Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

backport: merge bitcoin#18434, #21664, #20608, #21871, #21255, #21428, #21889, #22070, #22392, #23535, #23811, #23838, #23839, #23148, #20422, #24561, #26075, #25458, partial #22381 (guix backports: part 1) #5355

Merged
merged 23 commits into from
Jun 8, 2023
Merged

backport: merge bitcoin#18434, #21664, #20608, #21871, #21255, #21428, #21889, #22070, #22392, #23535, #23811, #23838, #23839, #23148, #20422, #24561, #26075, #25458, partial #22381 (guix backports: part 1) #5355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
994fb57
merge bitcoin#18434: add a test-security target and run it in CI
kwvg Jun 4, 2023
0024743
fix: disable security tests on win64 CI build
kwvg Jun 4, 2023
101cb67
fix: move test-security-check call
UdjinM6 Jun 3, 2023
ef9300a
merge bitcoin#21664: use LIEF for macOS and Windows symbol & security…
kwvg May 13, 2023
067d4a4
merge bitcoin#20608: add symbol check test for PE binaries
kwvg Dec 9, 2020
ef65f61
merge bitcoin#21871: add checks for minimum required OS versions
kwvg May 13, 2023
1be3afd
merge bitcoin#21255: run test-symbol-check for RISC-V
kwvg Feb 21, 2021
d4a8d49
merge bitcoin#21428: Cleanup in test-{security,symbol}-check.py
kwvg Mar 13, 2021
24a6642
partial bitcoin#22381: Test security-check sanity before performing t…
kwvg Jun 4, 2023
8535830
fix: add exception for 32-bit ARM builds which need glibc 2.28
kwvg Jun 3, 2023
cdedbea
merge bitcoin#21889: check for control flow instrumentation
kwvg May 9, 2021
8dab702
merge bitcoin#22070: don't use cf-protection when targeting arm-apple…
kwvg May 13, 2023
d28ba33
build: run backwards compatibility symbol checks on all builds
kwvg Jul 6, 2021
110dbf8
merge bitcoin#22392: use LIEF for ELF security & symbol checks
kwvg May 13, 2023
1e9278e
merge bitcoin#23535: check for control flow instrumentation
kwvg Nov 17, 2021
bd2135f
merge bitcoin#23811: match on EXE_FORMATS rather than name string
kwvg Dec 18, 2021
38c3bd0
merge bitcoin#23838: make security checks architecture independent
kwvg Dec 16, 2021
e39a1de
merge bitcoin#23839: build with and test for control flow instrumenta…
kwvg Dec 22, 2021
f2a5b47
merge bitcoin#23148: Fix guix linker-loader path and add check_ELF_in…
kwvg Sep 28, 2021
7753957
merge bitcoin#20422: mac deployment unification
kwvg May 13, 2023
e91a62b
merge bitcoin#24561: use LIEF 0.12.0
kwvg May 13, 2023
ecb9ff8
merge bitcoin#25458: parallelize LIEF build
kwvg Jun 23, 2022
3c8088f
merge bitcoin#26075: remove 32bit linux code from release scripts
kwvg Sep 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 12 additions & 13 deletions Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,12 +39,9 @@ OSX_TEMP_ISO = $(OSX_DMG:.dmg=).temp.iso
OSX_BACKGROUND_SVG=background.svg
OSX_BACKGROUND_IMAGE=background.tiff
OSX_BACKGROUND_IMAGE_DPIS=36 72
OSX_DSSTORE_GEN=$(top_srcdir)/contrib/macdeploy/custom_dsstore.py
OSX_DEPLOY_SCRIPT=$(top_srcdir)/contrib/macdeploy/macdeployqtplus
OSX_FANCY_PLIST=$(top_srcdir)/contrib/macdeploy/fancy.plist
OSX_INSTALLER_ICONS=$(top_srcdir)/src/qt/res/icons/dash.icns
OSX_PLIST=$(top_builddir)/share/qt/Info.plist #not installed
OSX_QT_TRANSLATIONS = ar,bg,ca,cs,da,de,es,fa,fi,fr,gd,gl,he,hu,it,ja,ko,lt,lv,pl,pt,ru,sk,sl,sv,uk,zh_CN,zh_TW

DIST_CONTRIB = \
$(top_srcdir)/contrib/debian/copyright \
Expand All @@ -57,16 +54,15 @@ DIST_SHARE = \

BIN_CHECKS=$(top_srcdir)/contrib/devtools/symbol-check.py \
$(top_srcdir)/contrib/devtools/security-check.py \
$(top_srcdir)/contrib/devtools/pixie.py
$(top_srcdir)/contrib/devtools/utils.py

WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/dash.ico \
$(top_srcdir)/share/pixmaps/nsis-header.bmp \
$(top_srcdir)/share/pixmaps/nsis-wizard.bmp \
$(top_srcdir)/doc/README_windows.txt

