# MAIN
# Parse command line arguments.
-my $option_help = 0;
-my $option_version = 0;
-my $option_pie = 0;
-my $option_bindnow = 0;
-my @option_ignore_arch = ();
-my @option_ignore_flag = ();
+my $option_help = 0;
+my $option_version = 0;
+my $option_pie = 0;
+my $option_bindnow = 0;
+my @option_ignore_arch = ();
+my @option_ignore_flag = ();
my @option_ignore_arch_flag = ();
-my @option_ignore_line = ();
+my @option_ignore_line = ();
my @option_ignore_arch_line = ();
-my $option_all = 0;
-my $option_arch = undef;
-my $option_buildd = 0;
- $option_color = 0;
+my $option_all = 0;
+my $option_arch = undef;
+my $option_buildd = 0;
+ $option_color = 0;
if (not Getopt::Long::GetOptions(
- 'help|h|?' => \$option_help,
- 'version' => \$option_version,
+ 'help|h|?' => \$option_help,
+ 'version' => \$option_version,
# Hardening options.
- 'pie' => \$option_pie,
- 'bindnow' => \$option_bindnow,
- 'all' => \$option_all,
+ 'pie' => \$option_pie,
+ 'bindnow' => \$option_bindnow,
+ 'all' => \$option_all,
# Ignore.
- 'ignore-arch=s' => \@option_ignore_arch,
- 'ignore-flag=s' => \@option_ignore_flag,
+ 'ignore-arch=s' => \@option_ignore_arch,
+ 'ignore-flag=s' => \@option_ignore_flag,
'ignore-arch-flag=s' => \@option_ignore_arch_flag,
- 'ignore-line=s' => \@option_ignore_line,
+ 'ignore-line=s' => \@option_ignore_line,
'ignore-arch-line=s' => \@option_ignore_arch_line,
# Misc.
- 'color' => \$option_color,
- 'arch=s' => \$option_arch,
- 'buildd' => \$option_buildd,
+ 'color' => \$option_color,
+ 'arch=s' => \$option_arch,
+ 'buildd' => \$option_buildd,
)) {
require Pod::Usage;
Pod::Usage::pod2usage(2);
[Cc]ompiler[\s.]*:?\s+
/xo;
next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
+ # `moc-qt4`, contains '-I/usr/share/qt4/mkspecs/linux-g++' (or
+ # similar for other architectures) which gets recognized as a
+ # compiler line. Ignore it.
+ next if $line =~ m{^/usr/bin/moc-qt4
+ \s.+\s
+ -I/usr/share/qt4/mkspecs/[a-z]+-g\++(?:-64)?
+ \s}x;
# Check if additional hardening options were used. Used to ensure
# they are used for the complete build.
- $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie);
+ $harden_pie = 1 if any_flags_used($line, @def_cflags_pie,
+ @def_ldflags_pie);
$harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow);
push @input, $line;
=head1 SYNOPSIS
-B<blhc> [I<options>] I<E<lt>dpkg-buildpackage build log fileE<gt>..>
+B<blhc> [I<options>] I<< <dpkg-buildpackage build log file>.. >>
=head1 DESCRIPTION
tools using dpkg-buildpackage like pbuilder or the official buildd build logs)
to help maintainers detect missing hardening flags in their packages.
+If there's no output, no flags are missing and the build log is fine.
+
=head1 OPTIONS
=over 8
blhc path/to/log/file
+If there's no output, no flags are missing and the build log is fine.
+
Parse multiple log files. The exit code is ORed over all files.
blhc path/to/directory/with/log/files/*