Handle dependency generation flags (-M/-MM/-MD/-MMD).

[blhc/blhc.git] / bin / blhc

diff --git a/bin/blhc b/bin/blhc
index 7b196a0ccf93a6d6ea521e5f7650847021852c00..91a5f4943c29076d61bde0904dffc7aa8d38a74a 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -129,26 +129,20 @@ my %extensions_compile_cpp = map { $_ => 1 } (
 );
 my %extension = map { $_ => 1 } (
     @source_no_preprocess,
 );
 my %extension = map { $_ => 1 } (
     @source_no_preprocess,

-    @source_no_preprocess_compile,
-    @source_no_preprocess_compile_cpp,
-    @source_no_preprocess_no_compile,

     @header_preprocess,
     @source_preprocess,
     @header_preprocess,
     @source_preprocess,

-    @source_preprocess_compile,
-    @source_preprocess_compile_cpp,
-    @source_preprocess_no_compile,

 );
 
 # Regexp to match file extensions.
 my $file_extension_regex = qr/
     \s
 );
 
 # Regexp to match file extensions.
 my $file_extension_regex = qr/
     \s

-    \S+         # Filename without extension.
+    \S+             # Filename without extension.

     \.
     \.

-    ([^\\.\s]+) # File extension.
-    (?=\s|\\)   # At end of word. Can't use \b because some files have non
-                # word characters at the end and because \b matches double
-                # extensions (like .cpp.o). Works always as all lines are
-                # terminated with "\n".
+    ([^\\.,;:\s]+)  # File extension.
+    (?=\s|\\)       # At end of word. Can't use \b because some files have non
+                    # word characters at the end and because \b matches double
+                    # extensions (like .cpp.o). Works always as all lines are
+                    # terminated with "\n".

     /x;
 
 # Expected (hardening) flags. All flags are used as regexps.
     /x;
 
 # Expected (hardening) flags. All flags are used as regexps.


@@ -181,10 +175,10 @@ my @def_cppflags_fortify = (
 );
 my @def_ldflags = ();
 my @def_ldflags_relro = (
 );
 my @def_ldflags = ();
 my @def_ldflags_relro = (

-    '-Wl,(-z,)?relro',
+    '-Wl,(?:-z,)?relro',

 );
 my @def_ldflags_bindnow = (
 );
 my @def_ldflags_bindnow = (

-    '-Wl,(-z,)?now',
+    '-Wl,(?:-z,)?now',

 );
 my @def_ldflags_pie = (
     '-fPIE',
 );
 my @def_ldflags_pie = (
     '-fPIE',


@@ -193,13 +187,38 @@ my @def_ldflags_pie = (
 my @def_ldflags_pic = (
     '-fPIC',
     '-fpic',
 my @def_ldflags_pic = (
     '-fPIC',
     '-fpic',

+    '-shared',

 );
 # Renaming rules for the output so the regex parts are not visible. Also
 # stores string values of flag regexps above, see compile_flag_regexp().
 my %flag_renames = (
 );
 # Renaming rules for the output so the regex parts are not visible. Also
 # stores string values of flag regexps above, see compile_flag_regexp().
 my %flag_renames = (

-    '-O(?:2|3)'       => '-O2',
-    '-Wl,(-z,)?relro' => '-Wl,-z,relro',
-    '-Wl,(-z,)?now'   => '-Wl,-z,now',
+    '-O(?:2|3)'         => '-O2',
+    '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
+    '-Wl,(?:-z,)?now'   => '-Wl,-z,now',
+);
+
+my %exit_code = (
+    no_compiler_commands => 1 << 0,
+    # used by POD::Usage => 1 << 1,
+    non_verbose_build    => 1 << 2,
+    flags_missing        => 1 << 3,
+    hardening_wrapper    => 1 << 4,
+    invalid_cmake        => 1 << 5,
+);
+
+# Statistics of missing flags and non-verbose build commands. Used for
+# $option_buildd.
+my %statistics = (
+    preprocess          => 0,
+    preprocess_missing  => 0,
+    compile             => 0,
+    compile_missing     => 0,
+    compile_cpp         => 0,
+    compile_cpp_missing => 0,
+    link                => 0,
+    link_missing        => 0,
+    commands            => 0,
+    commands_nonverbose => 0,

