X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=5bbfe73255836fd23bba513edaf9f2af1734ba73;hp=7f1fd84fe1b078841eebbcd06a1c4f83cd6a5e2c;hb=c3edfcb8350482755554fea4bcf45973f02137f8;hpb=aa0da48a68484b4656e97251de39086d0a80137d

diff --git a/bin/blhc b/bin/blhc
index 7f1fd84..5bbfe73 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -209,6 +209,7 @@ my %exit_code = (
     non_verbose_build    => 1 << 2,
     flags_missing        => 1 << 3,
     hardening_wrapper    => 1 << 4,
+    invalid_cmake        => 1 << 5,
 );
 
 # Statistics of missing flags and non-verbose build commands. Used for
@@ -253,6 +254,14 @@ sub error_non_verbose_build {
            error_color(':', 'yellow'),
            $line;
 }
+sub error_invalid_cmake {
+    my ($version) = @_;
+
+    printf "%s%s %s\n",
+            error_color('INVALID CMAKE', 'red'),
+            error_color(':', 'yellow'),
+            $version;
+}
 sub error_hardening_wrapper {
     printf "%s%s %s\n",
             error_color('HARDENING WRAPPER', 'red'),
@@ -494,6 +503,23 @@ FILE: foreach my $file (@ARGV) {
             }
         }
 
+        # The following two versions of CMake in Debian obeyed CPPFLAGS, but
+        # this was later dropped because upstream rejected the patch. Thus
+        # build logs with these versions will have fortify hardening flags
+        # enabled, even though they may be not correctly set and are missing
+        # when build with later CMake versions. Thanks to Aron Xu for letting
+        # me know.
+        if ($line =~ /^Package versions: /
+                and $line =~ /\bcmake_(\S+)/
+                and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) {
+            if (not $option_buildd) {
+                error_invalid_cmake($1);
+            } else {
+                print "W-invalid-cmake-used $1\n";
+            }
+            $exit |= $exit_code{invalid_cmake};
+        }
+
         # If hardening wrapper is used (wraps calls to gcc and adds hardening
         # flags automatically) we can't perform any checks, abort.
         if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {