From 9c1453602e75fb9c4632dfabb26fe928afe18b7a Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Wed, 29 Apr 2026 09:58:53 -0400
Subject: [PATCH] stdenv.mkDerivation: only create enabledHardeningOptions
 variable if necessary

---
 pkgs/stdenv/generic/make-derivation.nix | 30 +++++++++++++------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 855615856299..a5470d9b6c2b 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -413,20 +413,6 @@ let
           actualValue;
       outputs' = if separateDebugInfo' then outputs ++ [ "debug" ] else outputs;
 
-      enabledHardeningOptions =
-        if elem "all" hardeningDisable then
-          [ ]
-        else
-          subtractLists (unique (
-            pipe hardeningDisable [
-              # disabling fortify implies fortify3 should also be disabled
-              (concretizeFlagImplications "fortify" [ "fortify3" ])
-              # disabling strictflexarrays1 implies strictflexarrays3 should also be disabled
-              (concretizeFlagImplications "strictflexarrays1" [ "strictflexarrays3" ])
-              # disabling libcxxhardeningfast implies libcxxhardeningextensive should also be disabled
-              (concretizeFlagImplications "libcxxhardeningfast" [ "libcxxhardeningextensive" ])
-            ]
-          )) (defaultHardeningFlags ++ hardeningEnable);
       # hardeningDisable additionally supports "all".
       erroneousHardeningFlags = subtractLists knownHardeningFlags (
         hardeningEnable ++ remove "all" hardeningDisable
@@ -694,6 +680,22 @@ let
             else
               null
           } =
+            let
+              enabledHardeningOptions =
+                if elem "all" hardeningDisable then
+                  [ ]
+                else
+                  subtractLists (unique (
+                    pipe hardeningDisable [
+                      # disabling fortify implies fortify3 should also be disabled
+                      (concretizeFlagImplications "fortify" [ "fortify3" ])
+                      # disabling strictflexarrays1 implies strictflexarrays3 should also be disabled
+                      (concretizeFlagImplications "strictflexarrays1" [ "strictflexarrays3" ])
+                      # disabling libcxxhardeningfast implies libcxxhardeningextensive should also be disabled
+                      (concretizeFlagImplications "libcxxhardeningfast" [ "libcxxhardeningextensive" ])
+                    ]
+                  )) (defaultHardeningFlags ++ hardeningEnable);
+            in
             concatStringsSep " " enabledHardeningOptions;
 
           # TODO: remove platform condition