 );
 
 # Use colored (ANSI) output?
 );
 
 # Use colored (ANSI) output?


@@ -229,6 +248,14 @@ sub error_non_verbose_build {
            error_color(':', 'yellow'),
            $line;
 }
            error_color(':', 'yellow'),
            $line;
 }

+sub error_invalid_cmake {
+    my ($version) = @_;
+
+    printf "%s%s %s\n",
+            error_color('INVALID CMAKE', 'red'),
+            error_color(':', 'yellow'),
+            $version;
+}

 sub error_hardening_wrapper {
     printf "%s%s %s\n",
             error_color('HARDENING WRAPPER', 'red'),
 sub error_hardening_wrapper {
     printf "%s%s %s\n",
             error_color('HARDENING WRAPPER', 'red'),


@@ -296,13 +323,16 @@ sub is_non_verbose_build {
     my ($line, $next_line, $skip_ref) = @_;
 
     if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/
     my ($line, $next_line, $skip_ref) = @_;
 
     if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/

-                or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
+                or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/

                 or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
                 or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
                 or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
         return 0;
     }
 
                 or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
                 or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
                 or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
         return 0;
     }
 

+    # False positives.
+    return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+

     my $file = $1;
 
     # On the first pass we only check if this line is verbose or not.
     my $file = $1;
 
     # On the first pass we only check if this line is verbose or not.


@@ -317,7 +347,7 @@ sub is_non_verbose_build {
     if (defined $file) {
         # Get filename, we can't use the complete path as only parts of it are
         # used in the real compiler command.
     if (defined $file) {
         # Get filename, we can't use the complete path as only parts of it are
         # used in the real compiler command.

-        $file =~ m{/([a-zA-Z0-9._-]+)$};
+        $file =~ m{/([^/\s]+)$};

         $file = $1;
 
         if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/o) {
         $file = $1;
 
         if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/o) {


@@ -437,8 +467,13 @@ if ($option_all) {
 my $exit = 0;
 
 FILE: foreach my $file (@ARGV) {
 my $exit = 0;
 
 FILE: foreach my $file (@ARGV) {

+    print "checking '$file'...\n" if scalar @ARGV > 1;
+

     open my $fh, '<', $file or die "$!: $file";
 
     open my $fh, '<', $file or die "$!: $file";
 

+    # Architecture of this file.
+    my $arch = $option_arch;
+

     # Hardening options. Not all architectures support all hardening options.
     my $harden_format  = 1;
     my $harden_fortify = 1;
     # Hardening options. Not all architectures support all hardening options.
     my $harden_format  = 1;
     my $harden_fortify = 1;


@@ -456,7 +491,7 @@ FILE: foreach my $file (@ARGV) {
         # flags are not checked.
         if ($option_buildd and $line =~ /^Toolchain package versions: /) {
             require Dpkg::Version;
         # flags are not checked.
         if ($option_buildd and $line =~ /^Toolchain package versions: /) {
             require Dpkg::Version;

-            if ($line !~ /dpkg-dev_(\S+)/
+            if ($line !~ /\bdpkg-dev_(\S+)/

                     or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
                 $harden_format  = 0;
                 $harden_fortify = 0;
                     or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
                 $harden_format  = 0;
                 $harden_fortify = 0;


@@ -467,11 +502,32 @@ FILE: foreach my $file (@ARGV) {
             }
         }
 
             }
         }
 

+        # The following two versions of CMake in Debian obeyed CPPFLAGS, but
+        # this was later dropped because upstream rejected the patch. Thus
+        # build logs with these versions will have fortify hardening flags
+        # enabled, even though they may be not correctly set and are missing
+        # when build with later CMake versions. Thanks to Aron Xu for letting
+        # me know.
+        if ($line =~ /^Package versions: /
+                and $line =~ /\bcmake_(\S+)/
+                and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) {
+            if (not $option_buildd) {
+                error_invalid_cmake($1);
+            } else {
+                print "W-invalid-cmake-used $1\n";
+            }
+            $exit |= $exit_code{invalid_cmake};
+        }
+

