summaryrefslogtreecommitdiff
path: root/scripts/Dpkg/Vendor
AgeCommit message (Collapse)AuthorFilesLines
2015-01-28scripts: Rename and deprecate _g function with g_Guillem Jover2-8/+8
The old function name was inconsistent with the other gettext family of short aliases which has already caused some code typos, and functions starting with underscore are considered by convention private in Perl.
2014-10-12scripts: Document private modules as such in a CHANGES sectionGuillem Jover3-0/+20
This is to try to make sure, that even if documented, people will not accidentally rely on private modules, that have not API stability guarantees.
2014-10-06dpkg-buildflags: Do not blacklist pie and stackprotector on mips/mipselAurelien Jarno1-4/+4
pie is blacklisted on mips and mipsel, according to the comments due to #526961. This bug has been fixed more than 4 years ago, it's time to reactivate pie support. Similarly strack-protector support has been added on mips and mipsel in gcc 4.6 so we can now activate it too. Closes: #763672 Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Guillem Jover <guillem@debian.org>
2014-10-06Dpkg::Vendor::Debian: Add a timeless feature in the reproducible areaPaul Wise1-0/+6
This will add approproriate options to warn about __TIME__, __DATE__ and __TIMESTAMP__ macros. Closes: #762683 Signed-off-by: Guillem Jover <guillem@debian.org>
2014-10-06Dpkg::Vendor::Debian: Add support for a reproducible feature areaPaul Wise1-0/+17
Signed-off-by: Guillem Jover <guillem@debian.org>
2014-10-06Dpkg::Vendor::Debian: Fix comments wordingGuillem Jover1-3/+3
2014-10-06dpkg-buildflags: Honor feature area settings from DEB_BUILD_OPTIONSGuillem Jover1-7/+15
This allows users to specify build flags from specific area features. These settings will be overridden by any subsequent settings from DEB_BUILD_MAINT_OPTIONS, in the same way other build flags are affected, so that the maintainer can disable specific things that might be broken.
2014-10-06dpkg-buildflags: Add a canary feature to the qa feature areaGuillem Jover1-0/+12
This can be used to test the propagation of build flags by checking the build logs for any omission. Closes: #628516
2014-10-06dpkg-buildflags: Add a bug feature to the qa feature areaGuillem Jover1-0/+10
This feature will enable fatal warnings for code that can pose actual problems. Closes: #682659
2014-10-06dpkg-buildflags: Add a new qa feature areaGuillem Jover1-0/+17
This will allow to add various Quality Assurance features that can be used to avoid common errors.
2014-10-06Dpkg::Vendor::Debian: Prefix add_hardening_flags with _ to mark as privateGuillem Jover1-2/+2
2014-08-15dpkg-buildflags: Remove arch blacklist from stackprotectorstrong optionRomain Francoise1-6/+0
As of gcc-defaults 1.130 all architectures have moved to GCC 4.9, so we can remove the architecture blacklist for stackprotectorstrong. Signed-off-by: Guillem Jover <guillem@debian.org>
2014-08-15scripts: Use length instead of defined when checking environment variablesGuillem Jover1-1/+1
In these cases we are not interested if the variables are defined, but if they have actual content.
2014-08-15Dpkg::Vendor::Debian: Refactor common compiler flags into intermediate variablesGuillem Jover1-18/+21
2014-08-09scripts: Use // instead of || where appropriateGuillem Jover1-1/+1
Replace only safe usages, i.e. those that fallback on initialization values that evaluate to false anyway. Or when the API is explicit about the variable being undefined.
2014-08-09Dpkg::Vendor::Debian: Split feature area option parsing into a functionGuillem Jover1-19/+26
2014-08-09dpkg-buildflags: Add support for new hardening flag stackprotectorstrongGuillem Jover1-1/+21
This flag is now part of the default set on Debian and derivatives, but it will fallback to stackprotector when the former is not functional or disabled by the user. Based-on-patch-by: Romain Francoise <rfrancoise@debian.org>
2014-08-09Dpkg::Vendor::Debian: Do not disable stack-protector on arm64Adam Conrad1-2/+2
The toolchain supports it now on arm64. Closes: #751032 Signed-off-by: Guillem Jover <guillem@debian.org>
2014-08-09Use https:// URLs instead of http:// when possible (round two)Guillem Jover1-1/+1
Switch more URLs, now that these services have had SSL enabled.
