Failure when CFLAGS provides -O3 (#900)

* Failure when CFLAGS provides -O3

* Ensure jitter entropy compiled w/o optimizations

Author: justsmth

.github/workflows/tests.yml

@@ -603,3 +603,23 @@ jobs:
       - name: Run cargo test
         working-directory: "path has spaces/aws-lc-rs"
         run: cargo test --tests -p aws-lc-rs --features bindgen
+
+  hostile-environment:
+    if: github.repository_owner == 'aws'
+    name: Hostile environment
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ ubuntu-latest, macos-latest ]
+    env:
+      CFLAGS: '-O3'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Run tests
+        run: cargo test -p aws-lc-rs --all-targets
+      - name: Run tests w/ FIPS
+        run: cargo test -p aws-lc-rs --all-targets --features fips

aws-lc-sys/builder/cc_builder.rs

@@ -16,8 +16,8 @@ mod x86_64_unknown_linux_musl;
 
 use crate::{
     cargo_env, effective_target, emit_warning, env_var_to_bool, execute_command, get_crate_cflags,
-    is_no_asm, optional_env_optional_crate_target, out_dir, requested_c_std, set_env_for_target,
-    target, target_arch, target_env, target_os, CStdRequested, OutputLibType,
+    is_no_asm, optional_env_optional_crate_target, optional_env_target, out_dir, requested_c_std,
+    set_env_for_target, target, target_arch, target_env, target_os, CStdRequested, OutputLibType,
 };
 use std::cell::Cell;
 use std::collections::HashMap;
@@ -373,7 +373,19 @@ impl CcBuilder {
             option.apply_cc(&mut je_builder);
         }
 
-        let compiler = je_builder.get_compiler();
+        let compiler = if let Some(original_cflags) = optional_env_target("CFLAGS") {
+            let mut new_cflags = original_cflags.clone();
+            new_cflags.push_str(" -O0");
+            set_env_for_target("CFLAGS", &new_cflags);
+            // cc-rs currently prioritizes flags provided by CFLAGS over the flags provided by the build script.
+            // The environment variables used by the compiler are set when `get_compiler` is called.
+            let compiler = je_builder.get_compiler();
+            set_env_for_target("CFLAGS", &original_cflags);
+            compiler
+        } else {
+            je_builder.get_compiler()
+        };
+
         je_builder.define("AWSLC", "1");
         je_builder.pic(true);
         if target_os() == "windows" && compiler.is_like_msvc() {
@@ -391,6 +403,7 @@ impl CcBuilder {
                 .flag("-Wextra")
                 .flag("-Wall")
                 .flag("-pedantic")
+                // Compilation will fail if optimizations are enabled.
                 .flag("-O0")
                 .flag("-fwrapv")
                 .flag("-Wconversion");