         # If hardening wrapper is used (wraps calls to gcc and adds hardening
         # flags automatically) we can't perform any checks, abort.
         if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {
         # If hardening wrapper is used (wraps calls to gcc and adds hardening
         # flags automatically) we can't perform any checks, abort.
         if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {

-            error_hardening_wrapper();
-            $exit |= 1 << 4;
+            if (not $option_buildd) {
+                error_hardening_wrapper();
+            } else {
+                print "I-hardening-wrapper-used\n";
+            }
+            $exit |= $exit_code{hardening_wrapper};

             next FILE;
         }
 
             next FILE;
         }
 


@@ -492,9 +548,9 @@ FILE: foreach my $file (@ARGV) {
         last if $line =~ /^Build finished at \d{8}-\d{4}$/;
 
         # Detect architecture automatically unless overridden.
         last if $line =~ /^Build finished at \d{8}-\d{4}$/;
 
         # Detect architecture automatically unless overridden.

-        if (not $option_arch
+        if (not $arch

                 and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) {
                 and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) {

-            $option_arch = $1;
+            $arch = $1;

         }
 
         # Ignore compiler warnings for now.
         }
 
         # Ignore compiler warnings for now.


@@ -552,23 +608,24 @@ FILE: foreach my $file (@ARGV) {
                 }
 
                 # Ignore lines with no compiler commands.
                 }
 
                 # Ignore lines with no compiler commands.

-                next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose;
+                next if not $non_verbose
+                        and not $line =~ /\b$cc_regex(?:\s|\\)/o;
+                # Ignore lines with no filenames with extensions. May miss
+                # some non-verbose builds (e.g. "gcc -o test" [sic!]), but
+                # shouldn't be a problem as the log will most likely contain
+                # other non-verbose commands which are detected.
+                next if not $non_verbose
+                        and not $line =~ /$file_extension_regex/o;

 
                 # Ignore false positives.
                 #
                 # `./configure` output.
                 next if not $non_verbose
                         and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
 
                 # Ignore false positives.
                 #
                 # `./configure` output.
                 next if not $non_verbose
                         and $line =~ /^(?:checking|(?:C|c)onfigure:) /;

-                next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
+                next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)?

                                    (?:C|c)ompiler[\s.]*:?\s+
                                    (?:C|c)ompiler[\s.]*:?\s+

-                                   $cc_regex_full
-                                   (?:\s-std=[a-z0-9:+]+)?\s*$
-                                 /xo
-                        or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o
-                        or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
-                        or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
-                # `make` output.
-                next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++"
+                                 /xo;
+                next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;

 
                 # Check if additional hardening options were used. Used to
                 # ensure they are used for the complete build.
 
                 # Check if additional hardening options were used. Used to
                 # ensure they are used for the complete build.


@@ -583,13 +640,21 @@ FILE: foreach my $file (@ARGV) {
     close $fh;
 
     if (scalar @input == 0) {
     close $fh;
 
     if (scalar @input == 0) {

-        print "No compiler commands!\n";
-        $exit |= 1;
+        if (not $option_buildd) {
+            print "No compiler commands!\n";
+        } else {
+            print "W-no-compiler-commands\n";
+        }
+        $exit |= $exit_code{no_compiler_commands};

         next FILE;
     }
 
         next FILE;
     }
 

+    if ($option_buildd) {
+        $statistics{commands} += scalar @input;
+    }
+

     # Option or auto detected.
     # Option or auto detected.

-    if ($option_arch) {
+    if ($arch) {

         # The following was partially copied from dpkg-dev 1.16.1.2
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Kees Cook
         # The following was partially copied from dpkg-dev 1.16.1.2
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Kees Cook


@@ -597,10 +662,10 @@ FILE: foreach my $file (@ARGV) {
         # later. Keep it in sync.
 
         require Dpkg::Arch;
         # later. Keep it in sync.
 
         require Dpkg::Arch;

-        my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch);
+        my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);

 
         # Disable unsupported hardening options.
 
         # Disable unsupported hardening options.

-        if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') {
+        if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {

