAINT_APPEND  = -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,--as-needed
+
 %:
 	dh $@