curl-pkg.sh: run checksec on linux build results

If checksec tool if available. Also show per-function fortify details

Author: vszakats

_build-runner.sh

@@ -34,6 +34,9 @@ if [ ! -f .cw-initialized ]; then
     Linux*)
       [[ "${CW_CONFIG:-}" = *'boringssl'* ]] && extra="${extra} golang nasm"
       [[ "${CW_CONFIG:-}" = *'musl'* ]] && extra="${extra} musl musl-dev musl-tools"
+      if [[ "${CW_CONFIG:-}" = *'linux'* ]]; then
+        extra="${extra} checksec"
+      fi
       # shellcheck disable=SC2086
       apt-get --quiet 2 --option Dpkg::Use-Pty=0 install \
         curl git gpg rsync python3-pefile make cmake \

_ci-linux-debian.sh

@@ -15,6 +15,7 @@ extra=''
 [[ "${CW_CONFIG:-}" = *'win'* ]] && extra="${extra} mingw-w64 osslsigncode wine64"
 
 if [[ "${CW_CONFIG:-}" = *'linux'* ]]; then
+  extra="${extra} checksec"
   if [[ "${CW_CONFIG:-}" = *'musl'* ]]; then
     extra="${extra} musl musl-dev musl-tools"
     extra="${extra} linux-headers"  # for openssl 'secure-memory' feature

curl-pkg.sh

@@ -65,6 +65,10 @@
         otool -L "${f}"
       elif [ "${_OS}" = 'linux' ]; then
         "${_READELF}" --file-header --dynamic "${f}"
+        if command -v checksec >/dev/null 2>&1; then
+          checksec --format=json --file="${f}" | jq
+          checksec --format=xml --fortify-file="${f}"  # duplicate keys in json, cannot apply jq
+        fi
         # Show linked GLIBC versions
         # https://en.wikipedia.org/wiki/Glibc#Version_history
         if [ "${_CPU}" = 'a64' ]; then