CMakeLists.txt

cmake_minimum_required(VERSION 3.25)

project(compiler-hardening-tests
    VERSION 1.0.0
    DESCRIPTION "Testing and verification of compiler hardening options"
    LANGUAGES CXX
)

# Set C++20 as the required standard
set(CMAKE_CXX_STANDARD 20)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_EXTENSIONS OFF)

# Export compile commands for clang-tidy
set(CMAKE_EXPORT_COMPILE_COMMANDS ON)

# Enable testing
enable_testing()

# Set up cross-compilation emulator for Emscripten
# This allows CTest to execute .js files generated by Emscripten using Node.js
if(EMSCRIPTEN)
    set(CMAKE_CROSSCOMPILING_EMULATOR "node" CACHE FILEPATH "Emulator to run Emscripten-generated JavaScript")
    message(STATUS "Set CMAKE_CROSSCOMPILING_EMULATOR to 'node' for Emscripten tests")
endif()

# ============================================================================
# Compiler-Specific Hardening Options Function
# ============================================================================

# Function to apply compiler-specific hardening flags to a target
function(apply_hardening_flags target)
    message(STATUS "Applying hardening flags to ${target}")
    
    # ----------------------------------------------------------------------------
    # Apple Clang Hardening Options
    # ----------------------------------------------------------------------------
    if(CMAKE_CXX_COMPILER_ID MATCHES "AppleClang")
        message(STATUS "  Compiler: Apple Clang")
        
        target_compile_options(${target} PRIVATE
            -Wall
            -Warray-bounds-pointer-arithmetic
            -Wconversion
            -Werror=format-security
            -Wextra
            -Wformat
            -Wformat=2
            -Wimplicit-fallthrough
            -Wshadow
            -Wsign-conversion
            -fPIE
            -fstack-protector-strong
            -pedantic-errors
        )
        
        # Debug-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Debug>:
                -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG
                # -D_LIBCPP_ASSERTION_SEMANTIC=_LIBCPP_ASSERTION_SEMANTIC_OBSERVE
            >
        )
        
        # Release-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Release>:
                -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST
                # -D_LIBCPP_ASSERTION_SEMANTIC=_LIBCPP_ASSERTION_SEMANTIC_OBSERVE
                -fno-delete-null-pointer-checks
                -fno-strict-aliasing
                -fno-strict-overflow
                -ftrivial-auto-var-init=zero
            >
        )
        
        # Architecture-specific options
        if(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64")
            target_compile_options(${target} PRIVATE
                # x86-64 specific hardening for Apple Clang
            )
        elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm64")
            target_compile_options(${target} PRIVATE
                # ARM64 specific hardening for Apple Clang
            )
        endif()

    # ----------------------------------------------------------------------------
    # Clang Hardening Options
    # ----------------------------------------------------------------------------
    elseif(CMAKE_CXX_COMPILER_ID MATCHES "Clang" AND NOT CMAKE_CXX_COMPILER_ID MATCHES "AppleClang")
        message(STATUS "  Compiler: Clang")
        
        target_compile_options(${target} PRIVATE
            -Wall
            -Wextra
            -Wpedantic
        )
        
        # Debug-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Debug>:
                # Debug-specific options for Clang
            >
        )
        
        # Release-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Release>:
                # Release-specific options for Clang
            >
        )
        
        # Architecture-specific options
        if(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|AMD64")
            target_compile_options(${target} PRIVATE
                # x86-64 specific hardening for Clang
            )
        elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|ARM64")
            target_compile_options(${target} PRIVATE
                # ARM64 specific hardening for Clang
            )
        endif()

    # ----------------------------------------------------------------------------
    # GCC Hardening Options
    # ----------------------------------------------------------------------------
    elseif(CMAKE_CXX_COMPILER_ID MATCHES "GNU")
        message(STATUS "  Compiler: GCC")
        
        target_compile_options(${target} PRIVATE
            -Wall
            -Wextra
            -Wpedantic
        )
        
