#!/bin/bash

# Copyright (c) 2021-2026 Red Hat.
#
# This is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published
# by the Free Software Foundation; either version 3, or (at your
# option) any later version.
#
# It is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# See BZ 2010675

TEST_NAME=fortify
. $srcdir/common.sh

# Something on Bunsen's Ubuntu Risc-V machine is injecting -D_FORTIFY_SOURCE=3
# onto the end of the gcc command line and there does not appear to be a way
# to stop it...
uname -v > host
grep -q -i -e "ubuntu" host
if [ $? == 0 ];
then
    echo "$TEST_NAME: SKIP: Ubuntu build environment always adds -D_FORTIFY_SOURCE=3"
    exit $EXIT_TEST_SKIPPED
fi

OPTS=

if command -v rpm >/dev/null 2>&1; then
  # Use the same command line options that normal spec file will use,
  # *except* that we disable the use of the annobin plugin, since this
  # will pick up the one in the system directory, not the one just built"

  OPTS="$(rpm --eval '%undefine _annotated_build %build_cflags %build_ldflags')"
fi

# The rpm macros may not be available, so if necessary use our own

if ! [[ $OPTS == *"redhat-hardened-cc1"* ]];
then
    echo " $TEST_NAME: using built-in option selection"
    OPTS="-O2 -fexceptions -g -grecord-gcc-switches -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fPIE -fstack-protector-strong -fasynchronous-unwind-tables -fstack-clash-protection -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -pie"
fi

# Now add in our newly built plugin.
OPTS+=" -fplugin=$PLUGIN"
# OPTS+=" -fplugin=$PLUGIN -fplugin-arg-annobin-verbose"

# Next, turn off fortification."
OPTS+=" -Wp,-U_FORTIFY_SOURCE"

# And because LTO obscures fortification, turn that off too.
OPTS+=" -fno-lto"

start_test

export COLLECT_GCC_OPTIONS=

# Use atexit.c rather than main.c as it is bigger.
COMMAND="$GCC $OPTS $srcdir/atexit.c -o $EXE"
$COMMAND > $G_OUT 2>&1
if [ $? != 0 ];
then
    echo " $TEST_NAME: SKIP: unable to compile test file"
    echo " $TEST_NAME: command: $COMMAND"
    cat $G_OUT
    end_test
    exit $EXIT_TEST_SKIPPED
fi

# Run annocheck
SKIPS="--skip-all --test-fortify --suppress-version-warnings --enable-notes"
A_COMMAND="$ANNOCHECK $EXE $SKIPS --verbose"

$A_COMMAND > $A_OUT
grep -q -e"Overall: FAIL" $A_OUT
if [ $? != 0 ];
then
    echo " $TEST_NAME: FAIL: compiling with -Wp,-U_FORTIFY_SOURCE still produces an executable that passes annocheck"
    echo " $TEST_NAME: compile command: $COMMAND"
    echo " $TEST_NAME: compiler output:"
    cat $G_OUT
    echo " $TEST_NAME: annocheck command: $A_COMMAND"
    echo " $TEST_NAME: annocheck output:"
    cat $A_OUT
    end_test
    exit $EXIT_TEST_FAILED
fi

echo " $TEST_NAME: PASS: compiling with -Wp,-U_FORTIFY_SOURCE is detected by annocheck"

end_test
