# 开发阶段（调试 + 警告 + 基本优化）
CFLAGS_DEV="-std=c17 -Wall -Wextra -Wpedantic -g -Og -fno-omit-frame-pointer"

# CI 阶段（严格警告 + Sanitizer）
CFLAGS_CI="-std=c17 -Wall -Wextra -Wpedantic -Werror \
    -Wshadow -Wconversion -Wformat=2 \
    -fsanitize=address,undefined -fno-omit-frame-pointer"

# 生产构建（优化 + 安全加固）
CFLAGS_PROD="-std=c17 -Wall -Wextra -O2 -DNDEBUG \
    -fstack-protector-strong \
    -D_FORTIFY_SOURCE=2 \
    -Wformat -Wformat-security \
    -fPIE"

LDFLAGS_PROD="-Wl,-z,relro,-z,now -Wl,-z,noexecstack -pie"

CXXFLAGS="-std=c++17 -Wall -Wextra -Wpedantic -Werror \
    -Wshadow -Wconversion -Wold-style-cast \
    -Woverloaded-virtual -Wnon-virtual-dtor \
    -Wcast-align -Wcast-qual \
    -g -O2"

# 启用安全 STL 检查
CXXFLAGS += -D_GLIBCXX_ASSERTIONS

# 基本栈保护（canary 检测栈溢出）
gcc -fstack-protector -o hello main.c

# 强栈保护（推荐，保护更多函数）
gcc -fstack-protector-strong -o hello main.c

# 所有函数栈保护（开销较大）
gcc -fstack-protector-all -o hello main.c

# FORTIFY_SOURCE: 编译时和运行时检查缓冲区溢出
gcc -D_FORTIFY_SOURCE=2 -O2 -o hello main.c

# 检测的函数包括:
# memcpy, memmove, memset, strcpy, strncpy, strcat, strncat
# sprintf, snprintf, vsprintf, vsnprintf, gets, fgets
# 以及更多字符串和内存操作函数

# FORTIFY_SOURCE=1: 编译时已知大小的检查
# FORTIFY_SOURCE=2: 更严格的检查（-O2 时有效）

# PIE: 启用 ASLR（地址空间布局随机化）
gcc -fPIE -pie -o hello main.c

# 共享库始终需要 -fPIC
gcc -fPIC -shared -o libhello.so hello.c

# 部分 RELRO: .got 只读
gcc -Wl,-z,relro -o hello main.c

# 完全 RELRO: .got 和 .plt 都只读（推荐，启动略慢）
gcc -Wl,-z,relro,-z,now -o hello main.c

# 不可执行栈
gcc -Wl,-z,noexecstack -o hello main.c

# 禁止堆可执行
gcc -Wl,-z,noexecheap -o hello main.c

# 符号版本绑定
gcc -Wl,-z,defs -o hello main.c       # 检查所有符号已定义
gcc -Wl,--as-needed -o hello main.c   # 只链接实际使用的库

# Makefile.best-practices
CC = gcc
CXX = g++
CFLAGS = -std=c17
CXXFLAGS = -std=c++17

# 警告（始终启用）
WARNINGS = -Wall -Wextra -Wpedantic -Wshadow -Wconversion -Wformat=2
WARNINGS += -Wnull-dereference -Wdouble-promotion

# 特定于 C++ 的警告
CXX_WARNINGS = $(WARNINGS) -Wold-style-cast -Woverloaded-virtual
CXX_WARNINGS += -Wnon-virtual-dtor -Wcast-align -Wcast-qual

# 构建类型
ifdef DEBUG
    CFLAGS += -g3 -O0 -fsanitize=address,undefined
    CXXFLAGS += -g3 -O0 -fsanitize=address,undefined
    LDFLAGS += -fsanitize=address,undefined
else ifdef CI
    CFLAGS += -Werror -fsanitize=address,undefined -g -O1
    CXXFLAGS += -Werror -fsanitize=address,undefined -g -O1
    LDFLAGS += -fsanitize=address,undefined
else
    # Release 构建
    CFLAGS += -O2 -DNDEBUG -fstack-protector-strong -D_FORTIFY_SOURCE=2
    CXXFLAGS += -O2 -DNDEBUG -fstack-protector-strong -D_FORTIFY_SOURCE=2
    CXXFLAGS += -D_GLIBCXX_ASSERTIONS
    LDFLAGS += -Wl,-z,relro,-z,now -Wl,-z,noexecstack -pie
    LDFLAGS += -Wl,--as-needed
endif

