X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=README;h=5e58567bbf6899f0078a7af423ff3236c05aa2e5;hp=8944b54b55e1c3d57239022a6fb4837b1f8e39c6;hb=d569fff93bdd0e2f2bf8c041a6534d8a19613969;hpb=76236e46263e6d2cc6ed9451ae5ef1ff63711ba7

diff --git a/README b/README
index 8944b54..5e58567 100644
--- a/README
+++ b/README
@@ -13,8 +13,9 @@ all compiler commands use the correct hardening flags and thus all hardening
 features are correctly used.
 
 It's designed to check build logs generated by Debian's dpkg-buildpackage (or
-tools using dpkg-buildpackage like pbuilder or the official buildd build logs)
-to help maintainers detect missing hardening flags in their packages.
+tools using dpkg-buildpackage like pbuilder or sbuild (which is used for the
+official buildd build logs)) to help maintainers detect missing hardening
+flags in their packages.
 
 At the moment it works only on Debian and derivatives but it should be easily
 extendable to other systems as well. Patches are welcome.
@@ -100,11 +101,12 @@ following line (output of dpkg-buildpackage):
 The available hardening flags are adapted to the architecture because some
 architectures don't support certain hardening options.
 
-Some checks (Ada and hardening-wrapper at the moment) check the build
-dependencies for certain packages. The following lines are used to get the
-build dependencies. The first is used in buildd build logs, the second by
-pbuilder logs, both are detected:
+Some checks check the build dependencies for certain packages. The following
+lines are used to get the build dependencies. The first two are used in buildd
+build logs (the second was used in older logs), the third by pbuilder logs,
+all are detected:
 
+    Filtered Buildd-Depends: ...
     Build-Depends: ...
     Depends: ...
 
@@ -118,9 +120,13 @@ real compile process (output of dpkg-buildpackage):
     dpkg-buildpackage: ...
 
 If it's not present no compiler commands are detected. In case you don't use
-dpkp-buildpackage but still want to check a build log adding it as first line
+dpkp-buildpackage but still want to check a build log, adding it as first line
 should work fine.
 
+To prevent false positives when checking debug builds, compiler lines
+containing '-OO' or '-Og' are considered debug builds and are not checked for
+'-O2', even though fortification doesn't work without '-O2'.
+
 The following non-verbose builds can't be detected:
 
     gcc -o test
@@ -168,7 +174,7 @@ LICENSE
 
 blhc is licensed under GPL version 3 or later.
 
-Copyright (C) 2012  Simon Ruderich
+Copyright (C) 2012-2013  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by