bitcoin

Commit Graph

Author	SHA1	Message	Date
fanquake	6fe55160dd	contrib: support arm64 darwin in security checks	3 years ago
laanwj	792d0d8d51	Merge bitcoin/bitcoin#23839 : Linux: build with and test for control flow instrumentation on x86_64 `5a8f907c93` scripts: add CONTROL_FLOW to ELF security checks (fanquake) `e13f8f775d` build: build x86_64 Linux Boost with -fcf-protection=full (fanquake) `6ca5efa8ed` script rename control flow check to MACHO specific (fanquake) Pull request description: Closes #21888. TODO: * Duplication in security-check-tests Guix build: ```bash bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 \| env LC_ALL=C sort -z \| xargs -r0 sha256sum 8025e2e6859247eaf865a4a5009d0a39570ec5e8ab51739fa4da0d8ee4ab2117 guix-build-5a8f907c93f1/output/aarch64-linux-gnu/SHA256SUMS.part 75576482994493262dbf7d3567b0450c0804bdc75c186d6b4c6a856bd0d8f0a3 guix-build-5a8f907c93f1/output/aarch64-linux-gnu/bitcoin-5a8f907c93f1-aarch64-linux-gnu-debug.tar.gz 7cb89c9327cc540859334b597c041a2250156e3e83ce2aa7d16177376056302f guix-build-5a8f907c93f1/output/aarch64-linux-gnu/bitcoin-5a8f907c93f1-aarch64-linux-gnu.tar.gz e264053e4c7a5d65340dd7bbd2c664bcd596292ab80f00a0bf0026bfe0c480bc guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/SHA256SUMS.part 6c3ee9b3c0c4583620301b183226678f1618605dd07dbed0bbdf7d06d3591314 guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/bitcoin-5a8f907c93f1-arm-linux-gnueabihf-debug.tar.gz f217cb8d8e233a8dbdbfde7dabf12c5d867d7de53e8c652b8ed1d4a55da82fd9 guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/bitcoin-5a8f907c93f1-arm-linux-gnueabihf.tar.gz 48b4b2a1b52b3098f4e92c11cb60f1e5e9696a2a960560cd6adea72277eaa4a4 guix-build-5a8f907c93f1/output/dist-archive/bitcoin-5a8f907c93f1.tar.gz 40832db2446e129879caa9fbc9d682c53069876dbb2e0d4d76592e5dcb40bb12 guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/SHA256SUMS.part 26fdfa9b7b77d5db415ef34054cf6f6d020a5dab73239db6dd05539f654bc5d5 guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/bitcoin-5a8f907c93f1-powerpc64-linux-gnu-debug.tar.gz 3adbdb9d3eb1cb5f9adc38b29450054f286bd6d74cef8619adaee89494853605 guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/bitcoin-5a8f907c93f1-powerpc64-linux-gnu.tar.gz 8ec2baf82483a698350bfdabf530cd9b5241690c916f597c746210e95ac451de guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/SHA256SUMS.part 1797e75e1f66ec9068fa4e57e0108960475e863f8f054fbe854358b1f995c4df guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/bitcoin-5a8f907c93f1-powerpc64le-linux-gnu-debug.tar.gz 448bd289ef26c777a1fc4498e7ba7fb17d0f6a932dcac91b2f89cbba63704bb8 guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/bitcoin-5a8f907c93f1-powerpc64le-linux-gnu.tar.gz a23ee91eeae515c2a6a31eb25d659fab833839aaafa4676ccee364bdad2a468c guix-build-5a8f907c93f1/output/riscv64-linux-gnu/SHA256SUMS.part 82df1b6d5020d0af8268ecc8e823f752f20dec308277763b2dd675804dfa4bbd guix-build-5a8f907c93f1/output/riscv64-linux-gnu/bitcoin-5a8f907c93f1-riscv64-linux-gnu-debug.tar.gz 09a6098ce83896a6ee6d5c8aff12eaca51595bd724c8e0b2a6f90b6410dc168c guix-build-5a8f907c93f1/output/riscv64-linux-gnu/bitcoin-5a8f907c93f1-riscv64-linux-gnu.tar.gz 4fac2951f80eaa2bd1747a263be6be1b76282cac5062f7d86db631a2fb80f8db guix-build-5a8f907c93f1/output/x86_64-apple-darwin/SHA256SUMS.part 3392f417b09efca5916c384f0b2d0c177a72ec4921399c62e84484f0054cc8c4 guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx-unsigned.dmg