From f371dffcc66032ce424d3f386ab225d0f2a40bb5 Mon Sep 17 00:00:00 2001 From: mlandolfi90 Date: Tue, 4 Aug 2026 14:54:49 -0400 Subject: [PATCH] build(windows): do not pass -z noexecstack when cross-compiling to PE ELF_HARDENING_FLAGS is gated on IS_LINUX, which comes from uname and so describes the HOST. Cross-compiling to Windows from a Linux container (test-infrastructure/docker-compose.yml build-windows, llvm-mingw) satisfies that gate while the compiler emits PE, and the link fails: lld: error: unknown argument: -z clang: error: linker command failed with exit code 1 This is the flag's own documented intent -- the comment above it already says the flag is ELF-only and 'meaningless for PE, so it is gated'. The gate simply tested the wrong end of the toolchain. IS_MINGW is derived from the compiler's _WIN32 define, so adding it names the target. Native Windows builds (MSYS2 CLANG64) are unaffected: uname reports MINGW64_NT there, so IS_LINUX was already 'no'. Linux and macOS builds are unaffected. Only the Linux-host -> Windows-target combination changes, and only to stop emitting a flag that cannot apply. Co-Authored-By: Claude Opus 5 Signed-off-by: mlandolfi90 --- Makefile.cbm | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Makefile.cbm b/Makefile.cbm index 1dbe4d7d1..7a16c7b6c 100644 --- a/Makefile.cbm +++ b/Makefile.cbm @@ -162,7 +162,11 @@ endif # shipped artifact. ELF-only: Apple's ld rejects -z noexecstack outright and it # is meaningless for PE, so it is gated rather than made "common". ELF_HARDENING_FLAGS := -ifeq ($(IS_LINUX),yes) +# IS_LINUX comes from uname, i.e. the HOST. Cross-compiling to Windows from a +# Linux container satisfies it while emitting PE, and lld then rejects the +# unknown -z argument. Gate on the TARGET too: IS_MINGW is derived from the +# compiler's own _WIN32 define, so it names what is actually being produced. +ifeq ($(IS_LINUX)$(IS_MINGW),yesno) ELF_HARDENING_FLAGS := -Wl,-z,noexecstack endif