             $harden_stack = 0;
         }
         if ($cpu =~ /^(ia64|hppa|avr32)$/) {
             $harden_stack = 0;
         }
         if ($cpu =~ /^(ia64|hppa|avr32)$/) {


@@ -645,8 +710,12 @@ FILE: foreach my $file (@ARGV) {
 
         my $skip = 0;
         if (is_non_verbose_build($line, $input[$i + 1], \$skip)) {
 
         my $skip = 0;
         if (is_non_verbose_build($line, $input[$i + 1], \$skip)) {

-            error_non_verbose_build($line);
-            $exit |= 1 << 2;
+            if (not $option_buildd) {
+                error_non_verbose_build($line);
+            } else {
+                $statistics{commands_nonverbose}++;
+            }
+            $exit |= $exit_code{non_verbose_build};

             next;
         }
         # Even if it's a verbose build, we might have to skip this line.
             next;
         }
         # Even if it's a verbose build, we might have to skip this line.


@@ -655,10 +724,14 @@ FILE: foreach my $file (@ARGV) {
         # Remove everything until and including the compiler command. Makes
         # checks easier and faster.
         $line =~ s/^.*?$cc_regex//o;
         # Remove everything until and including the compiler command. Makes
         # checks easier and faster.
         $line =~ s/^.*?$cc_regex//o;

+        # "([...] test.c)" is not detected as 'test.c' - fix this by removing
+        # the brace and similar characters.
+        $line =~ s/['")]+$//;

 
         # Skip unnecessary tests when only preprocessing.
         my $flag_preprocess = 0;
 
 
         # Skip unnecessary tests when only preprocessing.
         my $flag_preprocess = 0;
 

+        my $dependency = 0;

         my $preprocess = 0;
         my $compile    = 0;
         my $link       = 0;
         my $preprocess = 0;
         my $compile    = 0;
         my $link       = 0;


@@ -668,11 +741,25 @@ FILE: foreach my $file (@ARGV) {
             $preprocess      = 1;
             $flag_preprocess = 1 if $1 eq '-E';
             $compile         = 1 if $1 eq '-S' or $1 eq '-c';
             $preprocess      = 1;
             $flag_preprocess = 1 if $1 eq '-E';
             $compile         = 1 if $1 eq '-S' or $1 eq '-c';

+        # Dependency generation for Makefiles. The other flags (-MF -MG -MP
+        # -MT -MQ) are always used with -M/-MM.
+        } elsif ($line =~ /\s(?:-M|-MM)\b/) {
+            $dependency = 1;

         # Otherwise assume we are linking.
         } else {
             $link = 1;
         }
 
         # Otherwise assume we are linking.
         } else {
             $link = 1;
         }
 

+        # -MD/-MMD also cause dependency generation, but they don't imply -E!
+        if ($line =~ /\s(?:-MD|-MMD)\b/) {
+            $dependency      = 0;
+            $flag_preprocess = 0;
+        }
+
+        # Dependency generation for Makefiles, no preprocessing or other flags
+        # needed.
+        next if $dependency;
+

         # Get all file extensions on this line.
         my @extensions = $line =~ /$file_extension_regex/go;
         # Ignore all unknown extensions to speedup the search below.
         # Get all file extensions on this line.
         my @extensions = $line =~ /$file_extension_regex/go;
         # Ignore all unknown extensions to speedup the search below.


@@ -711,6 +798,13 @@ FILE: foreach my $file (@ARGV) {
             $compile_cpp = 1;
         }
 
             $compile_cpp = 1;
         }
 

+        if ($option_buildd) {
+            $statistics{preprocess}++  if $preprocess;
+            $statistics{compile}++     if $compile;
+            $statistics{compile_cpp}++ if $compile_cpp;
+            $statistics{link}++        if $link;
+        }
+

         # Check hardening flags.
         my @missing;
         if ($compile and not all_flags_used($line, \@missing, @cflags)
         # Check hardening flags.
         my @missing;
         if ($compile and not all_flags_used($line, \@missing, @cflags)


@@ -720,8 +814,12 @@ FILE: foreach my $file (@ARGV) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {

