Use tag W-no-compiler-commands in buildd mode.

[blhc/blhc.git] / bin / blhc

diff --git a/bin/blhc b/bin/blhc
index bfa954b50f2b8974ee1dbd06e855f5ee8ef668ee..544b32cb6fa31f68988b2c56f98504d738caeffa 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -202,6 +202,21 @@ my %flag_renames = (
     '-Wl,(-z,)?now'   => '-Wl,-z,now',
 );
 
     '-Wl,(-z,)?now'   => '-Wl,-z,now',
 );
 

+# Statistics of missing flags and non-verbose build commands. Used for
+# $option_buildd.
+my %statistics = (
+    preprocess          => 0,
+    preprocess_missing  => 0,
+    compile             => 0,
+    compile_missing     => 0,
+    compile_cpp         => 0,
+    compile_cpp_missing => 0,
+    link                => 0,
+    link_missing        => 0,
+    commands            => 0,
+    commands_nonverbose => 0,
+);
+

 # Use colored (ANSI) output?
 my $option_color;
 
 # Use colored (ANSI) output?
 my $option_color;
 


@@ -470,7 +485,11 @@ FILE: foreach my $file (@ARGV) {
         # If hardening wrapper is used (wraps calls to gcc and adds hardening
         # flags automatically) we can't perform any checks, abort.
         if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {
         # If hardening wrapper is used (wraps calls to gcc and adds hardening
         # flags automatically) we can't perform any checks, abort.
         if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {

-            error_hardening_wrapper();
+            if (not $option_buildd) {
+                error_hardening_wrapper();
+            } else {
+                print "I-hardening-wrapper-used\n";
+            }

             $exit |= 1 << 4;
             next FILE;
         }
             $exit |= 1 << 4;
             next FILE;
         }


@@ -583,11 +602,19 @@ FILE: foreach my $file (@ARGV) {
     close $fh;
 
     if (scalar @input == 0) {
     close $fh;
 
     if (scalar @input == 0) {

-        print "No compiler commands!\n";
+        if (not $option_buildd) {
+            print "No compiler commands!\n";
+        } else {
+            print "W-no-compiler-commands\n";
+        }

         $exit |= 1;
         next FILE;
     }
 
         $exit |= 1;
         next FILE;
     }
 

+    if ($option_buildd) {
+        $statistics{commands} += scalar @input;
+    }
+

     # Option or auto detected.
     if ($option_arch) {
         # The following was partially copied from dpkg-dev 1.16.1.2
     # Option or auto detected.
     if ($option_arch) {
         # The following was partially copied from dpkg-dev 1.16.1.2


@@ -645,7 +672,11 @@ FILE: foreach my $file (@ARGV) {
 
         my $skip = 0;
         if (is_non_verbose_build($line, $input[$i + 1], \$skip)) {
 
         my $skip = 0;
         if (is_non_verbose_build($line, $input[$i + 1], \$skip)) {

-            error_non_verbose_build($line);
+            if (not $option_buildd) {
+                error_non_verbose_build($line);
+            } else {
+                $statistics{commands_nonverbose}++;
+            }

             $exit |= 1 << 2;
             next;
         }
             $exit |= 1 << 2;
             next;
         }


@@ -714,6 +745,13 @@ FILE: foreach my $file (@ARGV) {
             $compile_cpp = 1;
         }
 
             $compile_cpp = 1;
         }
 

+        if ($option_buildd) {
+            $statistics{preprocess}++  if $preprocess;
+            $statistics{compile}++     if $compile;
+            $statistics{compile_cpp}++ if $compile_cpp;
+            $statistics{link}++        if $link;
+        }
+

         # Check hardening flags.
         my @missing;
         if ($compile and not all_flags_used($line, \@missing, @cflags)
         # Check hardening flags.
         my @missing;
         if ($compile and not all_flags_used($line, \@missing, @cflags)


