2 # Copyright (c) 2014 Wladimir J. van der Laan
3 # Distributed under the MIT software license, see the accompanying
4 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
6 A script to check that the (Linux) executables produced by gitian only contain
7 allowed gcc, glibc and libstdc++ version symbols. This makes sure they are
8 still compatible with the minimum supported Linux distribution versions.
12 find ../gitian-builder/build -type f -executable | xargs python contrib/devtools/symbol-check.py
14 from __future__
import division
, print_function
20 # Debian 6.0.9 (Squeeze) has:
22 # - g++ version 4.4.5 (https://packages.debian.org/search?suite=default§ion=all&arch=any&searchon=names&keywords=g%2B%2B)
23 # - libc version 2.11.3 (https://packages.debian.org/search?suite=default§ion=all&arch=any&searchon=names&keywords=libc6)
24 # - libstdc++ version 4.4.5 (https://packages.debian.org/search?suite=default§ion=all&arch=any&searchon=names&keywords=libstdc%2B%2B6)
26 # Ubuntu 10.04.4 (Lucid Lynx) has:
28 # - g++ version 4.4.3 (http://packages.ubuntu.com/search?keywords=g%2B%2B&searchon=names&suite=lucid§ion=all)
29 # - libc version 2.11.1 (http://packages.ubuntu.com/search?keywords=libc6&searchon=names&suite=lucid§ion=all)
30 # - libstdc++ version 4.4.3 (http://packages.ubuntu.com/search?suite=lucid§ion=all&arch=any&keywords=libstdc%2B%2B&searchon=names)
32 # Taking the minimum of these as our target.
34 # According to GNU ABI document (http://gcc.gnu.org/onlinedocs/libstdc++/manual/abi.html) this corresponds to:
35 # GCC 4.4.0: GCC_4.4.0
36 # GCC 4.4.2: GLIBCXX_3.4.13, CXXABI_1.3.3
45 # See here for a description of _IO_stdin_used:
46 # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=634261#109
48 # Ignore symbols that are exported as part of every executable
50 '_edata', '_end', '_init', '__bss_start', '_fini', '_IO_stdin_used'
52 READELF_CMD
= os
.getenv('READELF', '/usr/bin/readelf')
53 CPPFILT_CMD
= os
.getenv('CPPFILT', '/usr/bin/c++filt')
54 # Allowed NEEDED libraries
56 # bitcoind and bitcoin-qt
57 'libgcc_s.so.1', # GCC base support
58 'libc.so.6', # C library
59 'libpthread.so.0', # threading
60 'libanl.so.1', # DNS resolve
61 'libm.so.6', # math library
62 'librt.so.1', # real-time (clock)
63 'ld-linux-x86-64.so.2', # 64-bit dynamic linker
64 'ld-linux.so.2', # 32-bit dynamic linker
66 'libX11-xcb.so.1', # part of X11
67 'libX11.so.6', # part of X11
68 'libxcb.so.1', # part of X11
69 'libfontconfig.so.1', # font support
70 'libfreetype.so.6', # font parsing
71 'libdl.so.2' # programming interface to dynamic linker
74 class CPPFilt(object):
76 Demangle C++ symbol names.
78 Use a pipe to the 'c++filt' command.
81 self
.proc
= subprocess
.Popen(CPPFILT_CMD
, stdin
=subprocess
.PIPE
, stdout
=subprocess
.PIPE
)
83 def __call__(self
, mangled
):
84 self
.proc
.stdin
.write(mangled
+ '\n')
85 return self
.proc
.stdout
.readline().rstrip()
88 self
.proc
.stdin
.close()
89 self
.proc
.stdout
.close()
92 def read_symbols(executable
, imports
=True):
94 Parse an ELF executable and return a list of (symbol,version) tuples
95 for dynamic, imported symbols.
97 p
= subprocess
.Popen([READELF_CMD
, '--dyn-syms', '-W', executable
], stdout
=subprocess
.PIPE
, stderr
=subprocess
.PIPE
, stdin
=subprocess
.PIPE
)
98 (stdout
, stderr
) = p
.communicate()
100 raise IOError('Could not read symbols for %s: %s' % (executable
, stderr
.strip()))
102 for line
in stdout
.split('\n'):
104 if len(line
)>7 and re
.match('[0-9]+:$', line
[0]):
105 (sym
, _
, version
) = line
[7].partition('@')
106 is_import
= line
[6] == 'UND'
107 if version
.startswith('@'):
108 version
= version
[1:]
109 if is_import
== imports
:
110 syms
.append((sym
, version
))
113 def check_version(max_versions
, version
):
115 (lib
, _
, ver
) = version
.rpartition('_')
119 ver
= tuple([int(x
) for x
in ver
.split('.')])
120 if not lib
in max_versions
:
122 return ver
<= max_versions
[lib
]
124 def read_libraries(filename
):
125 p
= subprocess
.Popen([READELF_CMD
, '-d', '-W', filename
], stdout
=subprocess
.PIPE
, stderr
=subprocess
.PIPE
, stdin
=subprocess
.PIPE
)
126 (stdout
, stderr
) = p
.communicate()
128 raise IOError('Error opening file')
130 for line
in stdout
.split('\n'):
131 tokens
= line
.split()
132 if len(tokens
)>2 and tokens
[1] == '(NEEDED)':
133 match
= re
.match('^Shared library: \[(.*)\]$', ' '.join(tokens
[2:]))
135 libraries
.append(match
.group(1))
137 raise ValueError('Unparseable (NEEDED) specification')
140 if __name__
== '__main__':
143 for filename
in sys
.argv
[1:]:
144 # Check imported symbols
145 for sym
,version
in read_symbols(filename
, True):
146 if version
and not check_version(MAX_VERSIONS
, version
):
147 print('%s: symbol %s from unsupported version %s' % (filename
, cppfilt(sym
), version
))
149 # Check exported symbols
150 for sym
,version
in read_symbols(filename
, False):
151 if sym
in IGNORE_EXPORTS
:
153 print('%s: export of symbol %s not allowed' % (filename
, cppfilt(sym
)))
155 # Check dependency libraries
156 for library_name
in read_libraries(filename
):
157 if library_name
not in ALLOWED_LIBRARIES
:
158 print('%s: NEEDED library %s is not allowed' % (filename
, library_name
))