From 8a38a90e2e40fa58f7937160ca6c791fcf687a44 Mon Sep 17 00:00:00 2001 From: Brad King Date: Tue, 21 Jan 2025 15:31:50 -0500 Subject: ci: Enable assertions in CMake build jobs on macOS We did this previously on Linux and Windows: * commit 45feab3c00 (gitlab-ci: enable assertions on fedora34-ninja jobs, 2022-01-31, v3.23.0-rc1~37^2) * commit bec34592a6 (ci: Enable assertions in CMake build job on Windows, 2024-12-19) The macOS build jobs were already building the `Release` configuration by default. Make it explicit to be sure we use these flags. --- .gitlab/ci/configure_macos_arm64_ninja.cmake | 4 ++++ .gitlab/ci/configure_macos_x86_64_ninja.cmake | 4 ++++ .gitlab/os-macos.yml | 2 ++ 3 files changed, 10 insertions(+) diff --git a/.gitlab/ci/configure_macos_arm64_ninja.cmake b/.gitlab/ci/configure_macos_arm64_ninja.cmake index d49205f..78193bf 100644 --- a/.gitlab/ci/configure_macos_arm64_ninja.cmake +++ b/.gitlab/ci/configure_macos_arm64_ninja.cmake @@ -11,5 +11,9 @@ set(CMake_TEST_TLS_VERIFY_URL_BAD "https://badtls-expired.kitware.com" CACHE STR set(CMake_TEST_TLS_VERSION "1.2" CACHE STRING "") set(CMake_TEST_TLS_VERSION_URL_BAD "https://badtls-v1-1.kitware.com:8011" CACHE STRING "") +# "Release" flags without "-DNDEBUG" so we get assertions. +set(CMAKE_C_FLAGS_RELEASE "-O3" CACHE STRING "") +set(CMAKE_CXX_FLAGS_RELEASE "-O3" CACHE STRING "") + include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake") include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake") diff --git a/.gitlab/ci/configure_macos_x86_64_ninja.cmake b/.gitlab/ci/configure_macos_x86_64_ninja.cmake index c823917..c6131a2 100644 --- a/.gitlab/ci/configure_macos_x86_64_ninja.cmake +++ b/.gitlab/ci/configure_macos_x86_64_ninja.cmake @@ -14,5 +14,9 @@ set(CMake_TEST_TLS_VERIFY_URL_BAD "https://badtls-expired.kitware.com" CACHE STR set(CMake_TEST_TLS_VERSION "1.2" CACHE STRING "") set(CMake_TEST_TLS_VERSION_URL_BAD "https://badtls-v1-1.kitware.com:8011" CACHE STRING "") +# "Release" flags without "-DNDEBUG" so we get assertions. +set(CMAKE_C_FLAGS_RELEASE "-O3" CACHE STRING "") +set(CMAKE_CXX_FLAGS_RELEASE "-O3" CACHE STRING "") + include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake") include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake") diff --git a/.gitlab/os-macos.yml b/.gitlab/os-macos.yml index 629d87e..9973717 100644 --- a/.gitlab/os-macos.yml +++ b/.gitlab/os-macos.yml @@ -29,6 +29,7 @@ variables: CMAKE_CONFIGURATION: macos_x86_64_ninja + CMAKE_CI_BUILD_TYPE: Release CTEST_NO_WARNINGS_ALLOWED: 1 .macos_arm64_ninja: @@ -36,6 +37,7 @@ variables: CMAKE_CONFIGURATION: macos_arm64_ninja + CMAKE_CI_BUILD_TYPE: Release CTEST_NO_WARNINGS_ALLOWED: 1 .macos_arm64_ninja_symlinked: -- cgit v0.12 From b58b224e429701a59f38c4eff6c9f5b2006c79dd Mon Sep 17 00:00:00 2001 From: Brad King Date: Tue, 21 Jan 2025 14:11:38 -0500 Subject: ci: Enable libc++ hardening in CMake build jobs on macOS This may help catch out-of-bounds container access and similar bugs. --- .gitlab/ci/configure_macos_arm64_ninja.cmake | 3 +++ .gitlab/ci/configure_macos_x86_64_ninja.cmake | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.gitlab/ci/configure_macos_arm64_ninja.cmake b/.gitlab/ci/configure_macos_arm64_ninja.cmake index 78193bf..eb319c9 100644 --- a/.gitlab/ci/configure_macos_arm64_ninja.cmake +++ b/.gitlab/ci/configure_macos_arm64_ninja.cmake @@ -15,5 +15,8 @@ set(CMake_TEST_TLS_VERSION_URL_BAD "https://badtls-v1-1.kitware.com:8011" CACHE set(CMAKE_C_FLAGS_RELEASE "-O3" CACHE STRING "") set(CMAKE_CXX_FLAGS_RELEASE "-O3" CACHE STRING "") +# https://libcxx.llvm.org/Hardening.html +set(CMAKE_CXX_FLAGS "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG" CACHE STRING "") + include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake") include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake") diff --git a/.gitlab/ci/configure_macos_x86_64_ninja.cmake b/.gitlab/ci/configure_macos_x86_64_ninja.cmake index c6131a2..9de043e 100644 --- a/.gitlab/ci/configure_macos_x86_64_ninja.cmake +++ b/.gitlab/ci/configure_macos_x86_64_ninja.cmake @@ -18,5 +18,8 @@ set(CMake_TEST_TLS_VERSION_URL_BAD "https://badtls-v1-1.kitware.com:8011" CACHE set(CMAKE_C_FLAGS_RELEASE "-O3" CACHE STRING "") set(CMAKE_CXX_FLAGS_RELEASE "-O3" CACHE STRING "") +# https://libcxx.llvm.org/Hardening.html +set(CMAKE_CXX_FLAGS "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG" CACHE STRING "") + include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake") include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake") -- cgit v0.12