Better handling of libtool commands.

Fixes Debug bug #717598), reported by Stefan Fritsch. Thanks.

diff --git a/NEWS b/NEWS
index 305a530fca60a48715d8d9c2b8a5ff6651756b49..7bd78a719e5126030c0d140ed7305b6594eb7bee 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,8 @@ Version 0.XX
   reported by Matthias Klose.
 - Don't check for hardening flags in non-verbose compiler commands spanning
   multiple lines.
+- Better handling of libtool commands (Debug bug #717598), reported by Stefan
+  Fritsch.
 
 - Sync architecture specific hardening support with dpkg 1.17.1.
 

diff --git a/bin/blhc b/bin/blhc
index b45439ca9e533a7e01fbb2bc8759d5be8571d29e..72a2c4294ec2d6c04b1e54ff263a2452c2060e63 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -48,6 +48,9 @@ my $cc_regex_normal = qr/
     /x;
 # Regex to catch (GCC) compiler warnings.
 my $warning_regex = qr/^(.+?):(\d+):\d+: warning: (.+?) \[(.+?)\]$/;
+# Regex to catch libtool commands and not lines which show commands executed
+# by libtool (e.g. libtool: link: ...).
+my $libtool_regex = qr/\blibtool\s.*--mode=/;
 
 # List of source file extensions which require preprocessing.
 my @source_preprocess_compile_cpp = (
@@ -429,6 +432,20 @@ sub pic_pie_conflict {
 sub is_non_verbose_build {
     my ($line, $next_line, $skip_ref) = @_;
 
+    if ($line =~ /$libtool_regex/o) {
+        # libtool's --silent hides the real compiler flags.
+        if ($line =~ /\s--silent/) {
+            return 1;
+        # If --silent is not present, skip this line as some compiler flags
+        # might be missing (e.g. -fPIE) which are handled correctly by libtool
+        # internally. libtool displays the real compiler command on the next
+        # line, so the flags are checked as usual.
+        } else {
+            ${$skip_ref} = 1;
+            return 0;
+        }
+    }
+
     if (not (index($line, 'checking if you want to see long compiling messages... no') == 0
                 or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
                 or $line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/
@@ -816,7 +833,9 @@ foreach my $file (@ARGV) {
         }
 
         # Check if this line indicates a non verbose build.
-        $non_verbose |= is_non_verbose_build($line);
+        my $skip = 0;
+        $non_verbose |= is_non_verbose_build($line, undef, \$skip);
+        next if $skip;
 
         # One line may contain multiple commands (";"). Treat each one as
         # single line. parse_line() is slow, only use it when necessary.

diff --git a/t/logs/libtool b/t/logs/libtool
index fb0c30c0ab670145e2bec98ce6e25999ebc600b1..b72101aa4a49f24af27705bef9a83fd0d9bc3c9d 100644 (file)
--- a/t/logs/libtool
+++ b/t/logs/libtool
@@ -1,30 +1,46 @@
 dpkg-buildpackage: source package test
 
 /bin/bash ../../libtool --tag=CC   --mode=compile x86_64-linux-gnu-gcc -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
+libtool: compile: x86_64-linux-gnu-gcc -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
 /bin/bash ../../libtool --tag=CC   --mode=compile x86_64-linux-gnu-g++ -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.cpp
+libtool: compile: x86_64-linux-gnu-g++ -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.cpp
 /bin/bash ../../libtool --tag=CC   --mode=compile gcc-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
+libtool: compile: gcc-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
 /bin/bash ../../libtool --tag=CXX  --mode=compile g++-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
+libtool: compile: g++-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
 
 libtool: link: g++ -shared test-a.o test-b.o test-b.o test-c.o -O2 -pie -Wl,relro -Wl,now -o test.so
 libtool: link: g++ -shared test-a.o test-b.o test-b.o test-c.o -O2 -Wl,relro -o test.so
 
