Add branch protection for aarch64 builds

[marta-lewandowska]

Add stack protection so that aarch64 binaries are better protected: https://sourceware.org/annobin/annobin.html/Test-branch-protection.html and so that annocheck tests stop failing
https://artifacts.osci.redhat.com/testing-farm/d3efc626-605d-4ffc-9c42-2f859c5b6111/ :
Hardened: ./usr/bin/pesign: FAIL: dynamic-tags test because the BTI_PLT flag is missing from the dynamic tags

[marta-lewandowska]

Not sure where / how to add the note section. The stack protection might need that to function properly.
FAIL: property-note test because no .note.gnu.property section found

[vathpela]

works for me:

Linux gb10 7.0.10-200.fc44.aarch64 #1 SMP PREEMPT_DYNAMIC Sat May 23 15:23:04 UTC 2026 aarch64 GNU/Linux
gb10:~/devel/github.com/pesign/add_branch_protection$ make clean all >& /dev/null
gb10:~/devel/github.com/pesign/add_branch_protection$ annocheck -v src/authvar
annocheck: Version 13.14.
Hardened: src/authvar: info: No matching profile found.
Hardened: src/authvar: PASS: pie test because the ELF file header has the correct type
Hardened: src/authvar: info: written in C (source: DW_AT_language string).
Hardened: src/authvar: PASS: pic test because option found in DW_AT_producer string
Hardened: src/authvar: PASS: stack-prot test because option found in DW_AT_producer string
Hardened: src/authvar: PASS: stack-clash test because option found in DW_AT_producer string
Hardened: src/authvar: PASS: optimization test because option found in DW_AT_producer string
Hardened: src/authvar: PASS: fortify test because option found in DW_AT_producer string
Hardened: src/authvar: PASS: branch-protection test because correct option found in DW_AT_producer string
Hardened: src/authvar: PASS: writable-got test because section headers look good
Hardened: src/authvar: PASS: dynamic-segment test because dynamic section found
Hardened: src/authvar: PASS: bind-now test because BIND_NOW dynamic flag seen
Hardened: src/authvar: PASS: dynamic-tags test because the BTI_PLT flag is present in the dynamic tags
Hardened: src/authvar: PASS: notes test because annobin notes found in the .annobin.notes section
Hardened: src/authvar: skip: fast test because function abi-note.c is part of the C library's static code and does use math functions
Hardened: src/authvar: skip: lto test because function abi-note.c is part of the C library which is deliberately built without LTO
Hardened: src/authvar: PASS: implicit-values test because -Wimplicit-int and -Wimplicit-function-decalration enabled
Hardened: src/authvar: skip: fortify test because function abi-note.c is part of the C library, and as such it does not need fortification
Hardened: src/authvar: PASS: glibcxx-assertions test because compiled with -D_GLIBCXX_ASSERTIONS
Hardened: src/authvar: PASS: property-note test because an .ARM.attributes section obliviates the need for a .note.gnu.property section
Hardened: src/authvar: PASS: gnu-stack test because stack segment exists with the correct permissions
Hardened: src/authvar: PASS: gnu-relro test because GNU RELRO segment found
Hardened: src/authvar: skip: gaps test because string notes imply full coverage
Hardened: src/authvar: skip: cf-protection test because not an x86_64 binary
Hardened: src/authvar: PASS: entry test because no negative result detected
Hardened: src/authvar: skip: fips test because not a GO binary
Hardened: src/authvar: skip: go-revision test because no GO compiled code found
Hardened: src/authvar: PASS: instrumentation test because no negative result detected
Hardened: src/authvar: PASS: load-segments test because no negative result detected
Hardened: src/authvar: PASS: openssl-engine test because no negative result detected
Hardened: src/authvar: PASS: production test because no negative result detected
Hardened: src/authvar: PASS: run-path test because no negative result detected
Hardened: src/authvar: PASS: short-enums test because no negative result detected
Hardened: src/authvar: skip: stack-realign test because not an i686 executable
Hardened: src/authvar: PASS: textrel test because no negative result detected
Hardened: src/authvar: PASS: threads test because no negative result detected
Hardened: src/authvar: PASS: unicode test because no negative result detected
Hardened: src/authvar: Overall: PASS.
gb10:~/devel/github.com/pesign/add_branch_protection$