X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=97e85714d726c3a25189a594496358cff7237a02;hp=59360fad514c785fb591b6869a71fc2a9b305562;hb=affd2ba7dcef980b10553894e0aa40ac1c7dd14e;hpb=df33515631599ff32c01b6304332a70e6682522b diff --git a/bin/blhc b/bin/blhc index 59360fa..97e8571 100755 --- a/bin/blhc +++ b/bin/blhc @@ -202,11 +202,11 @@ my @flag_refs = ( \@def_ldflags, \@def_ldflags_relro, \@def_ldflags_bindnow, + \@def_ldflags_pie, ); # References to all used flags. my @flag_refs_all = ( @flag_refs, - \@def_ldflags_pie, \@def_ldflags_pic, ); # Renaming rules for the output so the regex parts are not visible. Also @@ -226,6 +226,14 @@ my %exit_code = ( invalid_cmake => 1 << 5, ); +my %buildd_tag = ( + no_compiler_commands => 'I-no-compiler-commands', + non_verbose_build => 'W-compiler-flags-hidden', + flags_missing => 'W-dpkg-buildflags-missing', + hardening_wrapper => 'I-hardening-wrapper-used', + invalid_cmake => 'I-invalid-cmake-used', +); + # Statistics of missing flags and non-verbose build commands. Used for # $option_buildd. my %statistics = ( @@ -388,6 +396,21 @@ sub is_non_verbose_build { return 1; } +sub remove_flags { + my ($flag_refs_ref, $flag_renames_ref, @flags) = @_; + + my %removes = map { $_ => 1 } @flags; + foreach my $flags (@{$flag_refs_ref}) { + @{$flags} = grep { + # Flag found as string. + not exists $removes{$_} + # Flag found as string representation of regexp. + and (not defined $flag_renames_ref->{$_} + or not exists $removes{$flag_renames_ref->{$_}}) + } @{$flags}; + } +} + sub compile_flag_regexp { my ($flag_renames_ref, @flags) = @_; @@ -429,7 +452,9 @@ my $option_pie = 0; my $option_bindnow = 0; my @option_ignore_arch = (); my @option_ignore_flag = (); +my @option_ignore_arch_flag = (); my @option_ignore_line = (); +my @option_ignore_arch_line = (); my $option_all = 0; my $option_arch = undef; my $option_buildd = 0; @@ -444,7 +469,9 @@ if (not Getopt::Long::GetOptions( # Ignore. 'ignore-arch=s' => \@option_ignore_arch, 'ignore-flag=s' => \@option_ignore_flag, + 'ignore-arch-flag=s' => \@option_ignore_arch_flag, 'ignore-line=s' => \@option_ignore_line, + 'ignore-arch-line=s' => \@option_ignore_arch_line, # Misc. 'color' => \$option_color, 'arch=s' => \$option_arch, @@ -493,17 +520,27 @@ if ($option_all) { $option_bindnow = 1; } +# Precompiled ignores for faster lookup. +my %option_ignore_arch_flag = (); +my %option_ignore_arch_line = (); + # Strip flags which should be ignored. if (scalar @option_ignore_flag > 0) { - my %ignores = map { $_ => 1 } @option_ignore_flag; - foreach my $flags (@flag_refs) { - @{$flags} = grep { - # Flag found as string. - not exists $ignores{$_} - # Flag found as string representation of regexp. - and (not defined $flag_renames{$_} - or not exists $ignores{$flag_renames{$_}}) - } @{$flags}; + remove_flags(\@flag_refs, \%flag_renames, @option_ignore_flag); +} +# Same for arch specific ignore flags, but only prepare here. +if (scalar @option_ignore_arch_flag > 0) { + foreach my $ignore (@option_ignore_arch_flag) { + my ($ignore_arch, $ignore_flag) = split ':', $ignore, 2; + + if (not $ignore_arch or not $ignore_flag) { + printf STDERR 'Value "%s" invalid for option ignore-arch-flag ' + . '("arch:flag" expected)' . "\n", $ignore; + require Pod::Usage; + Pod::Usage::pod2usage(2); + } + + push @{$option_ignore_arch_flag{$ignore_arch}}, $ignore_flag; } } @@ -517,6 +554,21 @@ foreach my $flags (@flag_refs_all) { foreach my $ignore (@option_ignore_line) { $ignore = qr/^$ignore$/; } +# Same for arch specific ignore lines. +if (scalar @option_ignore_arch_line > 0) { + foreach my $ignore (@option_ignore_arch_line) { + my ($ignore_arch, $ignore_line) = split ':', $ignore, 2; + + if (not $ignore_arch or not $ignore_line) { + printf STDERR 'Value "%s" invalid for option ignore-arch-line ' + . '("arch:line" expected)' . "\n", $ignore; + require Pod::Usage; + Pod::Usage::pod2usage(2); + } + + push @{$option_ignore_arch_line{$ignore_arch}}, qr/^$ignore_line$/; + } +} # Final exit code. my $exit = 0; @@ -525,7 +577,7 @@ FILE: foreach my $file (@ARGV) { print "checking '$file'...