60 Commits (ca91c244ef1ba7eac6643d66a5fc56d3a2a8b550)

Author	SHA1	Message	Date
fanquake	7f96638723	contrib: add macOS fixup_chains check to security-check ... Followup to #27676.	1 year ago
fanquake	ec822e88dd	Merge bitcoin/bitcoin#27813: guix: Update `python-lief` package to 0.13.2 ... 529c92e837 guix: Update `python-lief` package to 0.13.2 (Hennadii Stepanov) Pull request description: The Guix's `python-lief` package is going to move to using external deps, rather than the bundled ones (https://lists.gnu.org/archive/html/guix-patches/2023-05/msg01302.html). We want to continue using our own package indefinitely, to keep the build simpler, and allow for easier updating. Changes in `contrib/devtools/security-check.py` are caused by 6357c6370b. Also see: https://github.com/bitcoin/bitcoin/pull/27507. ACKs for top commit: fanquake: ACK 529c92e837 Tree-SHA512: ad81111b090a39b380fe25bb27b54a339e78a158f462c7adda25d5ee55f0d654107b1486b29b9687ad0808e27b01e04f53a0e8ffc6600b79103d6bd0dfec64ef	1 year ago
Hennadii Stepanov	529c92e837	guix: Update `python-lief` package to 0.13.2	1 year ago
fanquake	3df6070466	contrib: remove macOS lazy_bind check ... In future, this will be replaced by a check for fixup_chains usage.	1 year ago
fanquake	015cc5e588	lint: stop ignoring LIEF imports ... Type stubs are now available as of 0.13.0. See https://github.com/lief-project/LIEF/issues/650.	1 year ago
fanquake	0c579203d2	Merge bitcoin/bitcoin#25867: lint: enable E722 do not use bare except ... 61bb4e783b lint: enable E722 do not use bare except (Leonardo Lazzaro) Pull request description: Improve test code and enable E722 lint check. If you want to catch all exceptions that signal program errors, use except Exception: (bare except is equivalent to except BaseException:). Reference: https://peps.python.org/pep-0008/#programming-recommendations ACKs for top commit: MarcoFalke: lgtm ACK 61bb4e783b Tree-SHA512: c7497769d5745fa02c78a20f4a0e555d8d3996d64af6faf1ce28e22ac1d8be415b98e967294679007b7bda2a9fd04031a9d140b24201e00257ceadeb5c5d7665	2 years ago
Leonardo Lazzaro	61bb4e783b	lint: enable E722 do not use bare except	2 years ago
fanquake	6ba17d4955	scripts: add PE Canary check to security-check	2 years ago
Hennadii Stepanov	306ccd4927	scripted-diff: Bump copyright headers ... -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: - 2021: f47dda2c58 - 2020: fa0074e2d8 - 2019: aaaaad6ac9	2 years ago
fanquake	983e0a2058	contrib: use LIEF 0.12.0 for symbol and security checks	3 years ago
fanquake	6fe55160dd	contrib: support arm64 darwin in security checks	3 years ago
fanquake	5a8f907c93	scripts: add CONTROL_FLOW to ELF security checks	3 years ago
fanquake	6ca5efa8ed	script rename control flow check to MACHO specific	3 years ago
fanquake	b9898aeeaa	scripts: make security checks architecture independent ... This paves the way for using and checking for architecture dependent flags like -fcf-protection on x86_64 Linux and -mbranch-protection on 64 bit ARM.	3 years ago
Hennadii Stepanov	f47dda2c58	scripted-diff: Bump copyright headers ... -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: * 2020: fa0074e2d8 * 2019: aaaaad6ac9	3 years ago
fanquake	feee308401	scripts: match on exe type over str in security-check.py	3 years ago
fanquake	f31d4bd214	scripts: test for PE control flow instrumentation	3 years ago
josibake	a46f71bb70	lint: enable mypy checking for missing imports ... Achieve this by adding some ignore, and making data/ importable. Co-authored-by: João Barbosa <joao.paulo.barbosa@gmail.com>	3 years ago
fanquake	00b85d0b13	scripts: only parse the binary once in security-check.py	3 years ago
fanquake	cad40a5b16	scripts: use LIEF for ELF checks in security-check.py	3 years ago
fanquake	42b589d18f	scripts: test for MACHO control flow instrumentation	4 years ago
fanquake	955140b326	contrib: consolidate PIE and NX security checks	4 years ago
fanquake	0f5d77c8e4	contrib: add PE PIE check to security checks	4 years ago
