X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=dda96124fe76f12318a56683efd4c173dbb4e868;hb=5729a02f54e5cbc1ff346f457a9e56effcdee96d;hp=9e3c945b4adeb8ceec27e9aba6fab11a05f838c2;hpb=9c16fc443d8b897baeed79e596a069b4b27b5111;p=blhc%2Fblhc.git

diff --git a/bin/blhc b/bin/blhc
index 9e3c945..dda9612 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
 
 # Build log hardening check, checks build logs for missing hardening flags.
 
-# Copyright (C) 2012-2023  Simon Ruderich
+# Copyright (C) 2012-2024  Simon Ruderich
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -206,7 +206,7 @@ my $file_extension_regex = qr/
 # Expected (hardening) flags. All flags are used as regexps (and compiled to
 # real regexps below for better execution speed).
 my @def_cflags = (
-    '-g',
+    '-g3?',
     '-O(?:2|3)', # keep at index 1, search for @def_cflags_debug to change it
 );
 my @def_cflags_debug = (
@@ -296,6 +296,7 @@ my @flag_refs_all = (
 # Renaming rules for the output so the regex parts are not visible. Also
 # stores string values of flag regexps above, see compile_flag_regexp().
 my %flag_renames = (
+    '-g3?'                         => '-g',
     '-O(?:2|3)'                    => '-O2',
     '-Wformat(?:=2)?'              => '-Wformat',
     '--param[= ]ssp-buffer-size=4' => '--param=ssp-buffer-size=4',
@@ -691,7 +692,7 @@ if ($option_help) {
 }
 if ($option_version) {
     print <<"EOF";
-blhc $VERSION  Copyright (C) 2012-2023  Simon Ruderich
+blhc $VERSION  Copyright (C) 2012-2024  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -1153,11 +1154,12 @@ foreach my $file (@ARGV) {
 
     # Option or auto detected.
     if ($arch) {
-        # The following was partially copied from dpkg-dev 1.21.13
-        # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, _add_build_flags()),
-        # copyright Raphaël Hertzog <hertzog@debian.org>, Guillem Jover
-        # <guillem@debian.org>, Kees Cook <kees@debian.org>, Canonical, Ltd.
-        # licensed under GPL version 2 or later. Keep it in sync.
+        # The following was partially copied from dpkg-dev 1.22.0
+        # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, set_build_features and
+        # _add_build_flags()), copyright Raphaël Hertzog <hertzog@debian.org>,
+        # Guillem Jover <guillem@debian.org>, Kees Cook <kees@debian.org>,
+        # Canonical, Ltd. licensed under GPL version 2 or later. Keep it in
+        # sync.
 
         require Dpkg::Arch;
         my ($os, $cpu);
@@ -1174,13 +1176,23 @@ foreach my $file (@ARGV) {
             arm64
             armel
             armhf
+            hurd-amd64
             hurd-i386
             i386
             kfreebsd-amd64
             kfreebsd-i386
             mips
-            mipsel
+            mips64
             mips64el
+            mips64r6
+            mips64r6el
+            mipsel
+            mipsn32
+            mipsn32el
+            mipsn32r6
+            mipsn32r6el
+            mipsr6
+            mipsr6el
             powerpc
             ppc64
             ppc64el
@@ -1191,15 +1203,14 @@ foreach my $file (@ARGV) {
         );
 
         # Disable unsupported hardening options.
-        if ($os !~ /^(?:linux|kfreebsd|knetbsd|hurd)$/
-                or $cpu =~ /^(?:hppa|avr32)$/) {
+        if ($os !~ /^(?:linux|kfreebsd|knetbsd|hurd)$/ or $cpu eq 'hppa') {
             $harden_pie = 0;
         }
         if ($cpu =~ /^(?:ia64|alpha|hppa|nios2)$/ or $arch eq 'arm') {
             $harden_stack = 0;
             $harden_stack_strong = 0;
         }
-        if ($cpu =~ /^(?:ia64|hppa|avr32)$/) {
+        if ($cpu =~ /^(?:ia64|hppa)$/) {
             $harden_relro   = 0;
             $harden_bindnow = 0;
         }
@@ -1568,7 +1579,8 @@ log:
     blhc: ignore-line-regexp: REGEXP
 
 All lines fully matching REGEXP (see B<--ignore-line> for details) will be
-ignored.
+ignored. The string can be embedded multiple times to ignore different
+regexps.
 
 Please use this feature sparingly so that missing flags are not overlooked. If
 you find false positives which affect more packages please report a bug.
@@ -1824,7 +1836,7 @@ E<lt>jari.aalto@cante.netE<gt> for their valuable input and suggestions.
 
 =head1 LICENSE AND COPYRIGHT
 
-Copyright (C) 2012-2023 by Simon Ruderich
+Copyright (C) 2012-2024 by Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by