OSX_PACKAGING = $(OSX_DEPLOY_SCRIPT) $(OSX_FANCY_PLIST) $(OSX_INSTALLER_ICONS) \
OSX_PACKAGING = $(OSX_DEPLOY_SCRIPT) $(OSX_INSTALLER_ICONS) \
$(top_srcdir)/contrib/macdeploy/$(OSX_BACKGROUND_SVG) \
$(OSX_DSSTORE_GEN) \
$(top_srcdir)/contrib/macdeploy/detached-sig-apply.sh \
$(top_srcdir)/contrib/macdeploy/detached-sig-create.sh

Expand Down Expand Up @@ -127,7 +123,7 @@ osx_volname:

if BUILD_DARWIN
$(OSX_DMG): $(OSX_APP_BUILT) $(OSX_PACKAGING) $(OSX_BACKGROUND_IMAGE)
$(PYTHON) $(OSX_DEPLOY_SCRIPT) $(OSX_APP) -add-qt-tr $(OSX_QT_TRANSLATIONS) -translations-dir=$(QT_TRANSLATION_DIR) -dmg -fancy $(OSX_FANCY_PLIST) -verbose 2 -volname $(OSX_VOLNAME)
$(PYTHON) $(OSX_DEPLOY_SCRIPT) $(OSX_APP) $(OSX_VOLNAME) -translations-dir=$(QT_TRANSLATION_DIR) -dmg

$(OSX_BACKGROUND_IMAGE).png: contrib/macdeploy/$(OSX_BACKGROUND_SVG)
sed 's/PACKAGE_NAME/$(PACKAGE_NAME)/' < "$<" | $(RSVG_CONVERT) -f png -d 36 -p 36 -o $@
Expand Down Expand Up @@ -160,11 +156,8 @@ $(APP_DIST_DIR)/.background/$(OSX_BACKGROUND_IMAGE): $(OSX_BACKGROUND_IMAGE_DPIF
$(MKDIR_P) $(@D)
$(TIFFCP) -c none $(OSX_BACKGROUND_IMAGE_DPIFILES) $@

$(APP_DIST_DIR)/.DS_Store: $(OSX_DSSTORE_GEN)
$(PYTHON) $< "$@" "$(OSX_VOLNAME)"

$(APP_DIST_DIR)/$(OSX_APP)/Contents/MacOS/Dash-Qt: $(OSX_APP_BUILT) $(OSX_PACKAGING)
INSTALLNAMETOOL=$(INSTALLNAMETOOL) OTOOL=$(OTOOL) STRIP=$(STRIP) $(PYTHON) $(OSX_DEPLOY_SCRIPT) $(OSX_APP) -translations-dir=$(QT_TRANSLATION_DIR) -add-qt-tr $(OSX_QT_TRANSLATIONS) -verbose 2
INSTALLNAMETOOL=$(INSTALLNAMETOOL) OTOOL=$(OTOOL) STRIP=$(STRIP) $(PYTHON) $(OSX_DEPLOY_SCRIPT) $(OSX_APP) $(OSX_VOLNAME) -translations-dir=$(QT_TRANSLATION_DIR)

deploydir: $(APP_DIST_EXTRAS)
endif !BUILD_DARWIN
Expand Down Expand Up @@ -342,8 +335,14 @@ clean-local: clean-docs

test-security-check:
if TARGET_DARWIN
$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_MACHO
$(AM_V_at) CC='$(CC)' CFLAGS='$(CFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_MACHO
$(AM_V_at) CC='$(CC)' CFLAGS='$(CFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_MACHO
endif
if TARGET_WINDOWS
$(AM_V_at) CC='$(CC)' CFLAGS='$(CFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_PE
$(AM_V_at) CC='$(CC)' CFLAGS='$(CFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_PE
endif
if TARGET_LINUX
$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_ELF
$(AM_V_at) CC='$(CC)' CFLAGS='$(CFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_ELF
$(AM_V_at) CC='$(CC)' CFLAGS='$(CFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_ELF
endif
4 changes: 4 additions & 0 deletions ci/dash/build_src.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,10 @@ if [ -n "$USE_VALGRIND" ]; then
${BASE_ROOT_DIR}/ci/test/wrap-valgrind.sh
fi

if [ "$RUN_SECURITY_TESTS" = "true" ]; then
make test-security-check
fi

if [ "$RUN_SYMBOL_TESTS" = "true" ]; then
make $MAKEJOBS -C src check-symbols
fi
1 change: 1 addition & 0 deletions ci/test/00_setup_env.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ export HOST=${HOST:-$("$BASE_ROOT_DIR/depends/config.guess")}
export USE_BUSY_BOX=${USE_BUSY_BOX:-false}
export RUN_UNIT_TESTS=${RUN_UNIT_TESTS:-true}
export RUN_INTEGRATION_TESTS=${RUN_INTEGRATION_TESTS:-true}
export RUN_SECURITY_TESTS=${RUN_SECURITY_TESTS:-false}
export RUN_FUZZ_TESTS=${RUN_FUZZ_TESTS:-false}
export RUN_SYMBOL_TESTS=${RUN_SYMBOL_TESTS:-true}
export CONTAINER_NAME=${CONTAINER_NAME:-ci_unnamed}
Expand Down
3 changes: 2 additions & 1 deletion ci/test/00_setup_env_mac_host.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,10 @@ export LC_ALL=C.UTF-8