2014-05-17scripts: Switch unused capturing groups to non-capturing onesGuillem Jover1-4/+4
These have better runtime performance, not that it matters in many of the instances here though. Addresses RegularExpressions::ProhibitUnusedCapture. Warned-by: perlcritic
2014-05-17perl: Do not use global match variablesGuillem Jover1-2/+2
Fixes Variables::ProhibitMatchVars. Warned-by: perlcritic
2014-04-21dpkg-buildflags: Add support for FCFLAGS, OBJCFLAGS and OBJCXXFLAGSGuillem Jover2-1/+10
Add default values in Debian and derivatives for these flags. Distinguish FFLAGS from FCFLAGS by mentioning that the former is for the Fortran 77 compiler and the latter for the Fortran 9x compiler. Closes: #744326
2014-04-21Dpkg::Vendor::Ubuntu: Update ppc64el build flags supportAdam Conrad1-4/+6
Ubuntu never ended up shipping a ppc64 architecture, instead they have a ppc64el one, so switch to that. And honor the noopt DEB_BUILD_OPTIONS flag. Closes: #738691 Signed-off-by: Guillem Jover <guillem@debian.org>
2014-04-21scripts: Add a space after flow control statementsGuillem Jover1-1/+1
2013-12-07Use https:// URLs instead of http:// when possibleGuillem Jover3-3/+3
2013-10-26dpkg-buildflags: Add pie and stack-protector options to FFLAGSGuillem Jover1-0/+2
When enabled add those flags to the Fortran build flags. Update the man page to document that FFLAGS is a subset of CFLAGS. Closes: #726932
2013-06-22dpkg-buildflags: Add GCJFLAGS supportGuillem Jover2-1/+3
This adds default flags for the GNU Compiler for Java, and the supported hardened flags. We do not name the variable JFLAGS nor JAVAFLAGS, to make it very clear these are not flags for javac, they are only for GCJ; so we use the automake variable name as existing precedent. Closes: #708375
2013-06-22scripts: Inherit from parent instead of baseGuillem Jover3-3/+3
Use the lightweight parent instead of the bloated base.
2013-06-22dpkg-buildflags: Do not set -fstack-protector on arm64Matthias Klose1-2/+2
The flag is not yet supported there. Closes: #711936 [guillem@debian.org: Update comment. ] Signed-off-by: Guillem Jover <guillem@debian.org>
2013-05-08scripts: On split use an actual regex instead of a literal stringGuillem Jover1-1/+1
Fixes BuiltinFunctions::ProhibitStringySplit. Warned-by: perlcritic
2013-05-06scripts: Initialize arrays with the qw() operatorGuillem Jover1-2/+1
Fixes CodeLayout::ProhibitQuotedWordLists. Warned-by: perlcritic
2013-05-04Do not use double-quotes on strings that do not need interpolationGuillem Jover3-50/+51
Using double-quotes imposes a small performance penalty as the perl parser needs to check if any interpolation is needed. Use double-quotes only when the string contains single-quotes. Ideally we'd use double-quotes too for escaped meta-characters that might otherwise be confusing to immediately see if they need interpolation or not, but the policy does not (currently) allow to ignore these. Fixes ValuesAndExpressions::ProhibitInterpolationOfLiterals. Warned-by: perlcritic
2013-04-30Do not quote simple identifier hash keys in element accessesGuillem Jover2-15/+15
Addresses ValuesAndExpressions::ProhibitInterpolationOfLiterals. Warned-by: perlcritic
2013-04-30Do not quote simple identifier hash keys in initializationsGuillem Jover1-6/+6
Do not quote the keys for any hash which will always use simple identifiers, as that is taken care of by the => operator. So this does not apply to overload pragmas, version operators, field names, substvars, command line options or filenames. Addresses ValuesAndExpressions::ProhibitInterpolationOfLiterals. Warned-by: perlcritic
2013-04-29Dpkg: Use identifiers as key names whenever possibleGuillem Jover1-1/+1
The fixed key names are either inside unstable modules, internal to them or for keys in code never released, so should not cause much of an issue.
2013-04-29scripts: Use // operator instead of an explicit defined checkGuillem Jover1-2/+1
2013-04-24Dpkg::Vendor::Debian: Do not use Dpkg::Vendor::Ubuntu, just require itGuillem Jover1-1/+2
The fact that Dpkg::Vendor::Debian needs to use functions from Dpkg::Vendor::Ubuntu has always been all kinds of a broken design, as an obvious layer violation, but at least for now we avoid redefinition of functions.