 libtool: link: gcc -Wl,-z -Wl,relro -o test test.o
 /bin/bash ../../../libtool  --mode=link cc -Wl,-z,relro -o test.so test.o
+libtool: link: cc -Wl,-z,relro -o test.so test.o
 /bin/bash ../../../libtool  --mode=link gcc-4.6 -Wl,-z,relro -o test.so test.o
+libtool: link: gcc-4.6 -Wl,-z,relro -o test.so test.o
 /bin/bash ../libtool --tag=CXX --mode=link x86_64-linux-gnu-g++ -Wl,-z,relro -o test.so test.o
+libtool: link: x86_64-linux-gnu-g++ -Wl,-z,relro -o test.so test.o
 /bin/bash ../libtool --tag=CC --mode=link gcc -Wl,-z,relro -o test.so test.o
+libtool: link: gcc -Wl,-z,relro -o test.so test.o
 /bin/bash ../libtool --tag=CC --mode=link gcc -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
+libtool: link: gcc -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
 /bin/bash ../libtool --tag=CC   --mode=link gcc -Wl,-z,relro -o test.so test.o
+libtool: link: gcc -Wl,-z,relro -o test.so test.o
   /bin/bash ../libtool --tag=CC   --mode=link gcc -Wl,-z,relro -o test.so test.o
+  libtool: link: gcc -Wl,-z,relro -o test.so test.o
 /bin/bash ../../libtool  --tag=CC --preserve-dup-deps  --mode=link gcc -Wl,-z,relro -o test.so test.o
+libtool: link: gcc -Wl,-z,relro -o test.so test.o
  /bin/bash /tmp/test/build/libtool  --silent --tag CC --mode=relink gcc -Wl,-z,relro -o test.so test.o
+ libtool: relink: gcc -Wl,-z,relro -o test.so test.o
  /bin/bash /tmp/test/build/libtool  --tag CXX --mode=relink g++ -Wl,-z,relro -o test.la test.o
+ libtool: relink: g++ -Wl,-z,relro -o test.la test.o
 # Make sure ".libs/test" is treated as a binary.
 /bin/bash ../libtool --tag=CC   --mode=link gcc  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security   -Wl,-z,relro -o test test.o
+libtool: link: gcc  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security   -Wl,-z,relro -o test test.o
 gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -Wl,-z -Wl,relro -o .libs/test test.o
 
 # Just to be sure, libtool won't do this. Note the test.c.
 /bin/bash ../libtool --tag=CC   --mode=link gcc -Wl,-z,relro -o test.so test.c
+libtool: link: gcc -Wl,-z,relro -o test.so test.c
 
 libtool: install: /usr/bin/install -c ...
 /bin/bash ./libtool --mode=install /usr/bin/install -c ...
@@ -33,4 +49,28 @@ libtool: install: /usr/bin/install -c ...
     /bin/bash ../../../libtool   --mode=install /usr/bin/install -c  ...
 
 /bin/sh ../libtool --mode=link gcc -Wl,-z,relro -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
+libtool: link: gcc -Wl,-z,relro -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
 /bin/sh ../libtool --mode=link gcc -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
+libtool: link: gcc -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
+
+# Debian bug #717598:
+/usr/share/apr-1.0/build/libtool --silent --mode=compile x86_64-linux-gnu-gcc -std=gnu99 -I/usr/include/libxml2 -pthread  -pipe -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security ... -prefer-pic -c mod_buffer.c
+/usr/share/apr-1.0/build/libtool --silent --mode=link x86_64-linux-gnu-gcc -std=gnu99 -I/usr/include/libxml2 -pthread  -pipe -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wl,--as-needed -Wl,-z,relro -o mod_buffer.la -rpath /usr/lib/apache2/modules -module -avoid-version  mod_buffer.lo
+/usr/share/apr-1.0/build/libtool --silent --mode=link x86_64-linux-gnu-gcc -std=gnu99  -pthread  -pipe -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -lssl -lcrypto -pie -Wl,--as-needed -Wl,-z,relro -o ab  ab.lo   -lcap        /usr/lib/libaprutil-1.la /usr/lib/libapr-1.la -lm
+/usr/share/apr-1.0/build/libtool --silent --mode=link x86_64-linux-gnu-gcc -std=gnu99  -pthread  -pipe -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -lssl -lcrypto -pie \
+               -Wl,--as-needed -Wl,-z,relro -o ab  ab.lo   -lcap        /usr/lib/libaprutil-1.la /usr/lib/libapr-1.la -lm
+
+/bin/bash ../libtool  --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I..   -D_FORTIFY_SOURCE=2  -Wall -Wextra -Wconversion -g -O2 -fPIE \
+    -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -MT coloredstderr.lo -MD -MP -MF .deps/coloredstderr.Tpo -c -o coloredstderr.lo coloredstderr.c
+libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I.. -D_FORTIFY_SOURCE=2 -Wall -Wextra -Wconversion -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -MT coloredstderr.lo -MD -MP -MF .deps/coloredstderr.Tpo -c coloredstderr.c  -fPIC -DPIC -o .libs/coloredstderr.o
+mv -f .deps/coloredstderr.Tpo .deps/coloredstderr.Plo
+/bin/bash ../libtool  --tag=CC   --mode=link gcc  -Wall -Wextra -Wconversion -g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 \
+    -Wformat -Werror=format-security  -fPIE -pie -Wl,-z,relro -Wl,-z,now -o libcoloredstderr.la -rpath /usr/local/lib coloredstderr.lo  -ldl
+libtool: link: gcc -shared  -fPIC -DPIC  .libs/coloredstderr.o   -ldl  -O2 -Wl,-z -Wl,relro -Wl,-z -Wl,now   -Wl,-soname -Wl,libcoloredstderr.so.0 -o .libs/libcoloredstderr.so.0.0.0
+libtool: link: (cd ".libs" && rm -f "libcoloredstderr.so.0" && ln -s "libcoloredstderr.so.0.0.0" "libcoloredstderr.so.0")
+libtool: link: (cd ".libs" && rm -f "libcoloredstderr.so" && ln -s "libcoloredstderr.so.0.0.0" "libcoloredstderr.so")
+libtool: link: ( cd ".libs" && rm -f "libcoloredstderr.la" && ln -s "../libcoloredstderr.la" "libcoloredstderr.la" )
+
+/bin/bash ../libtool --silent --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I..   -D_FORTIFY_SOURCE=2  -Wall -Wextra -Wconversion -g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -MT coloredstderr.lo -MD -MP -MF .deps/coloredstderr.Tpo -c -o coloredstderr.lo coloredstderr.c
+mv -f .deps/coloredstderr.Tpo .deps/coloredstderr.Plo
+/bin/bash ../libtool --silent --tag=CC   --mode=link gcc  -Wall -Wextra -Wconversion -g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security  -fPIE -pie -Wl,-z,relro -Wl,-z,now -o libcoloredstderr.la -rpath /usr/local/lib coloredstderr.lo  -ldl

