OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	04/09/2025 07:08:42 PM	rwxr-xr-x
📄 brp-fix-pyc-reproducibility	560 bytes	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 brp-ldconfig	417 bytes	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 brp-llvm-compile-lto-elf	1.88 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 brp-mangle-shebangs	4.41 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 brp-python-bytecompile	5.64 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 brp-strip-lto	558 bytes	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 compileall2.py	21.59 KB	10/01/2024 12:46:16 PM	rw-r--r--
📄 config.guess	42.91 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 config.sub	35.46 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 dist.sh	1.94 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 find-provides	1.19 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 find-requires	1013 bytes	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 gpgverify	3.54 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 kmodtool	9.03 KB	09/27/2023 01:14:41 AM	rwxr-xr-x
📄 macros	16.02 KB	10/28/2024 11:45:49 AM	rw-r--r--
📄 redhat-annobin-cc1	93 bytes	10/28/2024 11:45:49 AM	r--r--r--
📄 redhat-annobin-plugin-select.sh	6.05 KB	10/28/2024 11:45:49 AM	rwxr-xr-x
📄 redhat-annobin-select-annobin-built-plugin	89 bytes	10/28/2024 11:45:49 AM	r--r--r--
📄 redhat-annobin-select-gcc-built-plugin	93 bytes	10/28/2024 11:45:49 AM	r--r--r--
📄 redhat-hardened-cc1	153 bytes	10/28/2024 11:45:49 AM	r--r--r--
📄 redhat-hardened-clang.cfg	6 bytes	10/28/2024 11:45:49 AM	r--r--r--
📄 redhat-hardened-ld	47 bytes	10/28/2024 11:45:49 AM	r--r--r--
📄 rpmrc	5.52 KB	10/28/2024 11:45:49 AM	rw-r--r--
📄 rpmsort	2.11 KB	09/27/2023 01:14:41 AM	rwxr-xr-x

Editing: brp-llvm-compile-lto-elf

#!/usr/bin/bash -eu

if [ -z "$RPM_BUILD_ROOT" ] || [ "$RPM_BUILD_ROOT" = "/" ]; then
	exit 0
fi

CLANG_FLAGS=$@
NCPUS=${RPM_BUILD_NCPUS:-1}

check_convert_bitcode () {
  local file_name=$(realpath ${1})
  local file_type=$(file ${file_name})

shift
  CLANG_FLAGS="$@"

if [[ "${file_type}" == *"LLVM IR bitcode"* ]]; then
    # Check the output of llvm-strings for the command line, which is in the LLVM bitcode because
    # we pass -frecord-gcc-switches.
    # Check for a line that has "-flto" after (or without) "-fno-lto".
    llvm-strings ${file_name} | while read line ; do
      flto=$(echo $line   | grep -o -b -e -flto     | tail -n 1 | cut -d : -f 1)
      fnolto=$(echo $line | grep -o -b -e -fno-lto  | tail -n 1 | cut -d : -f 1)

if test -n "$flto" && { test -z "$fnolto" || test "$flto" -gt "$fnolto"; } ; then
        echo "Compiling LLVM bitcode file ${file_name}."
        clang ${CLANG_FLAGS} -fno-lto -Wno-unused-command-line-argument \
          -x ir ${file_name} -c -o ${file_name}
        break
      fi
      done
  elif [[ "${file_type}" == *"current ar archive"* ]]; then
    echo "Unpacking ar archive ${file_name} to check for LLVM bitcode components."
    # create archive stage for objects
    local archive_stage=$(mktemp -d)
    local archive=${file_name}
    pushd ${archive_stage}
    ar x ${archive}
    for archived_file in $(find -not -type d); do
      check_convert_bitcode ${archived_file} ${CLANG_FLAGS}
      echo "Repacking ${archived_file} into ${archive}."
      ar r ${archive} ${archived_file}
    done
    popd
  fi
}

echo "Checking for LLVM bitcode artifacts"
export -f check_convert_bitcode
# Deduplicate by device:inode to avoid processing hardlinks in parallel.
find "$RPM_BUILD_ROOT" -type f -name "*.[ao]" -printf "%D:%i %p\n" | \
  awk '!seen[$1]++' | cut -d" " -f2- | \
  xargs -d"\n" -r -n1 -P$NCPUS sh -c "check_convert_bitcode \$@ $CLANG_FLAGS" ARG0