X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=f9455868e6996e59c45f50825110ec1f11119cbd;hp=c82e9bc37475987d2bb8610e6c160ec2a9f42fb6;hb=a7795c35f46dfbff0e3a832a48ff288107fcc81d;hpb=b85a3fb508fc2f9d98d44583cf31cbf5ac63a382

diff --git a/bin/blhc b/bin/blhc
index c82e9bc..f945586 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -119,7 +119,7 @@ sub any_flags_used {
     my ($line, @flags) = @_;
 
     foreach my $flag (@flags) {
-        return 1 if $line =~ /\s$flag(?:\s|\\|$)/;
+        return 1 if $line =~ /\s$flag(?:\s|\\)/;
     }
 
     return 0;
@@ -129,14 +129,12 @@ sub all_flags_used {
 
     my @missing_flags = ();
     foreach my $flag (@flags) {
-        if ($line !~ /\s$flag(?:\s|\\|$)/) {
+        if ($line !~ /\s$flag(?:\s|\\)/) {
             push @missing_flags, $flag;
         }
     }
 
-    if (scalar @missing_flags == 0) {
-        return 1;
-    }
+    return 1 if scalar @missing_flags == 0;
 
     @{$missing_flags_ref} = @missing_flags;
     return 0;
@@ -219,6 +217,7 @@ my $option_help    = 0;
 my $option_version = 0;
 my $option_all     = 0;
 my $option_arch    = undef;
+my $option_buildd  = 0;
 if (not Getopt::Long::GetOptions(
             'help|h|?' => \$option_help,
             'version'  => \$option_version,
@@ -228,6 +227,7 @@ if (not Getopt::Long::GetOptions(
             'all'      => \$option_all,
             # Misc.
             'arch'     => \$option_arch,
+            'buildd'   => \$option_buildd,
         )) {
     require Pod::Usage;
     Pod::Usage::pod2usage(2);
@@ -270,8 +270,28 @@ my $start = 0;
 my $continuation = 0;
 my $complete_line = undef;
 while (my $line = <>) {
-    # We skip over unimportant lines at the beginning to prevent false
-    # positives.
+    # dpkg-buildflags only provides hardening flags since 1.16.1, don't check
+    # for hardening flags in buildd mode if an older dpkg-dev is used. Default
+    # flags (-g -O2) are still checked.
+    #
+    # Packages which were built before 1.16.1 but used their own hardening
+    # flags are not checked.
+    if ($option_buildd and not $start
+            and $line =~ /^Toolchain package versions: /) {
+        require Dpkg::Version;
+        if ($line !~ /dpkg-dev_(\S+)/
+                or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
+            $harden_format  = 0;
+            $harden_fortify = 0;
+            $harden_stack   = 0;
+            $harden_relro   = 0;
+            $harden_bindnow = 0;
+            $harden_pie     = 0;
+        }
+    }
+
+    # We skip over unimportant lines at the beginning of the log to prevent
+    # false positives.
     $start = 1 if $line =~ /^dpkg-buildpackage:/;
     next if not $start;
 
@@ -287,7 +307,7 @@ while (my $line = <>) {
     # Remove all ANSI color sequences which are sometimes used in non-verbose
     # builds.
     $line = Term::ANSIColor::colorstrip($line);
-    # Also strip '\0xf' (delete previous character), used by Elink's build
+    # Also strip '\0xf' (delete previous character), used by Elinks' build
     # system.
     $line =~ s/\x0f//g;
     # And "ESC(B" which seems to be used on armhf and hurd (not sure what it
@@ -492,6 +512,7 @@ B<blhc> [--pie] [--bindnow] [--all]
     --bindnow               force +bindbow check
     --all                   force +all (+pie, +bindnow) check
     --arch                  set architecture (autodetected)
+    --buildd                parser mode for buildds
 
 =head1 DESCRIPTION
 
@@ -529,6 +550,20 @@ Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected
 automatically if dpkg-buildpackage is used.
 
+=item B<--buildd>
+
+Special mode for buildds when automatically parsing log files. The following
+changes are in effect:
+
+=over 2
+
+=item
+
+Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is
+detected).
+
+=back
+
 =back
 
 Auto detection for B<--pie> and B<--bindnow> only works if at least one