export CONTAINER_NAME=ci_macos
export HOST=x86_64-apple-darwin19
export PIP_PACKAGES="zmq"
export PIP_PACKAGES="zmq lief"
export RUN_UNIT_TESTS=true
export RUN_INTEGRATION_TESTS=false
export RUN_SECURITY_TESTS="true"
export GOAL="install"
export BITCOIN_CONFIG="--enable-gui --enable-reduce-exports --disable-miner --enable-werror"
# Run without depends
Expand Down
1 change: 1 addition & 0 deletions ci/test/00_setup_env_win64.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ export HOST=x86_64-w64-mingw32
export PACKAGES="python3 nsis g++-mingw-w64-x86-64 wine-binfmt wine64"
export DPKG_ADD_ARCH="i386"
export RUN_INTEGRATION_TESTS=false
export RUN_SECURITY_TESTS="false"
export GOAL="deploy"
export BITCOIN_CONFIG="--enable-gui --enable-reduce-exports --disable-miner"
export DIRECT_WINE_EXEC_TESTS=true
3 changes: 3 additions & 0 deletions ci/test/04_install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,9 @@ if [[ $DOCKER_NAME_TAG == centos* ]]; then
elif [ "$CI_USE_APT_INSTALL" != "no" ]; then
${CI_RETRY_EXE} DOCKER_EXEC apt-get update
${CI_RETRY_EXE} DOCKER_EXEC apt-get install --no-install-recommends --no-upgrade -y $PACKAGES $DOCKER_PACKAGES
if [ -n "$PIP_PACKAGES" ]; then
${CI_RETRY_EXE} pip3 install --user $PIP_PACKAGES
fi
fi

if [ "$TRAVIS_OS_NAME" == "osx" ]; then
Expand Down
4 changes: 3 additions & 1 deletion configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,6 @@ AC_PATH_PROG([GIT], [git])
AC_PATH_PROG(CCACHE,ccache)
AC_PATH_PROG(XGETTEXT,xgettext)
AC_PATH_PROG(HEXDUMP,hexdump)
AC_PATH_TOOL(CPPFILT, c++filt)
AC_PATH_TOOL(OBJCOPY, objcopy)
AC_PATH_TOOL(DSYMUTIL, dsymutil)
AC_PATH_PROG(DOXYGEN, doxygen)
Expand Down Expand Up @@ -942,6 +941,7 @@ if test x$use_hardening != xno; then
])
fi

AX_CHECK_LINK_FLAG([[-Wl,--enable-reloc-section]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--enable-reloc-section"],, [[$LDFLAG_WERROR]])
AX_CHECK_LINK_FLAG([[-Wl,--dynamicbase]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--dynamicbase"])
AX_CHECK_LINK_FLAG([[-Wl,--nxcompat]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--nxcompat"])
AX_CHECK_LINK_FLAG([[-Wl,--high-entropy-va]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--high-entropy-va"])
Expand Down Expand Up @@ -1823,6 +1823,8 @@ AC_SUBST(ANDROID_ARCH)
AC_CONFIG_FILES([Makefile src/Makefile doc/man/Makefile share/setup.nsi share/qt/Info.plist test/config.ini])
AC_CONFIG_FILES([contrib/devtools/split-debug.sh],[chmod +x contrib/devtools/split-debug.sh])
AM_COND_IF([HAVE_DOXYGEN], [AC_CONFIG_FILES([doc/Doxyfile])])
AC_CONFIG_LINKS([contrib/devtools/security-check.py:contrib/devtools/security-check.py])
AC_CONFIG_LINKS([contrib/devtools/test-security-check.py:contrib/devtools/test-security-check.py])
AC_CONFIG_LINKS([contrib/devtools/symbol-check.py:contrib/devtools/symbol-check.py])
AC_CONFIG_LINKS([contrib/devtools/test-symbol-check.py:contrib/devtools/test-symbol-check.py])
AC_CONFIG_LINKS([contrib/filter-lcov.py:contrib/filter-lcov.py])
Expand Down
1 change: 1 addition & 0 deletions contrib/containers/ci/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ RUN pip3 install \
codespell==1.17.1 \
flake8==3.8.3 \
jinja2 \
lief==0.12.0 \
pyzmq \
vulture==2.3 \
yq \
Expand Down
Loading