        # Debug-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Debug>:
                # Debug-specific options for GCC
            >
        )
        
        # Release-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Release>:
                # Release-specific options for GCC
            >
        )
        
        # Architecture-specific options
        if(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|AMD64")
            target_compile_options(${target} PRIVATE
                # x86-64 specific hardening for GCC
            )
        elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|ARM64")
            target_compile_options(${target} PRIVATE
                # ARM64 specific hardening for GCC
            )
        endif()

    # ----------------------------------------------------------------------------
    # MSVC Hardening Options
    # ----------------------------------------------------------------------------
    elseif(CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
        message(STATUS "  Compiler: MSVC")
        
        target_compile_options(${target} PRIVATE
            /W4
        )
        
        # Debug-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Debug>:
                # Debug-specific options for MSVC
            >
        )
        
        # Release-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Release>:
                # Release-specific options for MSVC
            >
        )
        
        # Architecture-specific options
        if(CMAKE_SYSTEM_PROCESSOR MATCHES "AMD64|x64")
            target_compile_options(${target} PRIVATE
                # x86-64 specific hardening for MSVC
            )
        elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "ARM64")
            target_compile_options(${target} PRIVATE
                # ARM64 specific hardening for MSVC
            )
        endif()

    # ----------------------------------------------------------------------------
    # Emscripten Hardening Options
    # ----------------------------------------------------------------------------
    elseif(EMSCRIPTEN)
        message(STATUS "  Compiler: Emscripten")
        
        target_compile_options(${target} PRIVATE
            -Wall
            -Wextra
            -Wpedantic
        )
        
        # Debug-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Debug>:
                # Debug-specific options for Emscripten
            >
        )
        
        # Release-specific flags
        target_compile_options(${target} PRIVATE
            $<$<CONFIG:Release>:
                # Release-specific options for Emscripten
            >
        )
        
        # Set output file extension to .js (which will also generate .wasm)
        set_target_properties(${target} PROPERTIES SUFFIX ".js")
        
        target_link_options(${target} PRIVATE
            # Target Node.js environment specifically
            -sENVIRONMENT=node
            # Embed wasm as base64 in JS to avoid fetch() URL issues with Node.js
            -sSINGLE_FILE=1
            -sNODEJS_CATCH_EXIT=0
            -sNODEJS_CATCH_REJECTION=0
        )
    endif()
endfunction()

# ============================================================================
# Test Executables
# ============================================================================

# Report test - logs compiler and platform information
add_executable(test-report test/report.cpp)
apply_hardening_flags(test-report)
add_test(
    NAME report
    COMMAND test-report
)
set_tests_properties(report PROPERTIES
    LABELS "info;always-pass"
)

# Hardening assertions test - validates libc++ hardening aborts on violations
add_executable(test-hardening-assertions test/test_observe_assertions.cpp)
apply_hardening_flags(test-hardening-assertions)

# Test expectations differ by platform
if(APPLE)
    # On macOS, wrap in shell command that detects signal termination
    # Exit code > 128 indicates process was killed by signal (128 + signal_number)
    # SIGABRT = 6 → exit code 134
    # SIGILL = 4 → exit code 132
    add_test(
        NAME hardening_assertions
        COMMAND bash -c "\"$<TARGET_FILE:test-hardening-assertions>\"; exit $(( $? > 128 ? 0 : 1 ))"
    )
    
    set_tests_properties(hardening_assertions PROPERTIES
        LABELS "macOS;hardening;expects-signal"
    )
else()
    # On other platforms, run normally (may or may not have hardening)
    add_test(
        NAME hardening_assertions
        COMMAND test-hardening-assertions
    )
    
    set_tests_properties(hardening_assertions PROPERTIES
        LABELS "hardening"
    )
endif()

# ============================================================================
# Installation
# ============================================================================
install(TARGETS test-report test-hardening-assertions
    RUNTIME DESTINATION bin
)