diff --git a/t/tests.t b/t/tests.t
index 42263dfc186d3e1e5519d96756478e66c1dc997b..1cb00e47529b42fca8d78d1fde5d1ee672f13d47 100644 (file)
--- a/t/tests.t
+++ b/t/tests.t
@@ -771,32 +771,39 @@ is_blhc 'ada-pbuilder', '', 8,
 
 # libtool
 
-is_blhc 'libtool', '--bindnow', 8,
-        'CFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CC   --mode=compile x86_64-linux-gnu-gcc -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
-CXXFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CC   --mode=compile x86_64-linux-gnu-g++ -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.cpp
-CFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CC   --mode=compile gcc-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
-CFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CXX  --mode=compile g++-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
+is_blhc 'libtool', '--bindnow', 12,
+        'CFLAGS missing (-fPIE -Wformat): libtool: compile: x86_64-linux-gnu-gcc -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
+CXXFLAGS missing (-fPIE -Wformat): libtool: compile: x86_64-linux-gnu-g++ -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.cpp
+CFLAGS missing (-fPIE -Wformat): libtool: compile: gcc-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
+CFLAGS missing (-fPIE -Wformat): libtool: compile: g++-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
 LDFLAGS missing (-Wl,-z,now): libtool: link: g++ -shared test-a.o test-b.o test-b.o test-c.o -O2 -Wl,relro -o test.so
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc -Wl,-z -Wl,relro -o test test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../../../libtool  --mode=link cc -Wl,-z,relro -o test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../../../libtool  --mode=link gcc-4.6 -Wl,-z,relro -o test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../libtool --tag=CXX --mode=link x86_64-linux-gnu-g++ -Wl,-z,relro -o test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../libtool --tag=CC --mode=link gcc -Wl,-z,relro -o test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../libtool --tag=CC --mode=link gcc -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../libtool --tag=CC   --mode=link gcc -Wl,-z,relro -o test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now):   /bin/bash ../libtool --tag=CC   --mode=link gcc -Wl,-z,relro -o test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../../libtool  --tag=CC --preserve-dup-deps  --mode=link gcc -Wl,-z,relro -o test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now):  /bin/bash /tmp/test/build/libtool  --silent --tag CC --mode=relink gcc -Wl,-z,relro -o test.so test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now):  /bin/bash /tmp/test/build/libtool  --tag CXX --mode=relink g++ -Wl,-z,relro -o test.la test.o
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../libtool --tag=CC   --mode=link gcc  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security   -Wl,-z,relro -o test test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: cc -Wl,-z,relro -o test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc-4.6 -Wl,-z,relro -o test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: x86_64-linux-gnu-g++ -Wl,-z,relro -o test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc -Wl,-z,relro -o test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc -Wl,-z,relro -o test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now):   libtool: link: gcc -Wl,-z,relro -o test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc -Wl,-z,relro -o test.so test.o
+NONVERBOSE BUILD:  /bin/bash /tmp/test/build/libtool  --silent --tag CC --mode=relink gcc -Wl,-z,relro -o test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now):  libtool: relink: gcc -Wl,-z,relro -o test.so test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now):  libtool: relink: g++ -Wl,-z,relro -o test.la test.o
