Sync architecture specific hardening support with dpkg 1.22.5

[blhc/blhc.git] / bin / blhc

diff --git a/bin/blhc b/bin/blhc
index dda96124fe76f12318a56683efd4c173dbb4e868..9040a084c873e691faae0801f8531588ec046883 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -49,6 +49,9 @@ my $cc_regex_full = qr/
 my $cc_regex_normal = qr/
     \b$cc_regex(?:\s|\\)
     /x;
+my $rustc_regex = qr/
+    \brustc\b
+    /x;
 # Regex to catch (GCC) compiler warnings.
 my $warning_regex = qr/^(.+?):(\d+):\d+: warning: (.+?) \[(.+?)\]$/;
 # Regex to catch libtool commands and not lines which show commands executed
@@ -522,7 +525,7 @@ sub pic_pie_conflict {
 }
 
 sub is_non_verbose_build {
-    my ($line, $skip_ref, $input_ref, $line_offset, $line_count) = @_;
+    my ($line, $cargo, $skip_ref, $input_ref, $line_offset, $line_count) = @_;
 
     if ($line =~ /$libtool_regex/o) {
         # libtool's --silent hides the real compiler flags.
@@ -554,6 +557,8 @@ sub is_non_verbose_build {
     # "Compiling" non binary files.
     return 0 if $line =~ /^\s*Compiling \S+\.(?:py|pyx|el)['"]?\s*(?:\.\.\.|because it changed\.)?$/;
     return 0 if $line =~ /^\s*[Cc]ompiling catalog \S+\.po\b/;
+    # cargo build
+    return 0 if $cargo and $line =~ m{^\s*Compiling\s+\S+\s+v\S+(?:\s+\(/<<PKGBUILDDIR>>\))?$};
     # "Compiling" with no file name.
     if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) {
         # $file_extension_regex may need spaces around the filename.
@@ -813,6 +818,9 @@ foreach my $file (@ARGV) {
         $disable_harden_pie = 1;
     }
 
+    # Ignore additional false positives if cargo/rust is used
+    my $cargo = 0;
+
     my $number = 0;
     while (my $line = <$fh>) {
         $number++;
@@ -909,6 +917,10 @@ foreach my $file (@ARGV) {
                 }
                 next FILE;
             }
+
+            if ($line =~ /\bcargo\b/) {
+                $cargo = 1;
+            }
         }
 
         # This flags is not always available, but if it is use it.
@@ -990,7 +1002,7 @@ foreach my $file (@ARGV) {
 
         # Check if this line indicates a non verbose build.
         my $skip = 0;
-        $non_verbose |= is_non_verbose_build($line, \$skip);
+        $non_verbose |= is_non_verbose_build($line, $cargo, \$skip);
         next if $skip;
 
         # Treat each command as a single line so we don't ignore valid
@@ -1112,7 +1124,9 @@ foreach my $file (@ARGV) {
             # Embedded `gcc -print-*` commands
             next if $line =~ /`$cc_regex_normal\s*[^`]*-print-\S+`/;
             # cmake checking for compiler flags without setting CPPFLAGS
-            next if $line =~ m{^\s*/usr/(bin|lib)/(ccache/)?c\+\+ -dM -E -c /usr/share/cmake-\S+/Modules/CMakeCXXCompilerABI\.cpp};
+            next if $line =~ m{^\s*/usr/(bin|lib)/(ccache/)?c\+\+ (?:-std=\S+ )?-dM -E -c /usr/share/cmake-\S+/Modules/CMakeCXXCompilerABI\.cpp};
+            # Some rustc lines look like linker commands
+            next if $cargo and $line =~ /$rustc_regex/o;
 
             # Check if additional hardening options were used. Used to ensure
             # they are used for the complete build.
@@ -1181,6 +1195,7 @@ foreach my $file (@ARGV) {
             i386
             kfreebsd-amd64
             kfreebsd-i386
+            loong64
             mips
             mips64
             mips64el
@@ -1203,7 +1218,11 @@ foreach my $file (@ARGV) {
         );
 
         # Disable unsupported hardening options.
-        if ($os !~ /^(?:linux|kfreebsd|knetbsd|hurd)$/ or $cpu eq 'hppa') {
+        if ($disable_harden_pie and exists $builtin_pie_arch{$arch}) {
+            $harden_pie = 0;
+        }
+        if ($os !~ /^(?:linux|kfreebsd|hurd)$/
+                or $cpu =~ /^(?:alpha|hppa|ia64)$/) {
             $harden_pie = 0;
         }
         if ($cpu =~ /^(?:ia64|alpha|hppa|nios2)$/ or $arch eq 'arm') {
@@ -1214,10 +1233,6 @@ foreach my $file (@ARGV) {
             $harden_relro   = 0;
             $harden_bindnow = 0;
         }
-
-        if ($disable_harden_pie and exists $builtin_pie_arch{$arch}) {
-            $harden_pie = 0;
-        }
     }
 
     # Default values.
@@ -1298,7 +1313,7 @@ LINE:
 
         my $skip = 0;
         if ($input_nonverbose[$i]
-                and is_non_verbose_build($line, \$skip,
+                and is_non_verbose_build($line, $cargo, \$skip,
                                          \@input, $i, $parallel)) {
             if (not $option_buildd) {
                 error_non_verbose_build($line, $input_number[$i]);