makepkg.conf

#
# /etc/makepkg.conf
#

#########################################################################
# SOURCE ACQUISITION
#########################################################################
#
#-- The download utilities that makepkg should use to acquire sources
#  Format: 'protocol::agent'
#DLAGENTS=('file::/usr/bin/curl -qgC - -o %o %u'
#          'ftp::/usr/bin/curl -qgfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
#          'http::/usr/bin/curl -qgb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
#          'https::/usr/bin/curl -qgb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
#          'rsync::/usr/bin/rsync --no-motd -z %u %o'
#          'scp::/usr/bin/scp -C %u %o')
DLAGENTS=('file::/usr/bin/aria2c --allow-overwrite=true --continue=true --file-allocation=none --log-level=error --max-tries=2 --max-connection-per-server=2 --max-file-not-found=5 --min-split-size=5M --no-conf --remote-time=true --summary-interval=60 --timeout=5 --out %o %u'
          'ftp::/usr/bin/aria2c --allow-overwrite=true --continue=true --file-allocation=none --log-level=error --max-tries=2 --max-connection-per-server=2 --max-file-not-found=5 --min-split-size=5M --no-conf --remote-time=true --summary-interval=60 --timeout=5 --out %o %u'
          'http::/usr/bin/aria2c --allow-overwrite=true --continue=true --file-allocation=none --log-level=error --max-tries=2 --max-connection-per-server=2 --max-file-not-found=5 --min-split-size=5M --no-conf --remote-time=true --summary-interval=60 --timeout=5 --out %o %u'
          'https::/usr/bin/aria2c --allow-overwrite=true --continue=true --file-allocation=none --log-level=error --max-tries=2 --max-connection-per-server=2 --max-file-not-found=5 --min-split-size=5M --no-conf --remote-time=true --summary-interval=60 --timeout=5 --out %o %u'
          'rsync::/usr/bin/rsync --no-motd -z %u %o'
          'scp::/usr/bin/scp -C %u %o')

# Other common tools:
# /usr/bin/snarf
# /usr/bin/lftpget -c
# /usr/bin/wget

#-- The package required by makepkg to download VCS sources
#  Format: 'protocol::package'
VCSCLIENTS=('bzr::bzr'
            'fossil::fossil'
            'git::git'
            'hg::mercurial'
            'svn::subversion')

#########################################################################
# ARCHITECTURE, COMPILE FLAGS
#########################################################################
#
CARCH="x86_64"
CHOST="x86_64-pc-linux-gnu"

#-- Compiler and Linker Flags
#CPPFLAGS=""
if [[ $CC == clang ]]; then
OBJCXX='clang++'
CPPFLAGS="-Wp,-D_FORTIFY_SOURCE=2"
CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
-Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security \
-Wtautological-compare -Wsign-compare \
-gfull -fstandalone-debug -gdwarf-4 \
-fPIC \
-ffunction-sections -fdata-sections \
-U_FORTIFY_SOURCE \
-fstack-protector-all \
-fstack-clash-protection \
-fcf-protection=full \
"
#CFI failure module
#-fsanitize=cfi -fvisibility=hidden
#-fforce-emit-vtables \
#-fno-stack-protector \
#
#-fintegrated-as -fintegrated-cc1 \
#-pipe -fno-plt -fexceptions \
#-fstack-protector-all \
#-fstack-clash-protection \
#-fcf-protection=full \
#-fsanitize-trap \
#-fno-omit-frame-pointer -fno-optimize-sibling-calls -fno-common \
#"

# zig cc
#-fPIE -fpie \

#-fwhole-program-vtables -fvirtual-function-elimination \
#-fsanitize=cfi -fvisibility=default \
#-fno-sanitize-recover=all \
#-fsanitize=safe-stack \
#-fsanitize-address-use-after-scope -fsanitize-address-use-after-return=always -fsanitize-address-use-odr-indicator -fno-omit-frame-pointer -fno-optimize-sibling-calls -fno-common \

CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"

#-faddrsig \
#-fno-sanitize-recover=all \
#-fsanitize-address-use-after-scope -fsanitize-address-use-after-return=always -fsanitize-address-use-odr-indicator -fno-omit-frame-pointer -fno-optimize-sibling-calls -fno-common \
#-fsanitize=undefined -fsanitize=integer \
#-fsanitize=cfi -fvisibility=default \
#-fsanitize=cfi -fvisibility=hidden \
#-fsanitize=integer \
#-fsanitize=safe-stack \
#-fsanitize=integer \

#SAN_OPTIONS="detect_leaks=1:strict_init_order=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_string_checks=1:detect_invalid_pointer_pairs=2:use_odr_indicator=1:abort_on_error=0"

#LDFLAGS="-flto -fuse-linker-plugin -fPIC -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack"
#LDFLAGS="-flto=full -fPIE -fpie -Wl,-z,noexecstack -Wl,--gc-sections -fno-plt -Wl,-z,relro,-z,now -Wl,-z,combreloc,-z,copyreloc,-z,notext,-z,ifunc-noplt \
LDFLAGS="-fuse-ld=mold -Wl,-z,relro,-z,now \
"
#
#-mguard=cf \

#-fno-plt
#-Wl,--no-undefined \

#-Wl,-z,noexecstack
#
#-fsanitize=cfi -fvisibility=hidden \
#-Wl,--icf=all \
#-fsanitize=safe-stack \
#-faddrsig -Wl,--icf=all -fsanitize=safe-stack \

#"-static -static-libsan -static-pie -lasan"
#LTOFLAGS="-flto -fsanitize=cfi -fvisibility=hidden"
#LTOFLAGS="-flto=full"
#LTOFLAGS="-flto=full -fuse-ld=mold -ffat-lto-objects"
LTOFLAGS="-flto=full"
else
OBJCXX=g++
#CPPFLAGS="-Wp,-D_FORTIFY_SOURCE=2 -D_FORTIFY_SOURCE=2"
CPPFLAGS="-Wp,-D_FORTIFY_SOURCE=2"
#CPPFLAGS=""
#-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
-Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security \
-Wtautological-compare -Wsign-compare \
-gdwarf-4 \
-fPIC \
-ffunction-sections -fdata-sections \
-fstack-protector-all \
-fstack-clash-protection \
-fcf-protection=full \
-U_FORTIFY_SOURCE \
"
#-fwhole-program \
#-fPIE -fpie
#-gz
#-Wrestrict \
#-ftrapv -Wformat-security \
#-fstack-clash-protection -fcf-protection \
#-fstack-protector-all \
#-fno-sanitize-recover=all \
#-fstack-clash-protection \
#-fstack-protector \
#-fsplit-stack \
#-fsanitize=address \
CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"
LDFLAGS="-fuse-ld=lld -Wl,-z,relro,-z,now"
LTOFLAGS="-flto=auto -fuse-linker-plugin -ffat-lto-objects"
fi
#RUSTFLAGS="-C opt-level=2"
RUSTFLAGS="-Cforce-frame-pointers=yes"
#-- Make Flags: change this for DistCC/SMP systems
MAKEFLAGS="-j$(($(nproc)+1))"
#-- Debugging flags
DEBUG_CFLAGS="-g"
DEBUG_CXXFLAGS="$DEBUG_CFLAGS"
DEBUG_RUSTFLAGS="-C debuginfo=2"

#########################################################################
# BUILD ENVIRONMENT
#########################################################################
#
# Makepkg defaults: BUILDENV=(!distcc !color !ccache check !sign)
#  A negated environment option will do the opposite of the comments below.
#
#-- distcc:   Use the Distributed C/C++/ObjC compiler
#-- color:    Colorize output messages
#-- ccache:   Use ccache to cache compilation
#-- check:    Run the check() function if present in the PKGBUILD
#-- sign:     Generate PGP signature file
#
BUILDENV=(!distcc color !ccache check !sign)
#
#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
#-- specify a space-delimited list of hosts running in the DistCC cluster.
#DISTCC_HOSTS=""
#
#-- Specify a directory for package building.
#BUILDDIR=/tmp/makepkg

