A quick comment: these flags impede debugging. Is there a way to apply them conditionally in release builds? This is what the nanobind cmake build system does.

Thanks for the clarification. Perhaps this will work?

config_setting(
    name = "release_build",
    flag_values = {"compilation_mode": "opt"},
)

@wjakob looks like this works, are there any more release-mode-only optimizations you can think of?

(I will redesign the skylib setting groups in a subsequent PR.)

Nanobind tweaks the following depending on whether or not the user performs a release or a debug build.

• stripping of linked binaries performed in release mode.
• the -DNB_COMPACT_ASSERTIONS compile definition is set in release mode. (This removes a large set of error message strings that are mainly useful for development and debugging)

It's probably a good idea for you to replicate these two behaviors as well.

The following are more opinionated and with opt-outs:

• size optimization (-Os) is enabled in release mode except unless the user specifies the NOMINSIZE flag.
• the -fno-stack-protector compile is passed in release mode unless the user specifies the PROTECT_STACK flag.

Thanks, then I'm all set. I'm currently not supporting the PROTECT_STACK flag, but I'll note it down for the future.

Actually, the debug stripping had the neat side effect of the abi3audit passing again (though perhaps for the wrong reasons).