bfb4f8ade6107996ec4bc9efdb53959151b8fb19b6790c34472fe218dd02383d guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx-unsigned.tar.gz 4de92e149bad46fc863efb3b650753d194aad96be991d020e0b859452cf27457 guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx64.tar.gz 9329549a2f275a59e329afc8744ff8cbc297f3042e0ad03b47626805c7aae2e8 guix-build-5a8f907c93f1/output/x86_64-linux-gnu/SHA256SUMS.part d87deb1eca8a1d3780f02edde78350d27f700e13c7ff444be0bfb34e7369904a guix-build-5a8f907c93f1/output/x86_64-linux-gnu/bitcoin-5a8f907c93f1-x86_64-linux-gnu-debug.tar.gz 76f3bc2fad010d9373e854d941e8205b68fa6c9a8ecaff34c4978ae3ae76c806 guix-build-5a8f907c93f1/output/x86_64-linux-gnu/bitcoin-5a8f907c93f1-x86_64-linux-gnu.tar.gz 2948631081c4bd475529da2b7bc2b32b5aa2e44de46dfdaa6cf9432b3c9fe869 guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/SHA256SUMS.part c5d56fac163b73c00e9745aa7b0f9a0bd9fcac7517e39b677869b6e76faf7218 guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win-unsigned.tar.gz f12c7cd72511544c67f4934981c090cee0d9c17e931c059edbbbef6e843dd651 guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64-debug.zip eb952cc4554f92ba6787353f4305d7cbcb1c6dafc4a3867b3088106252a573b8 guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64-setup-unsigned.exe 7bd2b071f1cdf9410535e6a10dd1da519f942bd2c1e47ed52c5b8c4f977e8f27 guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64.zip ``` ACKs for top commit: laanwj: Code review ACK `5a8f907c93` hebasto: ACK `5a8f907c93`, I have reviewed the code and it looks OK, I agree it can be merged. Tree-SHA512: 75702ac01175ccf08e73b5c3bce266cee9dd15ccf8fb38d46108cfada156de9a8c18e27d996f9343ae33f7a75a6904d335cbe25256d90af1f4ccbe72ce1788bb	3 years ago
fanquake	3ccfba1c7f	guix: use GCC 10 (over GCC 8) to build releases This currently points to the version-1.4.0 branch.	3 years ago
fanquake	5a8f907c93	scripts: add CONTROL_FLOW to ELF security checks	3 years ago
Hennadii Stepanov	f47dda2c58	scripted-diff: Bump copyright headers -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: * 2020: `fa0074e2d8` * 2019: `aaaaad6ac9`	3 years ago
fanquake	f31d4bd214	scripts: test for PE control flow instrumentation	3 years ago
Carl Dong	610a8a8e39	test--check: Pass in FLAGS and compile with them These test--check scripts should compile "test" binaries in a way that is as close to what autotools would do, since the goal is to make sure that if we run the -check script, they can correctly detect flaws in binaries which are compiled by our autotools-based system. Therefore, we should emulate what happens when the binary is linked in autotools, meaning that for C binaries, we need to supply the CFLAGS, CPPFLAGS, and LDFLAGS flags in that order. Note to future developers: perhaps it'd be nice to have these test-*-check scripts be part of configure.ac to avoid having to manually replicate autoconf-like behaviour every time we find a discrepancy. Of course, that would also mean you'd have to write more m4...	3 years ago
Carl Dong	a8127b34bc	build: Use and test PE binutils with --reloc-section Also fix test-security-check.py to account for new PE PIE failure indication.	3 years ago
Carl Dong	9fdc8afe11	devtools: Improve *-check.py tool detection This is important to make sure that we're not testing tools different from the one we're building with. Introduce determine_wellknown_cmd, which encapsulates how we should handle well-known tools specification (IFS splitting, env override, etc.).	3 years ago