@@ -723,7 +761,11 @@ FILE: foreach my $file (@ARGV) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {

-            error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            if (not $option_buildd) {
+                error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            } else {
+                $statistics{compile_missing}++;
+            }

             $exit |= 1 << 3;
         } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
                 # Libraries linked with -fPIC don't have to (and can't) be
             $exit |= 1 << 3;
         } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
                 # Libraries linked with -fPIC don't have to (and can't) be


@@ -732,13 +774,21 @@ FILE: foreach my $file (@ARGV) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {

-            error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            if (not $option_buildd) {
+                error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            } else {
+                $statistics{compile_cpp_missing}++;
+            }

             $exit |= 1 << 3;
         }
         if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) {
             $exit |= 1 << 3;
         }
         if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) {

-            error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            if (not $option_buildd) {
+                error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            } else {
+                $statistics{preprocess_missing}++;
+            }

             $exit |= 1 << 3;
         }
         if ($link and not all_flags_used($line, \@missing, @ldflags)
             $exit |= 1 << 3;
         }
         if ($link and not all_flags_used($line, \@missing, @ldflags)


@@ -746,12 +796,53 @@ FILE: foreach my $file (@ARGV) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) {

-            error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            if (not $option_buildd) {
+                error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            } else {
+                $statistics{link_missing}++;
+            }

             $exit |= 1 << 3;
         }
     }
 }
 
             $exit |= 1 << 3;
         }
     }
 }
 

+# Print statistics for buildd mode, only output in this mode.
+if ($option_buildd) {
+    my @warning;
+
+    if ($statistics{preprocess_missing}) {
+        push @warning, sprintf "CPPFLAGS %d (of %d)",
+                               $statistics{preprocess_missing},
+                               $statistics{preprocess};
+    }
+    if ($statistics{compile_missing}) {
+        push @warning, sprintf "CFLAGS %d (of %d)",
+                               $statistics{compile_missing},
+                               $statistics{compile};
+    }
+    if ($statistics{compile_cpp_missing}) {
+        push @warning, sprintf "CXXFLAGS %d (of %d)",
+                               $statistics{compile_cpp_missing},
+                               $statistics{compile_cpp};
+    }
+    if ($statistics{link_missing}) {
+        push @warning, sprintf "LDFLAGS %d (of %d)",
+                               $statistics{link_missing},
+                               $statistics{link};
+    }
+    if (scalar @warning) {
+        local $" = ', '; # array join string
+        print "W-dpkg-buildflags-missing @warning missing\n";
+    }
+
+    if ($statistics{commands_nonverbose}) {
+        printf "W-compiler-flags-hidden %d (of %d) hidden\n",
+               $statistics{commands_nonverbose},
+               $statistics{commands},
+    }
+}
+
+

 exit $exit;
 
 
 exit $exit;
 
 


@@ -763,16 +854,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags
 
 =head1 SYNOPSIS
 
 
 =head1 SYNOPSIS
 

-B<blhc> [options] <dpkg-buildpackage build log file>..
-
-    --all                   force +all (+pie, +bindnow) check
-    --arch                  set architecture (autodetected)
-    --bindnow               force +bindbow check
-    --buildd                parser mode for buildds
-    --color                 use colored output
-    --pie                   force +pie check
-    --help                  available options
-    --version               version number and license
+B<blhc> [I<options>] I<E<lt>dpkg-buildpackage build log fileE<gt>..>

 
 =head1 DESCRIPTION
 
 
 =head1 DESCRIPTION
 


@@ -788,7 +870,7 @@ other important warnings. It's licensed under the GPL 3 or later.
 Force check for all +all (+pie, +bindnow) hardening flags. By default it's
 auto detected.
 
 Force check for all +all (+pie, +bindnow) hardening flags. By default it's
 auto detected.
 

-=item B<--arch>
+=item B<--arch> I<architecture>

 
 Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected
 
 Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected