Build with all hardening flags

diff --git a/debian/changelog b/debian/changelog
index 5a9701859d0440e479caa42eafb45aceae3d83c3..b7548ff98825a5e5e73d305d996a4789b436c2ec 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,7 @@ babl (0.1.34-1) UNRELEASED; urgency=medium
   * Switch from cdbs to dh
   * Set Debian GNOME team as maintainer and update Vcs fields
   * Switch to automatic dbgsym packages
+  * Build with all hardening flags
   * Bump Standards-Version to 4.1.1
 
  -- Jeremy Bicha <jbicha@debian.org>  Sat, 14 Oct 2017 14:10:57 -0400

diff --git a/debian/rules b/debian/rules
index 036a41b35c42d4c0cdd479caa900e488c865ff4f..d269c0a29f1e5370f33190c9a42676bc46124ef8 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -1,7 +1,8 @@
 #!/usr/bin/make -f
 -include /usr/share/gnome-pkg-tools/1/rules/gnome-get-source.mk
 
-export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+export DEB_LDFLAGS_MAINT_APPEND = -Wl,-O1 -Wl,--as-needed
 
 # Disable SSE2 except on amd64
 ifneq ($(DEB_HOST_ARCH_CPU),amd64)