fanquake	42b589d18f	scripts: test for MACHO control flow instrumentation	4 years ago
Hennadii Stepanov	61a0f8f9cc	test: Cleanup test files in test-{security,symbol}-check.py	4 years ago
Wladimir J. van der Laan	65d0f1a533	devtools: Add security check for separate_code Check that sections are appropriately separated in virtual memory, based on their (expected) permissions. This checks for missing -Wl,-z,separate-code and potentially other problems. Co-authored-by: fanquake <fanquake@gmail.com>	4 years ago
fanquake	9fe71a57a6	test: use subprocess.run() in test-security-check.py	4 years ago
fanquake	968aaae940	tests: run test-security-check.py in CI	4 years ago
fanquake	3e38023af7	scripts: add PE .reloc section check to security-check.py	5 years ago
fanquake	8334ee31f8	scripts: add MACHO LAZY_BINDINGS test to test-security-check.py I didn't add the relevant test in #18295.	5 years ago
fanquake	7b99c7454c	scripts: add MACHO Canary check to security-check.py	5 years ago
MarcoFalke	fa488f131f	scripted-diff: Bump copyright headers -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT-	5 years ago
fanquake	7142d50ac3	scripts: rename test_64bit_PE to test_PE	5 years ago
fanquake	edaca2dd12	scripts: add MACHO NX check to security-check.py	5 years ago
fanquake	1a4e9f32ef	scripts: add MACHO tests to test-security-check.py	5 years ago
MarcoFalke	aaaaad6ac9	scripted-diff: Bump copyright of files changed in 2019 -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT-	5 years ago
MarcoFalke	faf666f814	Remove Windows 32 bit build	6 years ago
Wladimir J. van der Laan	78dae8cacc	Merge #13780 : 0.17: Pre-branch maintenance `3fc20632a3` qt: Set BLOCK_CHAIN_SIZE = 220 (DrahtBot) `2b6a2f4a28` Regenerate manpages (DrahtBot) `eb7daf4d60` Update copyright headers to 2018 (DrahtBot) Pull request description: Some trivial maintenance to avoid having to do it again after the 0.17 branch off. (The scripts to do this are in `./contrib/`) Tree-SHA512: 16b2af45e0351b1c691c5311d48025dc6828079e98c2aa2e600dc5910ee8aa01858ca6c356538150dc46fe14c8819ed8ec8e4ec9a0f682b9950dd41bc50518fa	6 years ago
DrahtBot	eb7daf4d60	Update copyright headers to 2018	6 years ago
Chun Kuan Lee	1e60713a68	contrib: Fix test-security-check fail in Ubuntu 18.04	6 years ago
practicalswift	634bd97001	Explicitly specify encoding when opening text files in Python code	7 years ago
John Bampton	0d31ef4762	Enable W191 and W291 flake8 checks. Remove trailing whitespace from Python files. Convert tabs to spaces.	7 years ago
Chun Kuan Lee	ab3f4dd27f	tests: Add test for 64-bit PE, modify 32-bit test results `9a75d29b6f` change the error result from `PIE` to `DYNAMIC_BASE`. And there are no test for 64-bit, so I made one	7 years ago
John Newbery	2bff472992	[contrib] convert test-security-check to python3	7 years ago
Akira Takizawa	595a7bab23	Increment MIT Licence copyright header year on files modified in 2017	7 years ago
practicalswift	95bab821b3	Remove unused Python imports	8 years ago
isle2983	4677b197f7	[copyright] add MIT License copyright header to remaining Python files	8 years ago
Matthew King	873e81f89b	Use portable #! in python scripts (/usr/bin/env)	9 years ago
Wladimir J. van der Laan	579b863cd7	devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).	9 years ago

35 Commits (aa306765419f7dbea12b12e15553039835ba0e4d)