Installs the annocheck program which uses the notes generated by annobin to
check that the specified files were compiled with the correct security
hardening options.
Provides
Requires
License
GPL-3.0-or-later AND LGPL-2.0-or-later AND (GPL-2.0-or-later WITH GCC-exception-2.0) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND GFDL-1.3-or-later
Changelog
* Tue Sep 01 2026 Nick Clifton <nickc@redhat.com> - 13.29-1
- Annocheck: Fix bug checking the path safety of the --debug-dir option. (RHEL-240886)
* Mon Jul 27 2026 Nick Clifton <nickc@redhat.com> - 13.28-1
- Testsuite: Fix hardening test.
- Annocheck: Fix seg-fault in code checking for gcc components.
- Annocheck: Allow ~ in filenames. Add more exceptions for gcc components. (RHEL-213510)
- GCC-Plugin: Only use a 64-bit pointer size for s390x binaries built by GCC 17+ (#2502729)
* Wed Jul 22 2026 Nick Clifton <nickc@redhat.com> - 13.25-1
- Annocheck: Improve bad filename detection. (RHEL-211396)
- Annocheck: Enable stack-clash test for Risc-V binaries built by gcc-15+.
- LLVM & Clang Plugins: Build with -fexceptions enabled. (RHEL-184482)
- Annocheck: Add support for ZIP files and TAR balls.
- Testsuite: Fixes for the glibcxx and hardening tests.
- GCC Plugin: Fix several minor bugs.
- Annocheck: Fix several minor bugs.
- Testsuite: Fix discrepancies.
- GCC Plugin: Fix recording the setting of __GLIBCXX_ASSERTIONS.
- Annocheck: Add exceptions for kernel bootstrap tools. (RHEL-73522)
- Testsuite: Add new tests.
- GCC Plugin: Fix error when checking for function level changes in the PIC and GOW settings.
- Annocheck: LTO test: Add exceptions for Clang runtime support object files. (RHEL-176052)
* Tue May 05 2026 Nick Clifton <nickc@redhat.com> - 13.14-1
- Rebase to allow rebuilding against LLVM 22. (RHEL-140420)
- Annocheck: Do not complain about GO binaries that do not support branch protection.
- Annocheck: Do not complain about Rust binaries that do not support branch protection.
- Annocheck: Skip the dynamic-tags test if a GNU Property note is present.
- Annocheck: Look for compromising characters in pathnames.
- Require C++17 for building.
- Annocheck: Ignore Risc-V attribute sections.
- Annocheck: Change result of failing not-XXX tests from FAIL to MAYB. Update documentation.
- Annocheck: Process the .ARM.attributes section.
- Annocheck: Add more files to the gcc heuristics list. (RHEL-150659)
- Annocheck: Add .fc44 to list of known rpm file extensions.
- Annocheck: Fix compile time warnings from GCC-15 re: strchr returning a const char *.
- Annocheck: Skip production test for gcc libraries. (RHEL-123175)
- Annocheck: Update heuristic to detect gcc libraries. (RHEL-124869)
- Annocheck: Change FAIL for binaries built by a cross compiler to a MAYBE. (RHEL-123175)
- Annocheck: Improve detection of glibc static maths libraries. (RHEL-107470)
* Tue Jan 27 2026 Nick Clifton <nickc@redhat.com> - 12.98-2
- NVR bump to allow rebuilding against LLVM v21. (RHEL-144392)
* Fri Jul 25 2025 Nick Clifton <nickc@redhat.com> - 12.98-1
- Rebase to 12.98. (RHEL-105574)
- Improve configure and meson files for consistent builds.
- Annocheck: Delete the temporary debug info directory after the tests have finished.
* Tue Jun 10 2025 Nick Clifton <nickc@redhat.com> - 12.96-1
- Annocheck: Fix bugs in debug rpm location code. Add more glibc exceptions. (RHEL-95216)
- Annocheck: Improve performance with multiple debug info files and multiple files to scan. (#2366180)
- Annocheck: Update heuristic for detecting gcc files to cope with gcc 15. (#2365824)
* Wed Apr 30 2025 Nick Clifton <nickc@redhat.com> - 12.93-1
- Rebuild against LLVM v20. (RHEL-82001)
- Rebase to 12.93.
- Annocheck: Fix test for GO revision. (RHEL-56031)
* Mon Mar 10 2025 Tulio Magno Quites Machado Filho <tuliom@redhat.com> - 12.92-2
- Generate latest-annobin.tar.xz at prep phase (RHEL-82899)
* Fri Feb 14 2025 Nick Clifton <nickc@redhat.com> - 12.92-1
- Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files. (RHEL-79264)
* Thu Feb 13 2025 Nick Clifton <nickc@redhat.com> - 12.91-1
- Annocheck: Fix resource leak. (RHEL-79253)
- Annocheck: Fix double free. Add special handling for COMBOOT modules.
- Annocheck: Improve diagnostics when a separate debug info file cannot be found.
* Mon Feb 03 2025 Nick Clifton <nickc@redhat.com> - 12.88-1
- Annocheck: Look for -fstack-clash-protection in DW_AT_producer string. (RHEL-77489)
* Thu Jan 30 2025 Nick Clifton <nickc@redhat.com> - 12.87-1
- Annocheck: Fix locating string notes (again). Add exception for glibc benchmark tests. (RHEL-76809)
- Annocheck: Add crtoffloadtableS.o to list of known gcc binaries. (RHEL-76040)
* Mon Jan 27 2025 Nick Clifton <nickc@redhat.com> - 12.85-1
- Annocheck: Fix the --debug-dir option.
* Thu Jan 23 2025 Nick Clifton <nickc@redhat.com> - 12.84-1
- Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
* Wed Jan 22 2025 Nick Clifton <nickc@redhat.com> - 12.83-1
- Annocheck: Remove spurious debugging messages.
- Annocheck: Always look for annobin notes in separate debug info files. (RHEL-75778)
- Annocheck: Support multiple --debug-rpm and --debug-file options. (RHEL-73349)
- Annocheck: Add support for sys-root'ed glibc packages. (RHEL-71296)
- GCC Plugin: Tidy up use of gcc's diagnoatic headers. (#32429)
- Testsuite: Use configured compiler when running tests.
- GCC Plugin: Fix building with gcc 15. (#32429)
- Annocheck: Fix overly long debug messages.
- Annocheck: Rename rwx-seg test to load-segments. Add more checks. Add check for gaps as a future fail.
- Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
- Annocheck: Add --enable-future to enable future fail components in normal tests.
- Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
- Annocheck: Add more exceptions for gcc binaries. (RHEL-33365)
- Annocheck: Add --skip-passes option.
- Annocheck: Add exceptions for gcc binaries. (RHEL-33365)
- Annocheck: Skip property note test for i386 binaries created by LLVM. (#2323797)
- Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info. (RHEL-65411)
- GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.
- Clang & LLVM Plugins: Include install directory in binary. (RHEL-54069)
- BuiltBy: Fix seg-fault when comparing language version strings. (RHEL-53497)
- Annocheck: Stop spurious assembler warnings. (RHEL-53213)
- Annocheck: Stop warnings about known gaps. (RHEL-53218)
- Annocheck: Fix stack realign test. (#2302427)
* Mon Nov 18 202