X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=c84c9d29a3f2420ad081ebe3d34242491836d5fa;hb=b0ddb66b90fc843f0be02d100721eafeee105235;hp=666a151d847a6567687bcbd3d5394f97d754706a;hpb=d8241af33b38ea15eee60caebba0f931c80061be;p=blhc%2Fblhc.git

diff --git a/bin/blhc b/bin/blhc
index 666a151..c84c9d2 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -24,7 +24,7 @@ use warnings;
 use Getopt::Long ();
 use Text::ParseWords ();
 
-our $VERSION = '0.02';
+our $VERSION = '0.03';
 
 
 # CONSTANTS/VARIABLES
@@ -601,6 +601,8 @@ FILE:
 foreach my $file (@ARGV) {
     print "checking '$file'...\n" if scalar @ARGV > 1;
 
+    -f $file or die "No such file: $file";
+
     open my $fh, '<', $file or die $!;
 
     # Architecture of this file.
@@ -655,10 +657,10 @@ foreach my $file (@ARGV) {
                 and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) {
             if (not $option_buildd) {
                 error_invalid_cmake($1);
+                $exit |= $exit_code{invalid_cmake};
             } else {
-                print "$buildd_tag{invalid_cmake} $1\n";
+                print "$buildd_tag{invalid_cmake}|$1|\n";
             }
-            $exit |= $exit_code{invalid_cmake};
         }
 
         # If hardening wrapper is used (wraps calls to gcc and adds hardening
@@ -667,10 +669,10 @@ foreach my $file (@ARGV) {
                 and $line =~ /\bhardening-wrapper\b/) {
             if (not $option_buildd) {
                 error_hardening_wrapper();
+                $exit |= $exit_code{hardening_wrapper};
             } else {
-                print "$buildd_tag{hardening_wrapper}\n";
+                print "$buildd_tag{hardening_wrapper}||\n";
             }
-            $exit |= $exit_code{hardening_wrapper};
             next FILE;
         }
 
@@ -801,10 +803,10 @@ foreach my $file (@ARGV) {
     if (scalar @input == 0) {
         if (not $option_buildd) {
             print "No compiler commands!\n";
+            $exit |= $exit_code{no_compiler_commands};
         } else {
-            print "$buildd_tag{no_compiler_commands}\n";
+            print "$buildd_tag{no_compiler_commands}||\n";
         }
-        $exit |= $exit_code{no_compiler_commands};
         next FILE;
     }
 
@@ -899,10 +901,10 @@ LINE:
         if (is_non_verbose_build($line, $input[$i + 1], \$skip)) {
             if (not $option_buildd) {
                 error_non_verbose_build($line);
+                $exit |= $exit_code{non_verbose_build};
             } else {
                 $statistics{commands_nonverbose}++;
             }
-            $exit |= $exit_code{non_verbose_build};
             next;
         }
         # Even if it's a verbose build, we might have to skip this line.
@@ -1003,10 +1005,10 @@ LINE:
                 and index($line, '`dpkg-buildflags --get CFLAGS`') == -1) {
             if (not $option_buildd) {
                 error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+                $exit |= $exit_code{flags_missing};
             } else {
                 $statistics{compile_missing}++;
             }
-            $exit |= $exit_code{flags_missing};
         } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
                 # Libraries linked with -fPIC don't have to (and can't) be
                 # linked with -fPIE as well. It's no error if only PIE flags
@@ -1016,10 +1018,10 @@ LINE:
                 and index($line, '`dpkg-buildflags --get CXXFLAGS`') == -1) {
             if (not $option_buildd) {
                 error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+                $exit |= $exit_code{flags_missing};
             } else {
                 $statistics{compile_cpp_missing}++;
             }
-            $exit |= $exit_code{flags_missing};
         }
         if ($preprocess
                 and (not all_flags_used($line, \@missing, @cppflags)
@@ -1030,10 +1032,10 @@ LINE:
                 and index($line, '`dpkg-buildflags --get CPPFLAGS`') == -1) {
             if (not $option_buildd) {
                 error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+                $exit |= $exit_code{flags_missing};
             } else {
                 $statistics{preprocess_missing}++;
             }
-            $exit |= $exit_code{flags_missing};
         }
         if ($link and not all_flags_used($line, \@missing, @ldflags)
                 # Same here, -fPIC conflicts with -fPIE.
@@ -1042,10 +1044,10 @@ LINE:
                 and index($line, '`dpkg-buildflags --get LDFLAGS`') == -1) {
             if (not $option_buildd) {
                 error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+                $exit |= $exit_code{flags_missing};
             } else {
                 $statistics{link_missing}++;
             }
-            $exit |= $exit_code{flags_missing};
         }
     }
 }
@@ -1076,11 +1078,11 @@ if ($option_buildd) {
     }
     if (scalar @warning) {
         local $" = ', '; # array join string
-        print "$buildd_tag{flags_missing} @warning missing\n";
+        print "$buildd_tag{flags_missing}|@warning missing|\n";
     }
 
     if ($statistics{commands_nonverbose}) {
-        printf "$buildd_tag{non_verbose_build} %d (of %d) hidden\n",
+        printf "$buildd_tag{non_verbose_build}|%d (of %d) hidden|\n",
                $statistics{commands_nonverbose},
                $statistics{commands},
     }
@@ -1109,6 +1111,9 @@ It's designed to check build logs generated by Debian's dpkg-buildpackage (or
 tools using dpkg-buildpackage like pbuilder or the official buildd build logs)
 to help maintainers detect missing hardening flags in their packages.
 
+Only gcc is detected as compiler at the moment. If other compilers support
+hardening flags as well, please report them.
+
 If there's no output, no flags are missing and the build log is fine.
 
 =head1 OPTIONS
@@ -1151,6 +1156,10 @@ detected).
 
 Don't require Term::ANSIColor.
 
+=item *
+
+Return exit code 0, unless there was a error.
+
 =back
 
 =item B<--color>