fix: Additional build flags

include/c2pa.hpp

@@ -287,8 +287,15 @@ namespace c2pa
         /// @param tsa_uri  The TSA URI to use for time-stamping.
         Signer(SignerFunc *callback, C2paSigningAlg alg, const string &sign_cert, const string &tsa_uri);
 
-        Signer(C2paSigner *signer) : signer(signer) {}
-
+        /// @brief Create a signer from a signer pointer and takes ownership of that pointer
+        /// @param c_signer The signer pointer to use here (should be non null)
+        Signer(C2paSigner *c_signer) : signer(c_signer) {}
+
+        /// @brief Crates a signer from signer information
+        /// @param alg Signer algorithm
+        /// @param sign_cert Signing certificate
+        /// @param private_key Private key
+        /// @param tsa_uri URL for timestamping authority
         Signer(const string &alg, const string &sign_cert, const string &private_key, const optional<string> &tsa_uri = nullopt);
 
         // Non-copyable

src/CMakeLists.txt

@@ -159,9 +159,45 @@ add_library(c2pa_cpp STATIC c2pa.cpp)
 
 # Set compiler-specific flags for the C++ library
 if(MSVC)
-    target_compile_options(c2pa_cpp PRIVATE /WX)
+    target_compile_options(c2pa_cpp PRIVATE
+        /WX
+        /sdl
+        /guard:cf
+        /GS
+        /DYNAMICBASE
+        /NXCOMPAT)
+
+    target_link_options(c2pa_cpp PRIVATE
+        /DYNAMICBASE
+        /NXCOMPAT
+        /GUARD:CF
+    )
 else()
-    target_compile_options(c2pa_cpp PRIVATE -Werror)
+    target_compile_options(c2pa_cpp PRIVATE
+        -Werror
+        -Wformat=2
+        -Wformat-security
+        -Wnull-dereference
+        -Wstack-protector
+        -fstack-protector-strong
+        -fPIE
+        -D_FORTIFY_SOURCE=2
+    )
+
+    target_link_options(c2pa_cpp PRIVATE
+        -pie
+    )
+
+    if(APPLE)
+        target_link_options(c2pa_cpp PRIVATE
+            -Wl,-bind_at_load
+        )
+    else()
+        target_link_options(c2pa_cpp PRIVATE
+            -Wl,-z,relro
+            -Wl,-z,now
+        )
+    endif()
 
     # Some compiler versions require explicit linking with stdc++fs for std::filesystem...
     # This ensures compatibility if built with older compiler versions