2013-04-19Use just 'return' instead of 'return undef' in perl codeGuillem Jover1-2/+1
This makes sure the functions always return the appropriate value independent of the context. Fixes Subroutines::ProhibitExplicitReturnUndef. Warned-by: perlcritic
2013-04-04dpkg-buildflags: Mask fortify hardening option on nooptGuillem Jover1-0/+6
New glibc 2.16 and later, issue a warning on this condition. Just disable the hardening flags in such case. Closes: #691745
2013-03-18Dpkg::Vendor::Debian: Remove support for obsolete DM-Upload-AllowedGuillem Jover1-6/+0
This field was a Debian specifc hack that should have been part of the archive management software from the start. Now that dak supports setting the upload ACLs through an email command, there's no need for this anymore. Remove.
2012-05-04Dpkg::Vendor::Debian: Do not mask PIE on m68kGuillem Jover1-2/+2
The reason for this feature being masked on m68k was unspecified breakage in openssh (see #451192), which does not appear to be present any more. As such there's no apparent reason to mask it any longer. Requested-by: Thorsten Glaser <tg@mirbsd.de>
2012-04-03dpkg-buildflags: Remove redundant -Wformat-security from default flagsGuillem Jover1-2/+2
This option is already implied by -Werror=format-security. Closes: #664964 Suggested-by: Peter Eisentraut <petere@debian.org>
2012-03-08dpkg-buildflags: Handle unknown architectures gracefullyGuillem Jover1-0/+5
Give a warning and reset the abi-os-cpu tuple to empty strings. Closes: #663004
2011-12-29dpkg-buildflags: new --query-features commandKees Cook1-0/+5
Since the logic for having a hardening flag enabled or disabled depends on the architecture, and since the flags may change over time for each hardening feature, there needs to be a way to externally query the state of the hardening features. Specifically, lintian needs this to be able to figure out if a binary package is missing expected hardening features. Instead of maintaining multiple hard-coded lists of expected hardening features, this makes dpkg-buildflags the canonical location of the information, which can be queried by externally. (See bug 650536.) Signed-off-by: Kees Cook <kees@debian.org> Signed-off-by: Raphaël Hertzog <hertzog@debian.org>
2011-12-29Dpkg::Vendor::Debian: refactor compiler hardening logicKees Cook1-20/+41
Refactor the hardened compiler flag logic so the "use_feature" variable ends up controlling the final stance of each given hardening feature. Signed-off-by: Kees Cook <kees@debian.org> Signed-off-by: Raphaël Hertzog <hertzog@debian.org>
2011-12-13Do not use absolute paths for programs in perl and shell codeGuillem Jover1-1/+2
The location of programs on the filesystem is not standardized, and as such using absolute paths is not a portable assumption to make. This causes test suite errors on at least Mac OS X. Use just the program name on perl system() calls, when needing the full path use Dpkg::Path::find_command() in perl code and “which” in shell code. Reported-by: Stuart Ambler <stuart@zulazon.com>
2011-10-14dpkg-buildflags: Disable bindnow if relro is not usedGuillem Jover1-0/+3
There is no point in enabling full relro (aka bindnow) if relro is not enabled. It just brings its disadvantages and none of its possible advantages.
2011-10-02dpkg-buildflags: Set preprocessor option -D_FORTIFY_SOURCE=2 in CPPFLAGSGuillem Jover1-2/+1
Instead of setting it in the CFLAGS and CXXFLAGS variables. Closes: #642521, #643632
2011-09-23dpkg-buildflags: Disable bind now by defaultGuillem Jover1-1/+1
This option has a startup performance hit on slow systems, particularly due to slow I/O, the effects of which cannot be reverted except for a rebuild. It might make sense for long running processes where the startup time is not that important, and the security improvements do actually matter. Another option is to set the environment variable LD_BIND_NOW=1 for the long running process, so that the sysadmin can disable it if desired.
2011-09-08dpkg-buildflags: emit hardening build flags by defaultRaphaël Hertzog2-1/+91
All the hardening build flags supported by hardening-includes are supported except that PIE is not enabled by default (just like the corresponding gcc patch doesn't enable it by default). Inspired by the work of Kees Cook <kees@debian.org>.
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-29 21:30:11 +0000