From 11286942572faaba4b3c947a6bb8763eac6d8195 Mon Sep 17 00:00:00 2001
From: Mike Solar <iam@mikesolar.cn>
Date: Sun, 19 Jul 2026 23:51:15 +0800
Subject: [PATCH] core: restrict liboakcore exports to the C ABI via version
 script

Even statically linked runtime libraries must not leak symbols: the
linker version script now whitelists oakcore_* only. nm reports 188
oakcore_* exports and zero anything else.
---
 core/CMakeLists.txt | 7 +++++++
 core/oakcore.map    | 6 ++++++
 2 files changed, 13 insertions(+)
 create mode 100644 core/oakcore.map

diff --git a/core/CMakeLists.txt b/core/CMakeLists.txt
index 4ec6f5017..b8a825bc5 100644
--- a/core/CMakeLists.txt
+++ b/core/CMakeLists.txt
@@ -74,6 +74,13 @@ set_target_properties(olivecore PROPERTIES
 # OAKCORE_BUILD marks the library side of the export macros (dllexport)
 target_compile_definitions(olivecore PRIVATE OAKCORE_BUILD)
 
+# Export only the C ABI (oakcore_*), nothing else — not even symbols from
+# statically linked runtime libraries
+if (UNIX AND NOT APPLE)
+  target_link_options(olivecore PRIVATE
+    "LINKER:--version-script,${CMAKE_CURRENT_SOURCE_DIR}/oakcore.map")
+endif ()
+
 # The library builds against its internal implementation headers
 # (src/oliveimpl); consumers only ever see the public C API and wrapper
 # headers (include/olive/core). oliveimpl must come first so that internal
diff --git a/core/oakcore.map b/core/oakcore.map
new file mode 100644
index 000000000..e9181c1aa
--- /dev/null
+++ b/core/oakcore.map
@@ -0,0 +1,6 @@
+{
+  global:
+    oakcore_*;
+  local:
+    *;
+};