X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=783ae73f27b66eb68df2fbc3c8e9c1635ebbfd2d;hp=c13f3b6961b1a41ecfcf8ef91fd6c4433ba05e1e;hb=f840b1b9362096ce7a0b8813a37555d934d21887;hpb=959cbe56d9b89868c42c2ae0082771eea8f31d1a

diff --git a/bin/blhc b/bin/blhc
index c13f3b6..783ae73 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
 
 # Build log hardening check, checks build logs for missing hardening flags.
 
-# Copyright (C) 2012  Simon Ruderich
+# Copyright (C) 2012-2013  Simon Ruderich
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@ use warnings;
 use Getopt::Long ();
 use Text::ParseWords ();
 
-our $VERSION = '0.03';
+our $VERSION = '0.04';
 
 
 # CONSTANTS/VARIABLES
@@ -250,11 +250,11 @@ my @flag_refs_all = (
 # Renaming rules for the output so the regex parts are not visible. Also
 # stores string values of flag regexps above, see compile_flag_regexp().
 my %flag_renames = (
-    '-O(?:2|3)'         => '-O2',
-    '-Wformat(?:=2)?'   => '-Wformat',
+    '-O(?:2|3)'                    => '-O2',
+    '-Wformat(?:=2)?'              => '-Wformat',
     '--param[= ]ssp-buffer-size=4' => '--param=ssp-buffer-size=4',
-    '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
-    '-Wl,(?:-z,)?now'   => '-Wl,-z,now',
+    '-Wl,(?:-z,)?relro'            => '-Wl,-z,relro',
+    '-Wl,(?:-z,)?now'              => '-Wl,-z,now',
 );
 
 my %exit_code = (
@@ -440,6 +440,7 @@ sub is_non_verbose_build {
     #
     # C++ compiler setting.
     return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+    return 0 if $line =~ /^\s*C\+\+ Library: stdc\+\+$/;
     # "Compiling" with no file name.
     if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) {
         # $file_extension_regex may need spaces around the filename.
@@ -565,7 +566,7 @@ if ($option_help) {
     Pod::Usage::pod2usage(1);
 }
 if ($option_version) {
-    print "blhc $VERSION  Copyright (C) 2012  Simon Ruderich
+    print "blhc $VERSION  Copyright (C) 2012-2013  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -723,7 +724,10 @@ foreach my $file (@ARGV) {
             }
         }
 
-        if (index($line, 'Build-Depends: ') == 0) {
+        # Debian's build daemons use Build-Depends: for the build
+        # dependencies, but pbuilder just uses Depends:; support both.
+        if (index($line, 'Build-Depends: ') == 0
+                or index($line, 'Depends: ') == 0) {
             # If hardening wrapper is used (wraps calls to gcc and adds
             # hardening flags automatically) we can't perform any checks,
             # abort.
@@ -768,6 +772,13 @@ foreach my $file (@ARGV) {
         if (not $arch
                 and index($line, 'dpkg-buildpackage: host architecture ') == 0) {
             $arch = substr $line, 37, -1; # -1 to ignore '\n' at the end
+
+            # Old buildd logs use e.g. "host architecture is alpha", remove
+            # the "is", otherwise debarch_to_debtriplet() will not detect the
+            # architecture.
+            if (index($arch, 'is ') == 0) {
+                $arch = substr $arch, 3;
+            }
         }
 
         # Ignore compiler warnings for now.
@@ -842,12 +853,15 @@ foreach my $file (@ARGV) {
                                 [Cc]ompiler[\s.]*:?\s+
                                 /x;
             next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
-            # `moc-qt4`, contains '-I/usr/share/qt4/mkspecs/linux-g++' (or
-            # similar for other architectures) which gets recognized as a
-            # compiler line. Ignore it.
-            next if $line =~ m{^/usr/bin/moc-qt4
+            # `moc-qt4`/`moc-qt5` contain '-I.../linux-g++' in their command
+            # line (or similar for other architectures) which gets recognized
+            # as a compiler line, but `moc-qt*` is only a preprocessor for Qt
+            # C++ files. No hardening flags are relevant during this step,
+            # thus ignore `moc-qt*` lines. The resulting files will be
+            # compiled in a separate step (and therefore checked).
+            next if $line =~ m{^\S+/bin/moc-qt[45]
                                \s.+\s
-                               -I/usr/share/qt4/mkspecs/[a-z]+-g\++(?:-64)?
+                               -I\S+/mkspecs/[a-z]+-g\++(?:-64)?
                                \s}x;
             # Ignore false positives when the line contains only CC=gcc but no
             # other gcc command.
@@ -1467,7 +1481,7 @@ E<lt>jari.aalto@cante.netE<gt> for their valuable input and suggestions.
 
 =head1 LICENSE AND COPYRIGHT
 
-Copyright (C) 2012 by Simon Ruderich
+Copyright (C) 2012-2013 by Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by