curl-pkg.sh: run checksec on linux build results

If `checksec` tool if available. Also show per-function fortify details.

Author: vszakats

_build-runner.sh

@@ -34,6 +34,9 @@ if [ ! -f .cw-initialized ]; then
     Linux*)
       [[ "${CW_CONFIG:-}" = *'boringssl'* ]] && extra="${extra} golang nasm"
       [[ "${CW_CONFIG:-}" = *'musl'* ]] && extra="${extra} musl musl-dev musl-tools"
+      if [[ "${CW_CONFIG:-}" = *'linux'* ]]; then
+        extra="${extra} checksec"
+      fi
       # shellcheck disable=SC2086
       apt-get --quiet 2 --option Dpkg::Use-Pty=0 install \
         curl git gpg rsync python3-pefile make cmake \

_ci-linux-debian.sh

@@ -15,6 +15,7 @@ extra=''
 [[ "${CW_CONFIG:-}" = *'win'* ]] && extra="${extra} mingw-w64 osslsigncode wine64"
 
 if [[ "${CW_CONFIG:-}" = *'linux'* ]]; then
+  extra="${extra} checksec"
   if [[ "${CW_CONFIG:-}" = *'musl'* ]]; then
     extra="${extra} musl musl-dev musl-tools"
     # for openssl 'secure-memory' feature

curl-pkg.sh

@@ -75,6 +75,10 @@
           otool -L "${f}"
         elif [ "${_OS}" = 'linux' ]; then
           "${_READELF}" --file-header --dynamic "${f}"
+          if command -v checksec >/dev/null 2>&1; then
+            checksec --format=json --file="${f}" | jq
+            checksec --format=xml --fortify-file="${f}"  # duplicate keys in json, cannot apply jq
+          fi
           # Show linked GLIBC versions
           # https://en.wikipedia.org/wiki/Glibc#Version_history
           if [ "${_CPU}" = 'a64' ]; then