fix: add hardening compiler flags in Debian build

[mhduiy]

1. Added DEB_CFLAGS_MAINT_APPEND with -Wall for warning flags
2. Added DEB_CXXFLAGS_MAINT_APPEND with -Wall for C++ warnings
3. Added extensive DEB_LDFLAGS_MAINT_APPEND with security hardening flags:
   • --as-needed for linker optimization
   • -z,relro for RELRO protection
   • -z,now for immediate binding
   • -z,noexecstack for stack protection
   • -E for exporting symbols

These changes improve security hardening during package build by enabling additional compiler warnings and linker security features recommended for Debian packages.

fix: 在 Debian 构建中添加加固编译标志

1. 添加 DEB_CFLAGS_MAINT_APPEND 包含 -Wall 警告标志
2. 添加 DEB_CXXFLAGS_MAINT_APPEND 包含 C++ 警告标志
3. 添加全面的 DEB_LDFLAGS_MAINT_APPEND 安全加固标志:
   • --as-needed 用于链接器优化
   • -z,relro 用于 RELRO 保护
   • -z,now 用于立即绑定
   • -z,noexecstack 用于栈保护
   • -E 用于导出符号

这些更改通过在包构建过程中启用额外的编译器警告和链接器安全功能来提高安全
性，这些是 Debian 包推荐的安全加固措施。

Summary by Sourcery

Enable Debian build hardening by appending compiler warning and linker security flags

Build:

• Append -Wall to DEB_CFLAGS_MAINT_APPEND and DEB_CXXFLAGS_MAINT_APPEND to enable C/C++ compiler warnings
• Add DEB_LDFLAGS_MAINT_APPEND with --as-needed, -z relro, -z now, -z noexecstack, and -E for linker security hardening

[sourcery-ai]

Reviewer's Guide

Enhanced Debian package build by appending -Wall to C and C++ compiler flags and introducing multiple security hardening linker flags in debian/rules.

File-Level Changes

Change	Details	Files
Appended warning flags to C compiler flags	Added DEB_CFLAGS_MAINT_APPEND with -Wall	debian/rules
Appended warning flags to C++ compiler flags	Added DEB_CXXFLAGS_MAINT_APPEND with -Wall	debian/rules
Appended security hardening linker flags	Added --as-needed for linker optimization Added -z,relro for RELRO protection Added -z,now for immediate binding Added -z,noexecstack for stack protection Added -E to export symbols	debian/rules

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-ci-robot]

deepin pr auto review

在审查这段代码时，我注意到以下几点：

1. 新增的编译器标志：

   • 新增的编译器标志 -Wall 用于启用所有常用的警告，这是一个好的实践，可以帮助开发者发现潜在的问题。
   • -Wl,--as-needed、-Wl,-z,relro、-Wl,-z,now 和 -Wl,-z,noexecstack 这些链接器标志用于优化二进制文件，提高安全性。这些标志是合理的，有助于提高软件的安全性和性能。

2. 环境变量：

   • DEB_CFLAGS_MAINT_APPEND 和 DEB_CXXFLAGS_MAINT_APPEND 用于在维护模式下追加编译标志。这是一个好的做法，因为它允许维护者控制编译过程。
   • DEB_LDFLAGS_MAINT_APPEND 用于在维护模式下追加链接器标志，这也是一个合理的做法。

3. 代码风格：

   • 新增的编译器标志和链接器标志之间没有空行分隔，这可能会影响可读性。建议在每行新增的标志之间添加一个空行，以提高代码的可读性。

4. 安全性：

   • 新增的链接器标志 -Wl,-z,noexecstack 可以防止栈溢出攻击，这是一个重要的安全措施。

5. 性能：

   • -Wl,--as-needed 可以帮助减少二进制文件的大小，提高加载速度。

综上所述，这段代码的改动是合理的，有助于提高软件的安全性和性能。建议在每行新增的标志之间添加一个空行，以提高代码的可读性。

[sourcery-ai]

Hey @mhduiy - I've reviewed your changes - here's some feedback:

• Consider adding -fstack-protector-strong to DEB_CFLAGS_MAINT_APPEND for stronger stack protection.
• Evaluate if the -E linker flag is necessary, as exporting all symbols may increase the attack surface; consider removing it or using --export-dynamic selectively.
• Consider including -z,defs in DEB_LDFLAGS_MAINT_APPEND to catch undefined symbol references at link time.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Consider adding -fstack-protector-strong to DEB_CFLAGS_MAINT_APPEND for stronger stack protection.
- Evaluate if the -E linker flag is necessary, as exporting all symbols may increase the attack surface; consider removing it or using --export-dynamic selectively.
- Consider including -z,defs in DEB_LDFLAGS_MAINT_APPEND to catch undefined symbol references at link time.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[deepin-bot]

TAG Bot

New tag: 0.1.16
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #44

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: 18202781743, BLumia, mhduiy

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment