From c5f2b461853f562b8746fb75a091fc4932b3f7f1 Mon Sep 17 00:00:00 2001
From: Cory Fields <cory-nospam-@coryfields.com>
Date: Mon, 2 Jun 2025 17:51:40 +0000
Subject: [PATCH 1/2] cmake: don't set default visibility for static builds

define SECP256K1_CMAKE_SHARED_BUILD for all CMake shared lib builds, not just
Windows. This allows us to only set default symbol visibility for shared lib builds.

For static libs built with CMake, or Autotools builds for Windows, static
builds will prefer to hide symbols by default. Autotools does not have the
ability to set a define for non-Windows shared builds, so the best we can do
there is guess. SECP256K1_NO_EXPORT_SYMBOLS can be defined as an escape-hatch
in case a non-Windows CMake builder wants default visibility.
---
 configure.ac        |  1 +
 include/secp256k1.h | 16 +++++++++++-----
 src/CMakeLists.txt  |  4 ++--
 3 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/configure.ac b/configure.ac
index 406227fcd1..f7f1289c2f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -45,6 +45,7 @@ AS_UNSET(ac_cv_prog_AR)
 AS_UNSET(ac_cv_prog_ac_ct_AR)
 LT_INIT([win32-dll])
 
+SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DSECP256K1_AUTOTOOLS_BUILD=1"
 build_windows=no
 
 case $host_os in
diff --git a/include/secp256k1.h b/include/secp256k1.h
index 1d25a02ab2..bd051729e4 100644
--- a/include/secp256k1.h
+++ b/include/secp256k1.h
@@ -129,10 +129,11 @@ typedef int (*secp256k1_nonce_function)(
    * Attributes" in the GCC manual and the recommendations in
    * https://gcc.gnu.org/wiki/Visibility. */
 # if defined(SECP256K1_BUILD)
-#  if defined(DLL_EXPORT) || defined(SECP256K1_DLL_EXPORT)
+#  if defined(DLL_EXPORT) || defined(SECP256K1_CMAKE_SHARED_BUILD) || defined(SECP256K1_DLL_EXPORT)
     /* Building libsecp256k1 as a DLL.
      * 1. If using Libtool, it defines DLL_EXPORT automatically.
-     * 2. In other cases, SECP256K1_DLL_EXPORT must be defined. */
+     * 2. If using CMake, it defines SECP256K1_CMAKE_SHARED_BUILD automatically.
+     * 3. In other cases, SECP256K1_DLL_EXPORT must be defined. */
 #   define SECP256K1_API extern __declspec (dllexport)
 #  else
     /* Building libsecp256k1 as a static library on Windows.
@@ -155,11 +156,16 @@ typedef int (*secp256k1_nonce_function)(
 /* All cases not captured by the Windows-specific logic. */
 # if defined(__GNUC__) && (__GNUC__ >= 4) && defined(SECP256K1_BUILD)
    /* Building libsecp256k1 using GCC or compatible. */
-#  define SECP256K1_API extern __attribute__ ((visibility ("default")))
-# else
+#  if !defined(SECP256K1_NO_EXPORT_SYMBOLS)
+#   if defined(SECP256K1_CMAKE_SHARED_BUILD) || defined(SECP256K1_AUTOTOOLS_BUILD)
+#    define SECP256K1_API extern __attribute__ ((visibility ("default")))
+#   endif
+#  endif
+# endif
+#endif
+#ifndef SECP256K1_API
    /* Fall back to standard C's extern. */
 #  define SECP256K1_API extern
-# endif
 #endif
 
 /* Warning attributes
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index f31b8c8f55..d390b44cee 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -20,9 +20,9 @@ if(SECP256K1_ASM STREQUAL "arm32")
   target_link_libraries(secp256k1_asm INTERFACE secp256k1_asm_arm)
 endif()
 
+# Define our export symbol only for shared libs.
+set_target_properties(secp256k1 PROPERTIES DEFINE_SYMBOL SECP256K1_CMAKE_SHARED_BUILD)
 if(WIN32)
-  # Define our export symbol only for shared libs.
-  set_target_properties(secp256k1 PROPERTIES DEFINE_SYMBOL SECP256K1_DLL_EXPORT)
   target_compile_definitions(secp256k1 INTERFACE $<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:SECP256K1_STATIC>)
 endif()
 

From 3eef7362c45e5d4c0d4b06ec4d9af30be8642e5d Mon Sep 17 00:00:00 2001
From: Cory Fields <cory-nospam-@coryfields.com>
Date: Mon, 2 Jun 2025 18:51:32 +0000
Subject: [PATCH 2/2] Revert "build: Drop no longer needed 
 `-fvisibility=hidden` compiler option"

This reverts commit d1478763a5f400fafb42af5911db4a9460dd4a5d.

Hidden visiblity is still useful for builders including a static libsecp.
---
 CMakeLists.txt | 2 ++
 configure.ac   | 1 +
 2 files changed, 3 insertions(+)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2b7737146d..520a96efdc 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -271,6 +271,8 @@ else()
   try_append_c_flags(-Wundef)
 endif()
 
+set(CMAKE_C_VISIBILITY_PRESET hidden)
+
 set(print_msan_notice)
 if(SECP256K1_BUILD_CTIME_TESTS)
   include(CheckMemorySanitizer)
diff --git a/configure.ac b/configure.ac
index f7f1289c2f..71df0e3d08 100644
--- a/configure.ac
+++ b/configure.ac
@@ -112,6 +112,7 @@ AC_DEFUN([SECP_TRY_APPEND_DEFAULT_CFLAGS], [
       SECP_TRY_APPEND_CFLAGS([-Wcast-align=strict], $1) # GCC >= 8.0
       SECP_TRY_APPEND_CFLAGS([-Wconditional-uninitialized], $1) # Clang >= 3.0 only
       SECP_TRY_APPEND_CFLAGS([-Wreserved-identifier], $1) # Clang >= 13.0 only
+      SECP_TRY_APPEND_CFLAGS([-fvisibility=hidden], $1) # GCC >= 4.0
 
       CFLAGS="$SECP_TRY_APPEND_DEFAULT_CFLAGS_saved_CFLAGS"
     fi