# C++ compiler setting.
return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
return 0 if $line =~ /^\s*C\+\+ Library: stdc\+\+$/;
# C++ compiler setting.
return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
return 0 if $line =~ /^\s*C\+\+ Library: stdc\+\+$/;
# "Compiling" with no file name.
if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) {
# $file_extension_regex may need spaces around the filename.
# "Compiling" with no file name.
if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) {
# $file_extension_regex may need spaces around the filename.
while (my $line = <$fh>) {
# And stop at the end of the build log. Package details (reported by
# the buildd logs) are not important for us. This also prevents false
while (my $line = <$fh>) {
# And stop at the end of the build log. Package details (reported by
# the buildd logs) are not important for us. This also prevents false
last if index($line, 'Build finished at ') == 0
and $line =~ /^Build finished at \d{8}-\d{4}$/;
last if index($line, 'Build finished at ') == 0
and $line =~ /^Build finished at \d{8}-\d{4}$/;
# Detect architecture automatically unless overridden.
if (not $arch
and index($line, 'dpkg-buildpackage: host architecture ') == 0) {
# Detect architecture automatically unless overridden.
if (not $arch
and index($line, 'dpkg-buildpackage: host architecture ') == 0) {
# One line may contain multiple commands (";"). Treat each one as
# single line. parse_line() is slow, only use it when necessary.
# One line may contain multiple commands (";"). Treat each one as
# single line. parse_line() is slow, only use it when necessary.
licensed under the GPL 3 or later.
It's designed to check build logs generated by Debian's dpkg-buildpackage (or
licensed under the GPL 3 or later.
It's designed to check build logs generated by Debian's dpkg-buildpackage (or
-tools using dpkg-buildpackage like pbuilder or the official buildd build logs)
-to help maintainers detect missing hardening flags in their packages.
+tools using dpkg-buildpackage like pbuilder or sbuild (which is used for the
+official buildd build logs)) to help maintainers detect missing hardening
+flags in their packages.
Only gcc is detected as compiler at the moment. If other compilers support
hardening flags as well, please report them.
If there's no output, no flags are missing and the build log is fine.
Only gcc is detected as compiler at the moment. If other compilers support
hardening flags as well, please report them.
If there's no output, no flags are missing and the build log is fine.