build: add option for building with stack-protector-all

[openwrt/openwrt.git] / config / Config-build.in

diff --git a/config/Config-build.in b/config/Config-build.in
index ef1a10c28dce49abf34f38843830f4b957b33e2e..24c2bcf13007c7bdf1cb4aba0ba8c390f3415998 100644 (file)
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -5,7 +5,6 @@
 
 config EXPERIMENTAL
        bool "Enable experimental features by default"
-       default n
        help
          Set this option to build with latest bleeding edge features
          which may or may not work as expected.
@@ -27,6 +26,14 @@ menu "Global build settings"
                  directory containing machine readable list of built profiles
                  and resulting images.
 
+       config JSON_CYCLONEDX_SBOM
+               bool "Create CycloneDX SBOM JSON"
+               default BUILDBOT
+               help
+                 Create a JSON files *.bom.cdx.json in the build
+                 directory containing Software Bill Of Materials in CycloneDX
+                 format.
+
        config ALL_NONSHARED
                bool "Select all target specific packages by default"
                select ALL_KMODS
@@ -42,7 +49,6 @@ menu "Global build settings"
 
        config BUILDBOT
                bool "Set build defaults for automatic builds (e.g. via buildbot)"
-               default n
                help
                  This option changes several defaults to be more suitable for
                  automatic builds. This includes the following changes:
@@ -58,6 +64,10 @@ menu "Global build settings"
                bool "Enable signature checking in opkg"
                default SIGNED_PACKAGES
 
+       config DOWNLOAD_CHECK_CERTIFICATE
+               bool "Enable TLS certificate verification during package download"
+               default y
+
        comment "General build options"
 
        config TESTING_KERNEL
@@ -71,10 +81,8 @@ menu "Global build settings"
 
        config DISPLAY_SUPPORT
                bool "Show packages that require graphics support (local or remote)"
-               default n
 
        config BUILD_PATENTED
-               default n
                bool "Compile with support for patented functionality"
                help
                  When this option is disabled, software which provides patented functionality
@@ -82,7 +90,6 @@ menu "Global build settings"
                  functionality, this optional support will get disabled for this package.
 
        config BUILD_NLS
-               default n
                bool "Compile with full language support"
                help
                  When this option is enabled, packages are built with the full versions of
@@ -96,7 +103,6 @@ menu "Global build settings"
        config CLEAN_IPKG
                bool
                prompt "Remove ipkg/opkg status data files in final images"
-               default n
                help
                  This removes all ipkg/opkg status data files from the target directory
                  before building the root filesystem.
@@ -104,14 +110,12 @@ menu "Global build settings"
        config IPK_FILES_CHECKSUMS
                bool
                prompt "Record files checksums in package metadata"
-               default n
                help
                  This makes file checksums part of package metadata. It increases size
                  but provides you with pkg_check command to check for flash corruptions.
 
        config INCLUDE_CONFIG
                bool "Include build configuration in firmware" if DEVEL
-               default n
                help
                  If enabled, buildinfo files will be stored in /etc/build.* of firmware.
 
@@ -145,22 +149,44 @@ menu "Global build settings"
        config DEBUG
                bool
                prompt "Compile packages with debugging info"
-               default n
                help
                  Adds -g3 to the CFLAGS.
 
-       config IPV6
+       config USE_GC_SECTIONS
                bool
-               prompt "Enable IPv6 support in packages"
-               default y
+               prompt "Dead code and data elimination for all packages (EXPERIMENTAL)"
+               help
+                 Places functions and data items into its own sections to use the linker's
+                 garbage collection capabilites.
+                 Packages can choose to opt-out via setting PKG_BUILD_FLAGS:=no-gc-sections
+
+       config USE_LTO
+               bool
+               prompt "Use the link-time optimizer for all packages (EXPERIMENTAL)"
                help
-                 Enables IPv6 support in kernel (builtin) and packages.
+                 Adds LTO flags to the CFLAGS and LDFLAGS.
+                 Packages can choose to opt-out via setting PKG_BUILD_FLAGS:=no-lto
+
+       config MOLD
+               depends on (aarch64 || arm || i386 || i686 || m68k || powerpc || powerpc64 || sh4 || x86_64)
+               depends on !GCC_USE_VERSION_11
+               def_bool $(shell, ./config/check-hostcxx.sh 10 2 12)
+
+       config USE_MOLD
+               bool
+               prompt "Use the mold linker for all packages"
+               depends on MOLD
+               help
+                 Link packages with mold, a modern linker
+                 Packages can opt-out via setting PKG_BUILD_FLAGS:=no-mold
+
+       config IPV6
+               def_bool y
 
        comment "Stripping options"
 
        choice
                prompt "Binary stripping method"
-               default USE_STRIP   if EXTERNAL_TOOLCHAIN
                default USE_STRIP   if USE_GLIBC
                default USE_SSTRIP
                help
@@ -177,7 +203,6 @@ menu "Global build settings"
                        help
                          This will install binaries stripped using strip from binutils.
 
-
                config USE_SSTRIP
                        bool "sstrip"
                        depends on !USE_GLIBC
@@ -194,13 +219,12 @@ menu "Global build settings"
                help
                  Specifies arguments passed to the strip command when stripping binaries.
 
-       config SSTRIP_ARGS
-               string
-               prompt "Sstrip arguments"
-               depends on USE_SSTRIP
-               default "-z"
+       config SSTRIP_DISCARD_TRAILING_ZEROES
+               bool "Strip trailing zero bytes"
+               depends on USE_SSTRIP && !USE_MOLD
+               default y
                help
-                 Specifies arguments passed to the sstrip command when stripping binaries.
+                 Use sstrip's -z option to discard trailing zero bytes
 
        config STRIP_KERNEL_EXPORTS
                bool "Strip unnecessary exports from the kernel image"
@@ -269,6 +293,8 @@ menu "Global build settings"
                        bool "Regular"
                config PKG_CC_STACKPROTECTOR_STRONG
                        bool "Strong"
+               config PKG_CC_STACKPROTECTOR_ALL
+                       bool "All"
        endchoice
 
        choice