# 源文件和目标
SRCDIR = src
OBJDIR = obj
SRCS_C = $(wildcard $(SRCDIR)/*.c)
SRCS_CPP = $(wildcard $(SRCDIR)/*.cpp)
OBJS_C = $(patsubst $(SRCDIR)/%.c,$(OBJDIR)/%.o,$(SRCS_C))
OBJS_CPP = $(patsubst $(SRCDIR)/%.cpp,$(OBJDIR)/%.o,$(SRCS_CPP))
OBJS = $(OBJS_C) $(OBJS_CPP)
TARGET = hello

# 依赖生成
DEPFLAGS = -MMD -MP

# 构建规则
all: $(TARGET)

$(TARGET): $(OBJS)
	$(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS)

$(OBJDIR)/%.o: $(SRCDIR)/%.c | $(OBJDIR)
	$(CC) $(CFLAGS) $(WARNINGS) $(DEPFLAGS) -c -o $@ $<

$(OBJDIR)/%.o: $(SRCDIR)/%.cpp | $(OBJDIR)
	$(CXX) $(CXXFLAGS) $(CXX_WARNINGS) $(DEPFLAGS) -c -o $@ $<

$(OBJDIR):
	mkdir -p $(OBJDIR)

# 自动依赖
-include $(OBJS:.o=.d)

# 清理
clean:
	rm -rf $(OBJDIR) $(TARGET)

# 静态分析
analyze:
	cppcheck --enable=all --std=c17 --suppress=missingIncludeSystem \
	    -I include $(SRCDIR)/

# 格式化
format:
	find src include -name '*.c' -o -name '*.h' -o -name '*.cpp' \
	    -o -name '*.hpp' | xargs clang-format -i

.PHONY: all clean analyze format

cmake_minimum_required(VERSION 3.20)
project(MyProject VERSION 1.0.0 LANGUAGES C CXX)

# 编译器检查
if(NOT CMAKE_C_COMPILER_ID STREQUAL "GNU")
    message(WARNING "This project is optimized for GCC")
endif()

# 编译标准
set(CMAKE_C_STANDARD 17)
set(CMAKE_C_STANDARD_REQUIRED ON)
set(CMAKE_CXX_STANDARD 17)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_EXTENSIONS OFF)

# 安全编译选项
add_compile_options(
    -Wall -Wextra -Wpedantic
    -fstack-protector-strong
    -Wformat -Wformat-security
)

if(CMAKE_BUILD_TYPE STREQUAL "Release")
    add_compile_definitions(
        _FORTIFY_SOURCE=2
        NDEBUG
    )
    add_compile_options(-O2)
    add_link_options(
        -Wl,-z,relro,-z,now
        -Wl,-z,noexecstack
        -pie
        -Wl,--as-needed
    )
endif()

# Sanitizer 选项
option(ENABLE_ASAN "Enable AddressSanitizer" OFF)
option(ENABLE_UBSAN "Enable UndefinedBehaviorSanitizer" OFF)

if(ENABLE_ASAN)
    add_compile_options(-fsanitize=address -fno-omit-frame-pointer)
    add_link_options(-fsanitize=address)
endif()

if(ENABLE_UBSAN)
    add_compile_options(-fsanitize=undefined)
    add_link_options(-fsanitize=undefined)
endif()

# 目标
add_executable(hello src/main.c)
target_link_libraries(hello PRIVATE m pthread)

# 安装
install(TARGETS hello RUNTIME DESTINATION bin)

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        build_type: [Debug, Release, Sanitized]

    steps:
    - uses: actions/checkout@v4

    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y gcc-13 g++-13 cmake ninja-build

    - name: Configure
      run: |
        cmake -B build -G Ninja \
          -DCMAKE_C_COMPILER=gcc-13 \
          -DCMAKE_CXX_COMPILER=g++-13 \
          -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} \
          ${{ matrix.build_type == 'Sanitized' && '-DENABLE_ASAN=ON -DENABLE_UBSAN=ON' || '' }}

    - name: Build
      run: cmake --build build

    - name: Test
      run: cd build && ctest --output-on-failure

    - name: Static Analysis
      if: matrix.build_type == 'Debug'
      run: |
        sudo apt-get install -y cppcheck
        cppcheck --enable=all --error-exitcode=1 --std=c17 src/

  cross-compile:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [aarch64, armhf]

    steps:
    - uses: actions/checkout@v4

    - name: Install cross-compiler
      run: |
        sudo apt-get update
        sudo apt-get install -y gcc-${{ matrix.arch }}-linux-gnu cmake

    - name: Build
      run: |
        cmake -B build \
          -DCMAKE_C_COMPILER=${{ matrix.arch }}-linux-gnu-gcc \
          -DCMAKE_TOOLCHAIN_FILE=cmake/${{ matrix.arch }}.cmake
        cmake --build build

