GHA CI: enable run-time checks in C++ library

[Chocobo1]

Those have minimal impact on run-time:
https://www.gnu.org/software/libc/manual/html_node/Source-Fortification.html
https://bugs.launchpad.net/kicad/+bug/1838448/comments/40

[xavier2k6]

Did you do any testing with -D_FORTIFY_SOURCE=3?

I came across arvidn/libtorrent#7519 which references below:

• Increase _FORTIFY_SOURCE level to 3
• GCC's new fortification level: The gains and costs

[Chocobo1]

Did you do any testing with -D_FORTIFY_SOURCE=3?

I haven't really checked but I think the compiler/library in CI isn't modern enough to support -D_FORTIFY_SOURCE=3.

[glassez]

Did you do any testing with -D_FORTIFY_SOURCE=3?

According to docs:

Fortification at this level may have a impact on program performance

I would not add to the CI build configurations anything that could significantly reduce performance or add any significant differences from the release builds, as this may give false/unsuitable test results.

[xavier2k6]

Fortification at this level may have a impact on program performance

https://siddhesh.in/posts/fortify-source-3-performance.html

[Chocobo1]

I would not add to the CI build configurations anything that could significantly reduce performance

I agree with the significantly part. Talking about D_FORTIFY_SOURCE=2, I'm not aware users on those distros are reporting such problems and nor do I have ever notice anything from the flag.
Also performance is not a top priority for CI binaries, instead, it is correctness and catching bugs.

_FORTIFY_SOURCE=2 is already in use in ubuntu (for their official software packages): https://wiki.ubuntu.com/ToolChain/CompilerFlags#A-D_FORTIFY_SOURCE.3D2
and fedora: https://fedoraproject.org/wiki/Changes/Add_FORTIFY_SOURCE%3D3_to_distribution_build_flags#Detailed_Description

or add any significant differences from the release builds, as this may give false/unsuitable test results.

I would rather expect the flag to expose valid bugs than to worry about negative side effects.

Also there are other security hardening flags but they won't help catching bugs so I didn't bother. (those are better suited for final release builds)

[xavier2k6]

In case anyone is interested, I've used (D_FORTIFY_SOURCE=3) via 24.04 image in https://github.com/xavier2k6/qBittorrent/actions/runs/11084022076

[Chocobo1]

In case anyone is interested, I've used (D_FORTIFY_SOURCE=3) via 24.04 image in https://github.com/xavier2k6/qBittorrent/actions/runs/11084022076

👍 Please make a PR.

[xavier2k6]

Please make a PR.

Currently GHA are migrating ubuntu-latest to use the 24.04 image by default, this is happening from 25th Sept -> Oct 30th.

See: actions/runner-images#10636

As soon as this is done/qBittorrent repo is migrated to use these runners- will open a PR then.