From a923b2b22e20f0b771250c25a2253bea5583fc1f Mon Sep 17 00:00:00 2001
From: Anand Aiyer <anand@aiyer.com>
Date: Fri, 17 Jul 2026 20:42:58 +0530
Subject: [PATCH] fix(build): mark nomic blob stack non-executable

Signed-off-by: Anand Aiyer <anand@aiyer.com>
---
 scripts/extract_nomic_vectors.py   | 38 ++++++++++++++++++++++++++++--
 vendored/nomic/code_vectors_blob.S |  2 ++
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/scripts/extract_nomic_vectors.py b/scripts/extract_nomic_vectors.py
index ef38c2ca1..621d8d9da 100755
--- a/scripts/extract_nomic_vectors.py
+++ b/scripts/extract_nomic_vectors.py
@@ -332,9 +332,12 @@ def write_vectors_h(path: str, token_count: int, dim: int, incbin_path: str):
 
 
 def write_blob_s(path: str, incbin_path: str):
-    """Write assembler .incbin directive."""
+    """Write the cross-platform assembler .incbin wrapper."""
     with open(path, "w") as f:
-        f.write(f"""/* nomic-embed-code vector blob embedded via assembler. */
+        f.write(f"""/* nomic-embed-code vector blob embedded via assembler.
+ * Cross-platform: macOS (Mach-O) vs Linux (ELF) vs Windows (COFF). */
+
+#if defined(__APPLE__)
     .section __DATA,__const
     .globl _PRETRAINED_VECTOR_BLOB
     .globl _PRETRAINED_VECTOR_BLOB_LEN
@@ -347,6 +350,37 @@ def write_blob_s(path: str, incbin_path: str):
     .p2align 2
 _PRETRAINED_VECTOR_BLOB_LEN:
     .long _PRETRAINED_VECTOR_BLOB_END - _PRETRAINED_VECTOR_BLOB
+
+#elif defined(_WIN32) || defined(__CYGWIN__) || defined(__MINGW32__)
+    .section .rdata,"dr"
+    .globl PRETRAINED_VECTOR_BLOB
+    .globl PRETRAINED_VECTOR_BLOB_LEN
+    .p2align 4
+PRETRAINED_VECTOR_BLOB:
+    .incbin "{incbin_path}"
+PRETRAINED_VECTOR_BLOB_END:
+
+    .section .rdata,"dr"
+    .p2align 2
+PRETRAINED_VECTOR_BLOB_LEN:
+    .long PRETRAINED_VECTOR_BLOB_END - PRETRAINED_VECTOR_BLOB
+
+#else
+    .section .rodata,"a",@progbits
+    .globl PRETRAINED_VECTOR_BLOB
+    .globl PRETRAINED_VECTOR_BLOB_LEN
+    .p2align 4
+PRETRAINED_VECTOR_BLOB:
+    .incbin "{incbin_path}"
+PRETRAINED_VECTOR_BLOB_END:
+
+    .section .rodata,"a",@progbits
+    .p2align 2
+PRETRAINED_VECTOR_BLOB_LEN:
+    .long PRETRAINED_VECTOR_BLOB_END - PRETRAINED_VECTOR_BLOB
+
+    .section .note.GNU-stack,"",@progbits
+#endif
 """)
     print(f"  {path}: written")
 
diff --git a/vendored/nomic/code_vectors_blob.S b/vendored/nomic/code_vectors_blob.S
index b9271812d..4b90b4540 100644
--- a/vendored/nomic/code_vectors_blob.S
+++ b/vendored/nomic/code_vectors_blob.S
@@ -42,4 +42,6 @@ PRETRAINED_VECTOR_BLOB_END:
     .p2align 2
 PRETRAINED_VECTOR_BLOB_LEN:
     .long PRETRAINED_VECTOR_BLOB_END - PRETRAINED_VECTOR_BLOB
+
+    .section .note.GNU-stack,"",@progbits
 #endif