# CONSTANTS/VARIABLES
# Regex to catch compiler commands.
-my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux|kfreebsd)-gnu(?:eabi|eabihf)?-)?
- (?:(?<!\.)cc|gcc|g\+\+|c\+\+)
+my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
+ (?<!\.)(?:cc|gcc|g\+\+|c\+\+)
(?:-[\d.]+)?/x;
# Regex to catch (GCC) compiler warnings.
my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
'-Wl,(-z,)?now' => '-Wl,-z,now',
);
+# Use colored (ANSI) output?
+my $option_color;
+
# FUNCTIONS
sub error_color {
my ($message, $color) = @_;
- # Use colors when writing to a terminal.
- if (-t STDOUT) {
+ if ($option_color) {
return Term::ANSIColor::colored($message, $color);
} else {
return $message;
my $option_all = 0;
my $option_arch = undef;
my $option_buildd = 0;
+ $option_color = 0;
if (not Getopt::Long::GetOptions(
'help|h|?' => \$option_help,
'version' => \$option_version,
'bindnow' => \$harden_bindnow,
'all' => \$option_all,
# Misc.
+ 'color' => \$option_color,
'arch' => \$option_arch,
'buildd' => \$option_buildd,
)) {
# Ignore false positives.
#
# `./configure` output.
- next if not $non_verbose and $line =~ /^checking /;
+ next if not $non_verbose
+ and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
(?:C|c)ompiler[\s.]*:?\s+
$cc_regex
or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/
or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
- # Debian buildd output.
- next if $line =~ /^\s*Depends: .*?$cc_regex.*?$/
- and $line !~ /\s-./; # option, prevent false negatives
# Check if additional hardening options were used. Used to ensure
# they are used for the complete build.
--all force +all (+pie, +bindnow) check
--arch set architecture (autodetected)
--buildd parser mode for buildds
+ --color use colored output
=head1 DESCRIPTION
=back
+=item B<--color>
+
+Use colored (ANSI) output for warning messages.
+
=back
Auto detection for B<--pie> and B<--bindnow> only works if at least one