# .gitlab-ci.yml
stages: [build, test, analyze, deploy]

variables:
  GIT_SUBMODULE_STRATEGY: recursive

.build_template: &build_template
  stage: build
  script:
    - cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=$BUILD_TYPE
    - cmake --build build
  artifacts:
    paths: [build/]

build-debug:
  <<: *build_template
  image: gcc:13
  variables:
    BUILD_TYPE: Debug

build-release:
  <<: *build_template
  image: gcc:13
  variables:
    BUILD_TYPE: Release

test:
  stage: test
  image: gcc:13
  script:
    - cd build && ctest --output-on-failure

static-analysis:
  stage: analyze
  image: gcc:13
  script:
    - apt-get update && apt-get install -y cppcheck
    - cppcheck --enable=all --error-exitcode=1 --std=c17 src/
  allow_failure: false

sanitizer:
  stage: test
  image: gcc:13
  script:
    - cmake -B build-asan -DENABLE_ASAN=ON -DENABLE_UBSAN=ON
    - cmake --build build-asan
    - cd build-asan && ctest --output-on-failure

# 检查安全加固
checksec --file=./hello
# 或手动检查
readelf -l hello | grep -i "GNU_RELRO"
readelf -d hello | grep -i "BIND_NOW"
readelf -h hello | grep -i "Type:"  # 应为 DYN（PIE）
file hello  # 应显示 "pie executable"

# 检查符号表
nm hello | grep -i " T "  # 导出的函数
strip hello  # 生产部署前去除调试信息（保留分离的调试文件）

# 安装
sudo apt install clang-tidy

# 使用 CMake 编译数据库
cmake -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
clang-tidy -p build src/*.c

# .clang-format
BasedOnStyle: Google
IndentWidth: 4
ColumnLimit: 100
AllowShortFunctionsOnASingleLine: None

# 运行静态分析
cppcheck --enable=all --std=c17 --suppress=missingIncludeSystem \
    -I include --error-exitcode=1 src/

# 使用 include-what-you-use
sudo apt install iwyu
cmake -B build -DCMAKE_CXX_INCLUDE_WHAT_YOU_USE=include-what-you-use
cmake --build build 2>&1 | grep "should add\|should remove"

# 安装 ccache
sudo apt install ccache

# 配置
export CC="ccache gcc"
export CXX="ccache g++"

# 或在 CMake 中
cmake -B build -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache

# 查看缓存状态
ccache -s

# CMake 预编译头
target_precompile_headers(hello PRIVATE
    <stdio.h>
    <stdlib.h>
    <string.h>
    "common_header.h"
)

# Ninja 比 Make 更快（增量构建时优势明显）
cmake -B build -G Ninja
cmake --build build

# 从 Git 获取版本信息
execute_process(
    COMMAND git describe --tags --always --dirty
    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
    OUTPUT_VARIABLE GIT_VERSION
    OUTPUT_STRIP_TRAILING_WHITESPACE
    ERROR_QUIET
)

execute_process(
    COMMAND git rev-parse --short HEAD
    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
    OUTPUT_VARIABLE GIT_HASH
    OUTPUT_STRIP_TRAILING_WHITESPACE
)

target_compile_definitions(hello PRIVATE
    GIT_VERSION="${GIT_VERSION}"
    GIT_HASH="${GIT_HASH}"
    BUILD_DATE="${CMAKE_SYSTEM}"
)

#include <stdio.h>

void print_version(void) {
    printf("Version:  %s\n", GIT_VERSION);
    printf("Git Hash: %s\n", GIT_HASH);
    printf("Build:    %s\n", BUILD_DATE);
    printf("Compiler: GCC %d.%d.%d\n", __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__);
}

gcc -std=c17 -Wall -Wextra -Wpedantic -g -Og -fno-omit-frame-pointer \
    -fsanitize=address,undefined \
    -o hello main.c

gcc -std=c17 -Wall -Wextra -Wpedantic -Werror -Wshadow -Wconversion \
    -fsanitize=address,undefined -fno-omit-frame-pointer \
    -o hello main.c

# 编译
gcc -std=c17 -Wall -Wextra -O2 -DNDEBUG \
    -fstack-protector-strong -D_FORTIFY_SOURCE=2 \
    -fPIE -g \
    -o hello main.c

# 链接
gcc -Wl,-z,relro,-z,now -Wl,-z,noexecstack -pie -Wl,--as-needed \
    -o hello main.o

# 部署
objcopy --only-keep-debug hello hello.debug
strip hello
objcopy --add-gnu-debuglink=hello.debug hello