\n" if scalar @ARGV > 1; - open my $fh, '<', $file or die "$!: $file"; + open my $fh, '<', $file or die $!; # Architecture of this file. my $arch = $option_arch; @@ -580,7 +632,7 @@ foreach my $file (@ARGV) { if (not $option_buildd) { error_invalid_cmake($1); } else { - print "W-invalid-cmake-used $1\n"; + print "$buildd_tag{invalid_cmake} $1\n"; } $exit |= $exit_code{invalid_cmake}; } @@ -592,7 +644,7 @@ foreach my $file (@ARGV) { if (not $option_buildd) { error_hardening_wrapper(); } else { - print "I-hardening-wrapper-used\n"; + print "$buildd_tag{hardening_wrapper}\n"; } $exit |= $exit_code{hardening_wrapper}; next FILE; @@ -718,7 +770,7 @@ foreach my $file (@ARGV) { if (not $option_buildd) { print "No compiler commands!\n"; } else { - print "W-no-compiler-commands\n"; + print "$buildd_tag{no_compiler_commands}\n"; } $exit |= $exit_code{no_compiler_commands}; next FILE; @@ -780,12 +832,27 @@ foreach my $file (@ARGV) { @ldflags = (@ldflags, @def_ldflags_bindnow); } + # Ignore flags for this arch if requested. + if ($arch and exists $option_ignore_arch_flag{$arch}) { + my @flag_refs = (\@cflags, \@cxxflags, \@cppflags, \@ldflags); + + remove_flags(\@flag_refs, + \%flag_renames, + @{$option_ignore_arch_flag{$arch}}); + } + + my @ignore_line = @option_ignore_line; + # Ignore lines for this arch if requested. + if ($arch and exists $option_ignore_arch_line{$arch}) { + @ignore_line = (@ignore_line, @{$option_ignore_arch_line{$arch}}); + } + LINE: for (my $i = 0; $i < scalar @input; $i++) { my $line = $input[$i]; # Ignore line if requested. - foreach my $ignore (@option_ignore_line) { + foreach my $ignore (@ignore_line) { next LINE if $line =~ /$ignore/; } @@ -966,11 +1033,11 @@ if ($option_buildd) { } if (scalar @warning) { local $" = ', '; # array join string - print "W-dpkg-buildflags-missing @warning missing\n"; + print "$buildd_tag{flags_missing} @warning missing\n"; } if ($statistics{commands_nonverbose}) { - printf "W-compiler-flags-hidden %d (of %d) hidden\n", + printf "$buildd_tag{non_verbose_build} %d (of %d) hidden\n", $statistics{commands_nonverbose}, $statistics{commands}, } @@ -1025,17 +1092,17 @@ changes are in effect: =over 2 -=item +=item * Print tags instead of normal warnings, see L for a list of possible tags. -=item +=item * Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is detected). -=item +=item * Don't require Term::ANSIColor. @@ -1051,6 +1118,14 @@ Ignore build logs from architectures matching I. I is a string. Used to prevent false positives. This option can be specified multiple times. +=item B<--ignore-arch-flag> I:I + +Like B<--ignore-flag>, but only ignore flag on I. + +=item B<--ignore-arch-line> I:I + +Like B<--ignore-line>, but only ignore line on I. + =item B<--ignore-flag> I Don't print an error when the specific flag is missing in a compiler line. @@ -1100,6 +1175,10 @@ Don't treat missing C<-g> as error: blhc --ignore-flag -g path/to/log/file +Don't treat missing C<-pie> on kfreebsd-amd64 as error: + + blhc --ignore-arch-flag kfreebsd-amd64:-pie path/to/log/file + Ignore lines consisting exactly of C<./script gcc file> which would cause a false positive. @@ -1121,17 +1200,13 @@ which is displayed. =over 2 -=item - -B +=item B The package uses hardening-wrapper which intercepts calls to gcc and adds hardening flags. The build log doesn't contain any hardening flags and thus can't be checked by blhc. -=item - -B (summary of hidden lines) +=item B (summary of hidden lines) Build log contains lines which hide the real compiler flags. For example: @@ -1145,19 +1220,20 @@ F fixes builds with hidden compiler flags. Sometimes C<.SILENT> in a F must be removed. And as last resort the F must be patched to remove the C<@>s hiding the real compiler commands. -=item - -B (summary of missing flags) +=item B (summary of missing flags) CPPFLAGS, CFLAGS, CXXFLAGS, LDFLAGS missing. -=item - -B (version) +=item B (version) -=item +By default CMake ignores CPPFLAGS thus missing those hardening flags. Debian +patched CMake in versions 2.8.7-1 and 2.8.7-2 to respect CPPFLAGS, but this +patch was rejected by upstream and later reverted in Debian. Thus those two +versions show correct usage of CPPFLAGS even if the package doesn't correctly +handle them (for example by passing them to CFLAGS). To prevent false +negatives just blacklist those two versions. -B +=item B No compiler commands were detected. Either the log contains none or they were not correctly detected by blhc (please report the bug in this case). @@ -1195,6 +1271,11 @@ Missing hardening flags. Hardening wrapper detected, no tests performed. +=item B<32> + +Invalid CMake version used. See B under L for a detailed explanation. + =back =head1 AUTHOR