-            error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
-            $exit |= 1 << 3;
+            if (not $option_buildd) {
+                error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            } else {
+                $statistics{compile_missing}++;
+            }
+            $exit |= $exit_code{flags_missing};

         } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
                 # Libraries linked with -fPIC don't have to (and can't) be
                 # linked with -fPIE as well. It's no error if only PIE flags
         } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
                 # Libraries linked with -fPIC don't have to (and can't) be
                 # linked with -fPIE as well. It's no error if only PIE flags


@@ -729,26 +827,75 @@ FILE: foreach my $file (@ARGV) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {

-            error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
-            $exit |= 1 << 3;
+            if (not $option_buildd) {
+                error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            } else {
+                $statistics{compile_cpp_missing}++;
+            }
+            $exit |= $exit_code{flags_missing};

         }
         if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) {
         }
         if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) {

-            error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
-            $exit |= 1 << 3;
+            if (not $option_buildd) {
+                error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            } else {
+                $statistics{preprocess_missing}++;
+            }
+            $exit |= $exit_code{flags_missing};

         }
         if ($link and not all_flags_used($line, \@missing, @ldflags)
                 # Same here, -fPIC conflicts with -fPIE.
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) {
         }
         if ($link and not all_flags_used($line, \@missing, @ldflags)
                 # Same here, -fPIC conflicts with -fPIE.
                 and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie)
                 # Assume dpkg-buildflags returns the correct flags.
                 and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) {

-            error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
-            $exit |= 1 << 3;
+            if (not $option_buildd) {
+                error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]);
+            } else {
+                $statistics{link_missing}++;
+            }
+            $exit |= $exit_code{flags_missing};

         }
     }
 }
 
         }
     }
 }
 

+# Print statistics for buildd mode, only output in this mode.
+if ($option_buildd) {
+    my @warning;
+
+    if ($statistics{preprocess_missing}) {
+        push @warning, sprintf "CPPFLAGS %d (of %d)",
+                               $statistics{preprocess_missing},
+                               $statistics{preprocess};
+    }
+    if ($statistics{compile_missing}) {
+        push @warning, sprintf "CFLAGS %d (of %d)",
+                               $statistics{compile_missing},
+                               $statistics{compile};
+    }
+    if ($statistics{compile_cpp_missing}) {
+        push @warning, sprintf "CXXFLAGS %d (of %d)",
+                               $statistics{compile_cpp_missing},
+                               $statistics{compile_cpp};
+    }
+    if ($statistics{link_missing}) {
+        push @warning, sprintf "LDFLAGS %d (of %d)",
+                               $statistics{link_missing},
+                               $statistics{link};
+    }
+    if (scalar @warning) {
+        local $" = ', '; # array join string
+        print "W-dpkg-buildflags-missing @warning missing\n";
+    }
+
+    if ($statistics{commands_nonverbose}) {
+        printf "W-compiler-flags-hidden %d (of %d) hidden\n",
+               $statistics{commands_nonverbose},
+               $statistics{commands},
+    }
+}
+
+

 exit $exit;
 
 
 exit $exit;
 
 


@@ -760,16 +907,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags
 
 =head1 SYNOPSIS
 
 
 =head1 SYNOPSIS
 

-B<blhc> [options] <dpkg-buildpackage build log file>..
-
-    --all                   force +all (+pie, +bindnow) check
-    --arch                  set architecture (autodetected)
-    --bindnow               force +bindbow check
-    --buildd                parser mode for buildds
-    --color                 use colored output
-    --pie                   force +pie check
-    --help                  available options
-    --version               version number and license
+B<blhc> [I<options>] I<E<lt>dpkg-buildpackage build log fileE<gt>..>

 
 =head1 DESCRIPTION
 
 
 =head1 DESCRIPTION
 


@@ -785,7 +923,7 @@ other important warnings. It's licensed under the GPL 3 or later.
 Force check for all +all (+pie, +bindnow) hardening flags. By default it's
 auto detected.
 
 Force check for all +all (+pie, +bindnow) hardening flags. By default it's
 auto detected.
 

-=item B<--arch>
+=item B<--arch> I<architecture>

 
 Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected
 
 Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected