From d316ac32430fc086bc32c1bc5a9d76321930c721 Mon Sep 17 00:00:00 2001
From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Mon, 27 Oct 2025 09:32:08 +0100
Subject: [PATCH] ci(aarch64): no -fcf-protection=full on aarch64

---
 .github/workflows/build-and-test-all.yml | 2 ++
 tasks.py                                 | 8 +++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-and-test-all.yml b/.github/workflows/build-and-test-all.yml
index e86192ffa2..414adfa04c 100644
--- a/.github/workflows/build-and-test-all.yml
+++ b/.github/workflows/build-and-test-all.yml
@@ -238,6 +238,8 @@ jobs:
             features: least
           - architecture_suffix: '-arm'
             builder: autotools
+          - architecture_suffix: '-arm'
+            features: least
       fail-fast: false
     container:
       image: "${{ needs.get-runner-container-image.outputs.id }}:${{ needs.get-runner-container-image.outputs.tag }}"
diff --git a/tasks.py b/tasks.py
index a3e4fe96d2..ebc034356d 100644
--- a/tasks.py
+++ b/tasks.py
@@ -1,6 +1,7 @@
 import os
 import time
 import json
+import platform
 import requests
 from invoke import task
 from invoke.exceptions import Failure, UnexpectedExit
@@ -454,6 +455,12 @@ def get_optimizations():
     optimizations = os.getenv('OPTIMIZATIONS', 'yes')
     return '-O1' if optimizations == 'yes' else '-O0'
 
+def get_protections():
+    if platform.machine() in ['aarch64', 'arm64']:
+        return "-fcf-protection=check",
+    return "-fcf-protection=full",
+
+
 def get_cflags():
     return " ".join([
         get_optimizations(),
@@ -463,7 +470,6 @@ def get_cflags():
         "-Werror=format-security",
         "-fstack-clash-protection",
         "-fstack-protector-strong",
-        "-fcf-protection=full",
         "-Werror=string-plus-int" if is_compiler_clang() else '',
     ])
 
-- 
2.47.3