#!/usr/bin/perl -w
# hardening-info -- lintian collection script

# The original shell script version of this script is
# Copyright (C) 1998 Christian Schwarz
#
# The objdump version, including support for etch's binutils, is
# Copyright (C) 2008 Adam D. Barratt
#
# This version, a trimmed-down wrapper for hardening-check, is
# Copyright (C) 2012 Kees Cook <kees@debian.org>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, you can find it on the World Wide
# Web at http://www.gnu.org/copyleft/gpl.html, or write to the Free
# Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
# MA 02110-1301, USA.

use strict;
use warnings;

use Cwd qw(realpath);
use FileHandle;

use lib "$ENV{'LINTIAN_ROOT'}/lib";
use Lintian::Collect;
use Lintian::Command qw(spawn reap);
use Lintian::Util qw(fail);

my ($pkg, $type, $dir) = @ARGV;
my $info = Lintian::Collect->new ($pkg, $type, $dir);
my $file_info = $info->file_info;

my $helper = realpath("$0-helper");

if ( -e "$dir/hardening-info" ) {
    unlink "$dir/hardening-info" or fail "unlink hardening-info: $!";
}

# Prepare to examine the file tree.
chdir ("$dir/unpacked")
    or fail("unable to chdir to unpacked: $!");

my %opts = ( pipe_in => FileHandle->new,
             out => "$dir/hardening-info",
             fail => 'never' );

# Use xargs to keep processing times of packages like linux-image
# reasonble.
spawn(\%opts, ['xargs', '-0r', 'hardening-check', '--lintian', '--'], '|',
    [$helper]);
$opts{pipe_in}->blocking(1);


foreach my $bin ($info->sorted_index) {
    next unless $info->index->{$bin}->is_file;
    # Skip kernel modules - most of the checks do not apply to the
    # kernel.
    next if $bin =~ m/\.ko/o;
    my $finfo = $file_info->{$bin};
    next unless $finfo =~ m/\bELF\b/o;
    printf {$opts{pipe_in}} "%s\0", $bin;
}

close $opts{pipe_in};
reap (\%opts);

exit 0;

# Local Variables:
# indent-tabs-mode: nil
# cperl-indent-level: 4
# End:
# vim: syntax=perl sw=4 sts=4 sr et
