X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=3b7f746113c319484b10f900f7c1fa50228d8e29;hp=d6e269091878869dbe8ab371ae954913003af2e8;hb=a4712dd7fab2e1e14ba27894279dc793d1944536;hpb=c4814aa2ad8a7a35e71839347b7fae2507be2ded

diff --git a/bin/blhc b/bin/blhc
index d6e2690..3b7f746 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
 
 # Build log hardening check, checks build logs for missing hardening flags.
 
-# Copyright (C) 2012-2019  Simon Ruderich
+# Copyright (C) 2012-2020  Simon Ruderich
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@ use warnings;
 use Getopt::Long ();
 use Text::ParseWords ();
 
-our $VERSION = '0.09';
+our $VERSION = '0.11';
 
 
 # CONSTANTS/VARIABLES
@@ -532,7 +532,7 @@ sub is_non_verbose_build {
 
     if (not (index($line, 'checking if you want to see long compiling messages... no') == 0
                 or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
-                or $line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/
+                or $line =~ /^\s*[][\/0-9 ]*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/
                 or $line =~ /^\s*[Bb]uilding (?:program|shared library)\s+(.+?)$/
                 or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
         return 0;
@@ -684,7 +684,7 @@ if ($option_help) {
 }
 if ($option_version) {
     print <<"EOF";
-blhc $VERSION  Copyright (C) 2012-2019  Simon Ruderich
+blhc $VERSION  Copyright (C) 2012-2020  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -750,6 +750,7 @@ foreach my $flags (@flag_refs_all) {
 }
 
 # Precompile ignore line regexps, also anchor at beginning and end of line.
+# Additional entries are also extracted from the build log, see below.
 foreach my $ignore (@option_ignore_line) {
     $ignore = qr/^$ignore$/;
 }
@@ -954,6 +955,15 @@ foreach my $file (@ARGV) {
             }
         }
 
+        # Permit dynamic excludes from within the build log to ignore false
+        # positives. Cannot use a separate config file as we often only have
+        # the build log itself.
+        if (index($line, 'blhc: ignore-line-regexp: ') == 0) {
+            my $ignore = substr $line, 26, -1; # -1 to ignore '\n' at the end
+            push @option_ignore_line, qr/^$ignore$/;
+            next;
+        }
+
         next if $line =~ /^\s*#/;
         # Ignore compiler warnings for now.
         next if $line =~ /$warning_regex/o;
@@ -1061,10 +1071,15 @@ foreach my $file (@ARGV) {
             # look like a compiler executable thus causing the line to be
             # treated as a normal compiler line.
             next if $line =~ m{^\s*rm\s+};
+            next if $line =~ m{^\s*dwz\s+};
             # Some build systems emit "gcc > file".
             next if $line =~ m{$cc_regex_normal\s*>\s*\S+}o;
             # Hex output may contain "cc".
             next if $line =~ m#(?:\b[0-9a-fA-F]{2,}\b\s*){5}#;
+            # Meson build output
+            next if $line =~ /^C\+\+ linker for the host machine: /;
+            # Embedded `gcc -print-*` commands
+            next if $line =~ /`$cc_regex_normal\s*[^`]*-print-\S+`/;
 
             # Check if additional hardening options were used. Used to ensure
             # they are used for the complete build.
@@ -1106,7 +1121,7 @@ foreach my $file (@ARGV) {
 
     # Option or auto detected.
     if ($arch) {
-        # The following was partially copied from dpkg-dev 1.19.7
+        # The following was partially copied from dpkg-dev 1.20.5
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, _add_build_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Guillem Jover
         # <guillem@debian.org>, Kees Cook <kees@debian.org>, Canonical, Ltd.
@@ -1513,6 +1528,22 @@ If there's no output, no flags are missing and the build log is fine.
 See F<README> for details about performed checks, auto-detection and
 limitations.
 
+=head1 FALSE POSITIVES
+
+To suppress false positives you can embed the following string in the build
+log:
+
+    blhc: ignore-line-regexp: REGEXP
+
+All lines fully matching REGEXP (see B<--ignore-line> for details) will be
+ignored.
+
+Please use this feature sparingly so that missing flags are not overlooked. If
+you find false positives which affect more packages please report a bug.
+
+To generate this string simply use echo in C<debian/rules>; make sure to use @
+to suppress the echo command itself as it could also trigger a false positive.
+
 =head1 OPTIONS
 
 =over 8
@@ -1758,7 +1789,7 @@ E<lt>jari.aalto@cante.netE<gt> for their valuable input and suggestions.
 
 =head1 LICENSE AND COPYRIGHT
 
-Copyright (C) 2012-2019 by Simon Ruderich
+Copyright (C) 2012-2020 by Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by