From 1e580bc97d257512ac07b494d485b877a2d3372c Mon Sep 17 00:00:00 2001
From: Raymond Zhao <7199958+rzhao271@users.noreply.github.com>
Date: Mon, 21 Oct 2024 10:53:34 -0700
Subject: [PATCH] fix: CLI is missing guard:cf flags (#231863)

---
 build/azure-pipelines/win32/cli-build-win32.yml | 6 ++++--
 cli/.cargo/config.toml                          | 2 ++
 cli/CONTRIBUTING.md                             | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)
 create mode 100644 cli/.cargo/config.toml

diff --git a/build/azure-pipelines/win32/cli-build-win32.yml b/build/azure-pipelines/win32/cli-build-win32.yml
index 19409272ff0..0525933902a 100644
--- a/build/azure-pipelines/win32/cli-build-win32.yml
+++ b/build/azure-pipelines/win32/cli-build-win32.yml
@@ -53,7 +53,8 @@ steps:
         VSCODE_CLI_ENV:
           OPENSSL_LIB_DIR: $(Build.ArtifactStagingDirectory)/openssl/x64-windows-static/lib
           OPENSSL_INCLUDE_DIR: $(Build.ArtifactStagingDirectory)/openssl/x64-windows-static/include
-          RUSTFLAGS: "-C target-feature=+crt-static"
+          RUSTFLAGS: "-Ctarget-feature=+crt-static -Clink-args=/guard:cf -Clink-args=/CETCOMPAT"
+          CFLAGS: "/guard:cf /Qspectre"
 
   - ${{ if eq(parameters.VSCODE_BUILD_WIN32_ARM64, true) }}:
     - template: ../cli/cli-compile.yml@self
@@ -65,7 +66,8 @@ steps:
         VSCODE_CLI_ENV:
           OPENSSL_LIB_DIR: $(Build.ArtifactStagingDirectory)/openssl/arm64-windows-static/lib
           OPENSSL_INCLUDE_DIR: $(Build.ArtifactStagingDirectory)/openssl/arm64-windows-static/include
-          RUSTFLAGS: "-C target-feature=+crt-static"
+          RUSTFLAGS: "-C target-feature=+crt-static -Clink-args=/guard:cf -Clink-args=/CETCOMPAT"
+          CFLAGS: "/guard:cf /Qspectre"
 
   - ${{ if not(parameters.VSCODE_CHECK_ONLY) }}:
     - ${{ if eq(parameters.VSCODE_BUILD_WIN32_ARM64, true) }}:
diff --git a/cli/.cargo/config.toml b/cli/.cargo/config.toml
new file mode 100644
index 00000000000..12558eb9668
--- /dev/null
+++ b/cli/.cargo/config.toml
@@ -0,0 +1,2 @@
+[target.'cfg(target_os = "windows")']
+rustflags = ["-Ctarget-feature=+crt-static", "-Clink-args=/guard:cf", "-Clink-args=/CETCOMPAT"]
diff --git a/cli/CONTRIBUTING.md b/cli/CONTRIBUTING.md
index d119f1ac98a..4809fccd080 100644
--- a/cli/CONTRIBUTING.md
+++ b/cli/CONTRIBUTING.md
@@ -8,7 +8,7 @@
 
 For the moment, we require OpenSSL on Windows, where it is not usually installed by default. To install it:
 
-1. Install (clone) vcpkg [using their instructions](https://github.com/Microsoft/vcpkg#quick-start-windows)
+1. Follow steps 1 and 2 of [Set up vcpkg](https://learn.microsoft.com/en-us/vcpkg/get_started/get-started-msbuild?pivots=shell-powershell#1---set-up-vcpkg) to obtain the executable.
 1. Add the location of the `vcpkg` directory to your system or user PATH.
 1. Run`vcpkg install openssl:x64-windows-static-md` (after restarting your terminal for PATH changes to apply)
 1. You should be able to then `cargo build` successfully