Why isn't -mmacosx-version-min=10.10 preventing use of a function tagged as starting in 10.11?

Question

By my understanding of how the availability macros and the -mmacosx-version-min flag works, the following code should fail to compile when targeting OS X 10.10:

#include <Availability.h>
#include <CoreFoundation/CoreFoundation.h>
#include <Security/Security.h>

#if !defined(__MAC_OS_X_VERSION_MIN_REQUIRED)
#error
#endif

#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101000
#error __MAC_OSX_VERSION_MIN_REQUIRED too low
#endif

#if __MAC_OS_X_VERSION_MIN_REQUIRED > 101000
#error __MAC_OSX_VERSION_MIN_REQUIRED too high
#endif

int main() {

    size_t len = 0;

    SSLContextRef x{};
    auto status = SSLCopyRequestedPeerNameLength(x, &len);
    return status != 0;
}

because the function SSLCopyRequestedPeerNameLength is tagged as becoming available in 10.11 in SecureTransport.h:

$ grep -C5 ^SSLCopyRequestedPeerNameLength /System/Library/Frameworks//Security.framework/Headers/SecureTransport.h

/*
 * Server Only: obtain the hostname specified by the client in the ServerName extension (SNI)
 */
OSStatus
SSLCopyRequestedPeerNameLength  (SSLContextRef  ctx,
                                 size_t         *peerNameLen)
    __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);

Yet when I compile on the command line with -mmacosx-version-min=10.10 I get no warning at all, despite -Wall -Werror -Wextra:

$ clang++ -Wall -Werror -Wextra ./foo.cpp --std=c++11 -framework Security -mmacosx-version-min=10.10 --stdlib=libc++ ; echo $?
0

Is there some additional definition I need to provide or specific warning to enable to ensure that I don't pick up a dependency on APIs newer than 10.10? I really had expected that -mmacosx-version-min=10.10 would prevent usage of APIs tagged with higher version numbers.

What have I misunderstood here?

Using XCode 10.0 (10A255) on macOS 10.13.6 here.

Luffa

OK, found it: you need to pass the magic flag -Wunguarded-availability which is documented exactly nowhere. – Luffa

Answer 1

Now that I can answer my own question, I will: you need to add -Wunguarded-availability to your compile flags. Only then will you get a warning/error.

Luffa