Add blhc module

docs/index.rst

@@ -726,6 +726,23 @@ This option indicates the extra options to pass to piuparts.
 
  Suggested value: ``--log-level=info``
 
+Blhc
+----
+
+This module allows blhc to be executed, checking the build log of build packages
+for missing hardening flags.
+
+In order for this module to work properly, ``blhc`` package must be installed.
+
+Parameters
+----------
+
+* ``blhcopts``
+
+This option indicates the extra options to pass to blhc.
+
+ Suggested value: ``--all``
+
 PrevBuildCleaner
 ----------------
 

etc/debomatic/debomatic.conf

@@ -45,6 +45,9 @@ lintlog: 0
 [piuparts]
 piupopts: --log-level=info
 
+[blhc]
+blhcopts: --all
+
 [repository]
 gpgkey: 0x12345678
 pubring: /etc/debomatic/debomatic-sign.pubring.gpg

modules/Blhc.py

@@ -0,0 +1,44 @@
+# Deb-o-Matic - Blhc module
+#
+# Copyright (C) 2014 Mattia Rizzolo <mattia@mapreri.org
+#
+# Authors: Mattia Rizzolo <mattia@mapreri.org>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
+#
+# Stores blhc output on top of the built package in the pool directory.
+
+import os
+from subprocess import call
+
+
+class DebomaticModule_Blhc:
+
+    def __init__(self):
+        self.blhc = '/usr/bin/blhc'
+
+    def post_build(self, args):
+        if args['opts'].has_section('blhc'):
+            blhcopts = args['opts'].get('blhc', 'blhcopts').strip()
+        else:
+            blhcopts = []
+        resultdir = os.path.join(args['directory'], 'pool', args['package'])
+        buildlog = os.path.join(resultdir, args['package']) + '.buildlog'
+        blhc = os.path.join(resultdir, args['package']) + '.blhc'
+        if buildlog:
+            with open(blhc, 'w') as fd:
+                call([self.blhc, '-V'], stdout=fd)
+                fd.flush()
+                cmd = [self.blhc] + blhcopts.split() + [buildlog]
+                call(cmd, stdout=fd)