re-enabled new-style hardening based on how sqlite3 3.7.14-1 does it

6 files changed, 19 insertions, 12 deletions

diff --git a/debian/control b/debian/control
index 47fa551..5e27ec2 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: sqlcipher
 Section: devel
 Priority: optional
 Maintainer: Hans-Christoph Steiner <hans@eds.org>
-Build-Depends: dpkg-dev (>= 1.16.0~), debhelper (>= 8.1.2~), hardening-wrapper, autoconf (>= 2.59), libtool (>= 1.5.2), automake, autotools-dev, chrpath, libreadline-dev, tcl8.5-dev, libssl-dev
+Build-Depends: dpkg-dev (>= 1.16.1~), debhelper (>= 8.1.3), autoconf (>= 2.59), libtool (>= 1.5.2), automake, autotools-dev, chrpath, libreadline-dev, tcl8.5-dev, libssl-dev
 Build-Conflicts: tcl8.4, tcl8.4-dev
 Homepage: http://sqlcipher.net/
 Standards-Version: 3.9.3
diff --git a/debian/libsqlcipher-dev.install b/debian/libsqlcipher-dev.install
deleted file mode 100644
index 6f3b50c..0000000
--- a/debian/libsqlcipher-dev.install
+++ /dev/null
@@ -1,5 +0,0 @@
-usr/include/sqlcipher/*.h
-usr/lib/*/libsqlcipher.a
-usr/lib/*/libsqlcipher.so
-usr/lib/*/libsqlcipher.la
-usr/lib/*/pkgconfig/sqlcipher.pc
diff --git a/debian/libsqlcipher-dev.install.in b/debian/libsqlcipher-dev.install.in
new file mode 100644
index 0000000..3466e26
--- /dev/null
+++ b/debian/libsqlcipher-dev.install.in
@@ -0,0 +1,5 @@
+usr/include/sqlcipher/*.h
+usr/lib/${DEB_HOST_MULTIARCH}/libsqlcipher.a
+usr/lib/${DEB_HOST_MULTIARCH}/libsqlcipher.so
+usr/lib/${DEB_HOST_MULTIARCH}/libsqlcipher.la
+usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig/sqlcipher.pc
diff --git a/debian/libsqlcipher0.install b/debian/libsqlcipher0.install
deleted file mode 100644
index 5d85381..0000000
--- a/debian/libsqlcipher0.install
+++ /dev/null
@@ -1 +0,0 @@
-usr/lib/*/libsqlcipher.so.*
diff --git a/debian/libsqlcipher0.install.in b/debian/libsqlcipher0.install.in
new file mode 100644
index 0000000..109e22e
--- /dev/null
+++ b/debian/libsqlcipher0.install.in
@@ -0,0 +1 @@
+usr/lib/${DEB_HOST_MULTIARCH}/libsqlcipher.so.*
diff --git a/debian/rules b/debian/rules
index 7d13b22..c088965 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,7 +3,9 @@
 
 #export DH_VERBOSE=1
 
-export DEB_BUILD_HARDENING=1
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/buildflags.mk
 
 DESTDIR=$(CURDIR)/debian/tmp
 
@@ -15,15 +17,13 @@ DDEBUG=`if (echo $(DEB_BUILD_OPTIONS) | grep -q debug) then \
 
 
 #export DEB_CFLAGS_MAINT_APPEND = -O2 -fno-strict-aliasing
-CFLAGS := $(shell dpkg-buildflags --get CFLAGS)
-LDFLAGS := $(shell dpkg-buildflags --get LDFLAGS)
-
-CFLAGS += -O2 -fno-strict-aliasing \
+export CFLAGS += -O2 -fno-strict-aliasing \
 	-DSQLITE_SECURE_DELETE -DSQLITE_ENABLE_COLUMN_METADATA \
 	-DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_RTREE=1 -DSQLITE_SOUNDEX=1 \
 	-DSQLITE_ENABLE_UNLOCK_NOTIFY \
 	-DSQLITE_OMIT_LOOKASIDE=1 \
 	-DSQLITE_ENABLE_UPDATE_DELETE_LIMIT=1 \
+	-DSQLITE_MAX_SCHEMA_RETRY=25 \
 	-DSQLITE_HAS_CODEC
 
 configure: configure-stamp
@@ -39,6 +39,9 @@ configure-stamp:
 	  --libexecdir=\$${libdir}/sqlcipher \
 	  $(DDEBUG)
 
+	# remove double -ldl from sqlcipher.pc
+	sed -i "s/\([-ldl .+]\) -ldl/\1/" sqlcipher.pc
+
 	touch $@
 
 build-arch: build-stamp
@@ -88,6 +91,10 @@ binary-arch: build install
 	dh_testdir
 	dh_testroot
 
+	for file in libsqlcipher0.install libsqlcipher-dev.install; do \
+		sed -e"s,\$${DEB_HOST_MULTIARCH},${DEB_HOST_MULTIARCH},g" \
+			debian/$${file}.in > debian/$$file; \
+	done
 	dh_install -a --sourcedir=$(DESTDIR)
 	dh_installman -a
 	dh_installdocs -a