#########################################################################
# GLOBAL PACKAGE OPTIONS
#   These are default values for the options=() settings
#########################################################################
#
# Makepkg defaults: OPTIONS=(!strip docs libtool staticlibs emptydirs !zipman !purge !debug !lto)
#  A negated option will do the opposite of the comments below.
#
#-- strip:      Strip symbols from binaries/libraries
#-- docs:       Save doc directories specified by DOC_DIRS
#-- libtool:    Leave libtool (.la) files in packages
#-- staticlibs: Leave static library (.a) files in packages
#-- emptydirs:  Leave empty directories in packages
#-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
#-- purge:      Remove files specified by PURGE_TARGETS
#-- debug:      Add debugging flags as specified in DEBUG_* variables
#-- lto:        Add compile flags for building with link time optimization
#
OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)

#-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
INTEGRITY_CHECK=(sha256)
#-- Options to be used when stripping binaries. See `man strip' for details.
STRIP_BINARIES="--strip-all"
#-- Options to be used when stripping shared libraries. See `man strip' for details.
STRIP_SHARED="--strip-unneeded"
#-- Options to be used when stripping static libraries. See `man strip' for details.
STRIP_STATIC="--strip-debug"
#-- Manual (man and info) directories to compress (if zipman is specified)
MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
#-- Doc directories to remove (if !docs is specified)
DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
#-- Files to be removed from all packages (if purge is specified)
PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
#-- Directory to store source code in for debug packages
DBGSRCDIR="/usr/src/debug"

#########################################################################
# PACKAGE OUTPUT
#########################################################################
#
# Default: put built package and cached source in build directory
#
#-- Destination: specify a fixed directory where all packages will be placed
#PKGDEST=/home/packages
#-- Source cache: specify a fixed directory where source files will be cached
#SRCDEST=/home/sources
#-- Source packages: specify a fixed directory where all src packages will be placed
#SRCPKGDEST=/home/srcpackages
#-- Log files: specify a fixed directory where all log files will be placed
#LOGDEST=/home/makepkglogs
#-- Packager: name/email of the person or organization building packages
#PACKAGER="John Doe <john@doe.com>"
PACKAGER="Masato TOYOSHIMA <phoepsilonix@phoepsilonix.love>"
#-- Specify a key to use for package signing
GPGKEY="57B49CC5AA4F00FC"

#########################################################################
# COMPRESSION DEFAULTS
#########################################################################
#
COMPRESSGZ=(gzip -c -f -n)
COMPRESSBZ2=(bzip2 -c -f)
COMPRESSXZ=(xz -T0 -e -9 -c -z -)
#COMPRESSZST=(zstd --auto-threads=physical -T0 -c -z -q --ultra -9 -)
COMPRESSZST=(zstd --auto-threads=physical -T0 -c -z -q --ultra -22 -)
COMPRESSLRZ=(lrzip -q)
COMPRESSLZO=(lzop -q)
COMPRESSZ=(compress -c -f)
COMPRESSLZ4=(lz4 -q)
COMPRESSLZ=(lzip -c -f)
#COMPRESSBR=(brotli -c -Z -)

#########################################################################
# EXTENSION DEFAULTS
#########################################################################
#
#PKGEXT='.pkg.tar.br'
#PKGEXT='.pkg.tar.xz'
PKGEXT='.pkg.tar.zst'
SRCEXT='.src.tar.gz'

#########################################################################
# OTHER
#########################################################################
#
#-- Command used to run pacman as root, instead of trying sudo and su
#PACMAN_AUTH=()