diff options
Diffstat (limited to 'core/conf/pkgmk.conf.harden')
| -rw-r--r-- | core/conf/pkgmk.conf.harden | 94 |
1 files changed, 94 insertions, 0 deletions
diff --git a/core/conf/pkgmk.conf.harden b/core/conf/pkgmk.conf.harden new file mode 100644 index 0000000..ad95d65 --- /dev/null +++ b/core/conf/pkgmk.conf.harden @@ -0,0 +1,94 @@ +# +# /etc/pkgmk.conf: pkgmk(8) configuration +# +# ONLY FOR x86 64 PROCESSORS +CUSTOMVERSION=8 + +W_CFLAGS="-Wall -Wextra -Wno-inline -Wundef -Wformat=2 -Wformat-security -Wformat-nonliteral -Wlogical-op -Wsign-compare -Wmissing-include-dirs -Wold-style-definition -Wpointer-arith -Winit-self -Wdeclaration-after-statement -Wfloat-equal -Wsuggest-attribute=noreturn -Wmissing-prototypes -Wstrict-prototypes -Wredundant-decls -Wmissing-declarations -Wmissing-noreturn -Wshadow -Wendif-labels -Wstrict-aliasing=2 -Wwrite-strings -Wno-long-long -Wno-overlength-strings -Wno-unused-parameter -Wno-missing-field-initializers -Wno-unused-result -Werror=overflow -Wdate-time -Wnested-externs" + +#-ffast-math -fno-common -fdiagnostics-show-option -fno-strict-aliasing -fvisibility=hidden -ffunction-sections -fdata-sections -ffat-lto-objects +H_CFLAGS="-g -O1 -march=x86-64 -pipe -fstack-protector-strong --param=ssp-buffer-size=4 -fno-plt -fstack-check" + +CFLAGS="${W_CFLAGS} ${H_CFLAGS} -fPIC -fPIE -pie" +CXXFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" +CPPFLAGS="-O1 -Wp,-D_FORTIFY_SOURCE=2" +#--as-needed -Wl,--no-undefined -Wl,--gc-sections -Wl +LDFLAGS="-fPIC -fPIE -pie -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now" + + +PIC_CFLAGS="${W_FLAGS} ${H_CFLAGS} -fPIC" +PIC_CXXFLAGS="${PIC_CFLAGS} -D_FORTIFY_SOURCE=2" +PIC_LDFLAGS="-fPIC -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now" + +export MAKEFLAGS="-j$(nproc)" + +case ${name} in + + "keyutils") + export CFLAGS=" ${H_CFLAGS} -fPIC -fPIE -pie -g -O1 -march=x86-64 -pipe" + export CXXFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" + ;; + "grub2") + export CFLAGS="${W_CFLAGS} -g -O1 -march=x86-64 -pipe" + export CXXFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" + export LDFLAGS="" + ;; + "grub2-efi") + export CFLAGS="${W_CFLAGS} -g -O1 -march=x86-64 -pipe" + export CXXFLAGS="${CFLAGS} -D_FORTIFY_SOURCE=2" + export LDFLAGS="" + ;; + "gcc") + export CFLAGS="-g -O2 -march=x86-64 -pipe -fPIC -fstack-protector-strong --param=ssp-buffer-size=4 -fno-plt -fstack-check" + export CXXFLAGS="${CFLAGS}" + export CPPFLAGS="${H_CPPFLAGS}" + export LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now" + ;; + "glibc") + export CFLAGS="${CFLAGS} -fno-plt -fstack-check" + export CXXFLAGS="${CFLAGS}" + export CPPFLAGS="-O1" + export LDFLAGS="" + ;; + "libcap") + export CFLAGS="${PIC_CFLAGS}" + export CXXFLAGS="${PIC_CXXFLAGS}" + export LDFLAGS="${PIC_LDFLAGS}" + ;; + "mdadm") + export CFLAGS="${PIC_CFLAGS}" + export CXXFLAGS="${PIC_CXXFLAGS}" + export LDFLAGS="${PIC_LDFLAGS}" + ;; + "openssl") + export CFLAGS="${PIC_CFLAGS}" + export CXXFLAGS="${PIC_CXXFLAGS}" + export LDFLAGS="${PIC_LDFLAGS}" + ;; +esac + +case ${PKGMK_ARCH} in + "64"|"") + ;; + *) + echo "Unknown architecture selected! Exiting." + exit 1 + ;; +esac + +#PKGMK_SOURCE_MIRRORS=(https://crux.nu/distfiles/) +#PKGMK_SOURCE_MIRRORS=(https://crux.ster.zone/distfiles/) +PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/) +PKGMK_SOURCE_DIR="/srv/ports/distfiles" +PKGMK_PACKAGE_DIR="/srv/ports/packages" +PKGMK_WORK_DIR="/srv/ports/work/$name" +# PKGMK_DOWNLOAD="no" +# PKGMK_IGNORE_FOOTPRINT="no" +# PKGMK_IGNORE_NEW="no" +# PKGMK_NO_STRIP="no" +# PKGMK_DOWNLOAD_PROG="wget" +# PKGMK_WGET_OPTS="" +# PKGMK_CURL_OPTS="" +# PKGMK_COMPRESSION_MODE="gz" + +# End of file |