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security   -Wl,-z,relro -o test test.o
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -Wl,-z -Wl,relro -o .libs/test test.o
-CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security): /bin/bash ../libtool --tag=CC   --mode=link gcc -Wl,-z,relro -o test.so test.c
-CPPFLAGS missing (-D_FORTIFY_SOURCE=2): /bin/bash ../libtool --tag=CC   --mode=link gcc -Wl,-z,relro -o test.so test.c
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/bash ../libtool --tag=CC   --mode=link gcc -Wl,-z,relro -o test.so test.c
-CPPFLAGS missing (-D_FORTIFY_SOURCE=2): /bin/sh ../libtool --mode=link gcc -Wl,-z,relro -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
-LDFLAGS missing (-fPIE -pie -Wl,-z,now): /bin/sh ../libtool --mode=link gcc -Wl,-z,relro -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
-CPPFLAGS missing (-D_FORTIFY_SOURCE=2): /bin/sh ../libtool --mode=link gcc -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
-LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): /bin/sh ../libtool --mode=link gcc -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
+CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security): libtool: link: gcc -Wl,-z,relro -o test.so test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): libtool: link: gcc -Wl,-z,relro -o test.so test.c
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc -Wl,-z,relro -o test.so test.c
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): libtool: link: gcc -Wl,-z,relro -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
+LDFLAGS missing (-fPIE -pie -Wl,-z,now): libtool: link: gcc -Wl,-z,relro -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
+CPPFLAGS missing (-D_FORTIFY_SOURCE=2): libtool: link: gcc -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
+LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): libtool: link: gcc -o libtest.la test.h test-a.lo test-b.lo test-c.lo test-d.la
+NONVERBOSE BUILD: /usr/share/apr-1.0/build/libtool --silent --mode=compile x86_64-linux-gnu-gcc -std=gnu99 -I/usr/include/libxml2 -pthread  -pipe -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security ... -prefer-pic -c mod_buffer.c
+NONVERBOSE BUILD: /usr/share/apr-1.0/build/libtool --silent --mode=link x86_64-linux-gnu-gcc -std=gnu99 -I/usr/include/libxml2 -pthread  -pipe -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wl,--as-needed -Wl,-z,relro -o mod_buffer.la -rpath /usr/lib/apache2/modules -module -avoid-version  mod_buffer.lo
+NONVERBOSE BUILD: /usr/share/apr-1.0/build/libtool --silent --mode=link x86_64-linux-gnu-gcc -std=gnu99  -pthread  -pipe -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -lssl -lcrypto -pie -Wl,--as-needed -Wl,-z,relro -o ab  ab.lo   -lcap        /usr/lib/libaprutil-1.la /usr/lib/libapr-1.la -lm
+NONVERBOSE BUILD: /usr/share/apr-1.0/build/libtool --silent --mode=link x86_64-linux-gnu-gcc -std=gnu99  -pthread  -pipe -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -lssl -lcrypto -pie \             -Wl,--as-needed -Wl,-z,relro -o ab  ab.lo   -lcap        /usr/lib/libaprutil-1.la /usr/lib/libapr-1.la -lm
+NONVERBOSE BUILD: /bin/bash ../libtool --silent --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I..   -D_FORTIFY_SOURCE=2  -Wall -Wextra -Wconversion -g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -MT coloredstderr.lo -MD -MP -MF .deps/coloredstderr.Tpo -c -o coloredstderr.lo coloredstderr.c
+NONVERBOSE BUILD: /bin/bash ../libtool --silent --tag=CC   --mode=link gcc  -Wall -Wextra -Wconversion -g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security  -fPIE -pie -Wl,-z,relro -Wl,-z,now -o libcoloredstderr.la -rpath /usr/local/lib coloredstderr.lo  -ldl
 ';
 
 
@@ -932,7 +939,7 @@ is_blhc 'debian-hardening-wrapper-pbuilder', '--buildd', 0,
 ';
 
 is_blhc 'buildd-verbose-build', '--buildd', 0,
-        'W-compiler-flags-hidden|1 (of 5) hidden|
+        'W-compiler-flags-hidden|3 (of 5) hidden|
 ';
 
 is_blhc 'make', '--buildd', 0,