Package: sloccount
Severity: wishlist
Version: 2.26-5.1
Tags: patch
Hi,
To improve security in Debian programs, packages can be built using
hardened build flags. These flags enable various protections against
security issues such as stack smashing, predictable locations of
values in memory, etc. For more information, see:
http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
I had some free time; see attached patch to migrate to use these flags.
Let me know if there is anything that needs adjusting or if it is ok
to upload this version in a NMU in case you are working on other
issues needing attention.
Thanks,
Jari
>From ce1d04d47d730f90f17116794bff98a783b69051 Mon Sep 17 00:00:00 2001
From: Jari Aalto <[email protected]>
Date: Mon, 20 May 2013 12:49:43 +0300
Subject: [PATCH] hardened-build-flags
Organization: Private
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Signed-off-by: Jari Aalto <[email protected]>
---
debian/changelog | 7 +++++++
debian/rules | 11 ++++++++++-
2 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/debian/changelog b/debian/changelog
index 5120c61..6508f01 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+sloccount (2.26-5.2) unstable; urgency=low
+
+ * Use hardened build flags.
+ http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
+
+ -- Jari Aalto <[email protected]> Mon, 20 May 2013 12:45:44 +0300
+
sloccount (2.26-5.1) unstable; urgency=low
* Non-maintainer upload.
diff --git a/debian/rules b/debian/rules
index 40264a3..92e5884 100755
--- a/debian/rules
+++ b/debian/rules
@@ -4,6 +4,15 @@
# Uncomment this to turn on verbose mode.
#export DH_VERBOSE=1
+LDFLAGS = $(shell dpkg-buildflags --get LDFLAGS)
+LDFLAGS += -Wl,--as-needed
+
+CPPFLAGS = $(shell dpkg-buildflags --get CPPFLAGS)
+CFLAGS = $(shell dpkg-buildflags --get CFLAGS)
+CFLAGS += -Wall $(CPPFLAGS)
+
+CC := $(CC) -Wall $(CFLAGS) $(CPPFLAGS) $(LDFLAGS)
+
LINKMANPAGES= \
break_filelist \
@@ -62,7 +71,7 @@ build-stamp:
dh_testdir
# Add here commands to compile the package.
- $(MAKE)
+ dh_auto_build -- CC="$(CC)"
touch build-stamp
--
1.7.10.4
