(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
$cc_regex
/x;
+# Regex to check if a line contains a compiler command.
+my $cc_regex_normal = qr/
+ \b$cc_regex(?:\s|\\)
+ /x;
# Regex to catch (GCC) compiler warnings.
my $warning_regex = qr/^(.+?):(\d+):\d+: warning: (.+?) \[(.+?)\]$/;
# C++
qw( hh H hp hxx hpp HPP h++ tcc ),
);
+# Object files.
+my @object = (
+ # Normal object files.
+ qw ( o ),
+ # Libtool object files.
+ qw ( lo la ),
+ # Dynamic libraries. bzip2 uses .sho.
+ qw ( so sho ),
+ # Static libraries.
+ qw ( a ),
+);
# Hashes for fast extensions lookup to check if a file falls in one of these
# categories.
my %extensions_no_preprocess = map { $_ => 1 } (
+ # There's no @header_no_preprocess.
@source_no_preprocess,
);
my %extensions_preprocess = map { $_ => 1 } (
@source_preprocess_compile_cpp,
@source_no_preprocess_compile_cpp,
);
+my %extensions_object = map { $_ => 1 } (
+ @object,
+);
my %extension = map { $_ => 1 } (
@source_no_preprocess,
@header_preprocess,
@source_preprocess,
+ @object,
);
# Regexp to match file extensions.
# Ignore compiler warnings for now.
next if $line =~ /$warning_regex/o;
- if (not $option_buildd and index($line, "\033") != -1) { # esc
+ if (not $option_buildd and index($line, "\033") != -1) { # \033 = esc
# Remove all ANSI color sequences which are sometimes used in
# non-verbose builds.
$line = Term::ANSIColor::colorstrip($line);
# Ignore lines with no compiler commands.
next if not $non_verbose
- and not $line =~ /\b$cc_regex(?:\s|\\)/o;
+ and not $line =~ /$cc_regex_normal/o;
# Ignore lines with no filenames with extensions. May miss some
# non-verbose builds (e.g. "gcc -o test" [sic!]), but shouldn't be
# a problem as the log will most likely contain other non-verbose
\s.+\s
-I/usr/share/qt4/mkspecs/[a-z]+-g\++(?:-64)?
\s}x;
+ # Ignore false positives when the line contains only CC=gcc but no
+ # other gcc command.
+ if ($line =~ /(.*)CC=$cc_regex_full(.*)/o) {
+ my $before = $1;
+ my $after = $2;
+ next if not $before =~ /$cc_regex_normal/o
+ and not $after =~ /$cc_regex_normal/o;
+ }
# Check if additional hardening options were used. Used to ensure
# they are used for the complete build.
# Option or auto detected.
if ($arch) {
- # The following was partially copied from dpkg-dev 1.16.1.2
+ # The following was partially copied from dpkg-dev 1.16.4.3
# (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
# copyright Raphaƫl Hertzog <hertzog@debian.org>, Kees Cook
# <kees@debian.org>, Canonical, Ltd. licensed under GPL version 2 or
# checks easier and faster.
$line =~ s/^.*?$cc_regex//o;
# "([...] test.c)" is not detected as 'test.c' - fix this by removing
- # the brace and similar characters.
+ # the brace and similar characters at the line end.
$line =~ s/['")]+$//;
# Skip unnecessary tests when only preprocessing.
$preprocess = 1;
}
- # If there are source files then it's compiling/linking in one step
- # and we must check both. We only check for source files here, because
- # header files cause too many false positives.
- if (not $flag_preprocess
- and extension_found(\%extensions_compile_link, @extensions)) {
- # Assembly files don't need CFLAGS.
- if (not extension_found(\%extensions_compile, @extensions)
- and extension_found(\%extensions_no_compile, @extensions)) {
- $compile = 0;
- # But the rest does.
- } else {
- $compile = 1;
+ if (not $flag_preprocess) {
+ # If there are source files then it's compiling/linking in one
+ # step and we must check both. We only check for source files
+ # here, because header files cause too many false positives.
+ if (extension_found(\%extensions_compile_link, @extensions)) {
+ # Assembly files don't need CFLAGS.
+ if (not extension_found(\%extensions_compile, @extensions)
+ and extension_found(\%extensions_no_compile, @extensions)) {
+ $compile = 0;
+ # But the rest does.
+ } else {
+ $compile = 1;
+ }
+ # No compilable extensions found, either linking or compiling
+ # header flags.
+ #
+ # If there are also no object files we are just compiling headers
+ # (.h -> .h.gch). Don't check for linker flags in this case. Due
+ # to our liberal checks for compiler lines, this also reduces the
+ # number of false positives considerably.
+ } elsif ($link
+ and not extension_found(\%extensions_object, @extensions)) {
+ $link = 0;
}
}
tools using dpkg-buildpackage like pbuilder or the official buildd build logs)
to help maintainers detect missing hardening flags in their packages.
+Only gcc is detected as compiler at the moment. If other compilers support
+hardening flags as well, please report them.
+
If there's no output, no flags are missing and the build log is fine.
=head1 OPTIONS
=item *
-Return exit code 0, unless there was a error.
+Return exit code 0, unless there was a error (-I, -W messages don't count as
+error).
=back