Enable gccs static analyzer to detect memory bugs at compile-time. This
validates our __attribute__((__cleanup__)) macros and improves security
when parsing external XMPP data with zero runtime overhead.
Add security hardening via _FORTIFY_SOURCE=2 and switch to -Og to
provide the necessary optimization for these checks while remaining
debugger friendly.
The goal is to catch many buffer overflows and format string errors
at compile-time or runtime.
-Og may occasionally optimize out very short-lived
local variables, making them invisible in the debugger.
So i'm not sure this is a very good idea. But I hope that we will find
bugs earlier and don't even need to debug that often. We might revert
this change later though in case we run into problems too often.
I'm not aware of any other downsides.
Enable stack protection to detect buffer overflows and harden the binary.
This flag adds a canary to stack frames, causing the
program to terminate immediately if stack corruption is detected.
This helps identify memory safety bugs earlier during development by
turning silent corruption into an immediate crash, and provides
protection against stack-smashing exploits at runtime with negligible
performance overhead.
We don't add this generally because we wan't distributions/users to
decide if they want it. But it can help us find problems early on during
development.
Use disabler() for optional dependencies.
Extract repeated build type checks into is_debug/is_release variables.
Consolidate compiler flags into single add_project_arguments() calls.
Simplify dependency list building (Meson auto-ignores disabled deps).
Streamline platform checks using 'in' operator.
Remove redundant variables (xscrnsaver_found, gtk_version, config_h_inc).
Simplify ncurses and header detection with clearer fallback chains.
Consolidate install_data() calls for files in same directory.
For meson we dont just check for the presence of a dependency and
then auto enable it.
Users must enable features explicit. This helps with having
deterministic results.
Also remove the general `plugins` switch which was used to
enable/disable both python and c plugins. Users can just use
those switches.
In out autotools build we check for all kinds of curses and their
support for wide character.
Let's focus on more modern systems until someone complains.
For autotools this was added in:
75bb00368f
Regarding:
https://github.com/profanity-im/profanity/issues/1334
I think libstrophe is rather common now and should be treated
like all the other dependencies anyways.
So I'll remove this from the meson files at least. Since my
goal is to have a cleaner build system.
In autotools we had `package_status` which we set to either
`release` or `development`.
When converting from autotools to meson we used that mechanism
as well. But actually meson has a default way of handling this
with the option `buildtype`.
The following values are possible:
debug, debugoptimized, release, plain
So our `package_status = development` will now be
`if get_option('buildtype') == 'debug' or get_option('buildtype') ==
'debugoptimized'`. Probably we could also use
`if get_option('buildtype') == 'release'. But like this the
`plain` will be really plain.
Usage:
```
meson setup build --buildtype=debug
meson compile -C build
```