fanquake	8e1f40dd9a	contrib: use LIEF for PE security checks	4 years ago
fanquake	a25b2e965c	contrib: use LIEF for macOS security checks	4 years ago
fanquake	7e7eae7aa8	contrib: use f strings in security-check.py	4 years ago
Luke Dashjr	a0a771843f	contrib: Changes to checks for PowerPC64 ... Changes from #14066.	4 years ago
Wladimir J. van der Laan	634f6ec4eb	contrib: Parse ELF directly for symbol and security checks ... Instead of the ever-messier text parsing of the output of the readelf tool (which is clearly meant for human consumption not to be machine parseable), parse the ELF binaries directly. Add a small dependency-less ELF parser specific to the checks. This is slightly more secure, too, because it removes potential ambiguity due to misparsing and changes in the output format of `elfread`. It also allows for stricter and more specific ELF format checks in the future. This removes the build-time dependency for `readelf`. It passes the test-security-check for me locally, though I haven't checked on all platforms.	4 years ago
Tyler Chambers	b6121edf70	swapped "is" for "==" in literal comparison ... update lint-python.sh to include check F632	4 years ago
Wladimir J. van der Laan	65d0f1a533	devtools: Add security check for separate_code ... Check that sections are appropriately separated in virtual memory, based on their (expected) permissions. This checks for missing -Wl,-z,separate-code and potentially other problems. Co-authored-by: fanquake <fanquake@gmail.com>	4 years ago
fanquake	eacedfb023	scripts: add additional type annotations to security-check.py	5 years ago
fanquake	83d063e954	scripts: add run_command to security-check.py ... Deduplicate all the subprocess code as mentioned in 18713.	5 years ago
fanquake	13f606b4f9	scripts: remove NONFATAL from security-check.py	5 years ago
fanquake	061acf62a1	scripts: no-longer check for 32 bit windows in security-check.py	5 years ago
fanquake	3e38023af7	scripts: add PE .reloc section check to security-check.py	5 years ago
fanquake	7b99c7454c	scripts: add MACHO Canary check to security-check.py	5 years ago
fanquake	5ca90f8b59	scripts: add MACHO lazy bindings check to security-check.py	5 years ago
fanquake	edaca2dd12	scripts: add MACHO NX check to security-check.py	5 years ago
MarcoFalke	e09c701e01	scripted-diff: Bump copyright of files changed in 2020 ... -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT-	5 years ago
fanquake	7c9e821c4e	scripts: add MACHO NOUNDEFS check to security-check.py	5 years ago
fanquake	4ca92dc6d3	scripts: add MACHO PIE check to security-check.py	5 years ago
Craig Younkins	af1ed206f8	Fix broken Gmane URLs	6 years ago
Wladimir J. van der Laan	78dae8cacc	Merge #13780: 0.17: Pre-branch maintenance ... 3fc20632a3 qt: Set BLOCK_CHAIN_SIZE = 220 (DrahtBot) 2b6a2f4a28 Regenerate manpages (DrahtBot) eb7daf4d60 Update copyright headers to 2018 (DrahtBot) Pull request description: Some trivial maintenance to avoid having to do it again after the 0.17 branch off. (The scripts to do this are in `./contrib/`) Tree-SHA512: 16b2af45e0351b1c691c5311d48025dc6828079e98c2aa2e600dc5910ee8aa01858ca6c356538150dc46fe14c8819ed8ec8e4ec9a0f682b9950dd41bc50518fa	6 years ago
DrahtBot	eb7daf4d60	Update copyright headers to 2018	6 years ago
Chun Kuan Lee	1e60713a68	contrib: Fix test-security-check fail in Ubuntu 18.04	6 years ago
Conrado Gouvea	37d363dd4a	Tools: fix BIND_NOW check in security-check.py ... Previously, the BIND_NOW check would work only if it was the first value in FLAGS.	6 years ago
John Bampton	0d31ef4762	Enable W191 and W291 flake8 checks. ... Remove trailing whitespace from Python files. Convert tabs to spaces.	7 years ago
John Newbery	5de2b18c67	[contrib] fixup security-check.py Python3 support	7 years ago
John Newbery	bc6fdf2d15	Change all python files to use Python3	7 years ago
Akira Takizawa	595a7bab23	Increment MIT Licence copyright header year on files modified in 2017	7 years ago