ci: add symbol validation

checks for missing public symbols, leaked symbols and that plugins only
contains the register_plugin symbol.

.github/workflows/ci.yml

@@ -17,6 +17,8 @@ jobs:
            run: make PREFIX=install EXTRA_WARNINGS=-Werror
          - name: make install
            run: make install PREFIX=install
+         - name: check symbols
+           run: make check-symbols
 
    osx:
       runs-on: macos-latest
@@ -26,6 +28,8 @@ jobs:
            run: brew update; brew install make pkg-config
          - name: make
            run: sh build-osx.sh EXTRA_WARNINGS=-Werror clients curses
+         - name: check symbols
+           run: sh build-osx.sh check-symbols
 
    doxygen:
       runs-on: ubuntu-latest

GNUmakefile

@@ -161,6 +161,9 @@ sign:
 	git archive --prefix="bemenu-$(VERSION)/" -o "bemenu-$(VERSION).tar.gz" "$(GIT_TAG)"
 	gpg --default-key "$(GPG_KEY_ID)" --armor --detach-sign "bemenu-$(VERSION).tar.gz"
 
+check-symbols: libbemenu.so lib/bemenu.h
+	sh scripts/check-symbols.sh $^ bemenu-renderer-*.so
+
 clean:
 	$(RM) -r *.dSYM # OSX generates .dSYM dirs with -g ...
 	$(RM) $(pkgconfigs) $(libs) $(bins) $(renderers) $(mans) *.a *.so.*
@@ -178,4 +181,4 @@ uninstall:
 .DELETE_ON_ERROR:
 .PHONY: all clean uninstall install install-base install-pkgconfig install-include install-libs install-lib-symlinks \
 		install-man install-bins install-docs install-renderers install-curses install-wayland install-x11 \
-		doxygen sign clients curses x11 wayland
+		doxygen sign check-symbols clients curses x11 wayland

scripts/check-symbols.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+# Check that no internal symbols are being leaked from the library
+# $1: path to the .so
+# $2: path to the lib/bemenu.h
+
+hash grep nm sort awk comm printf cat touch
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+grep '^BM_PUBLIC' "$2" | grep -o '[a-z_]*(' | grep -o '[a-z_]*' | awk 'NF' | sort > "$tmp/hdr.txt"
+
+nm --extern-only "$1" |\
+   awk '/T/{if (substr($3,1,1) == "_") print substr($3, 2); else print $3}' |\
+   grep -o '[a-z_]*' | awk 'NF' | sort > "$tmp/lib.txt"
+
+comm -13 "$tmp/hdr.txt" "$tmp/lib.txt" > "$tmp/leaks.txt"
+comm -23 "$tmp/hdr.txt" "$tmp/lib.txt" > "$tmp/missing.txt"
+
+if [ -s "$tmp/leaks.txt" ]; then
+   printf 'SYMBOL LEAKAGE: following symbols should not be marked BM_PUBLIC:\n'
+   cat "$tmp/leaks.txt" | awk '$0="> "$0'
+   touch "$tmp/failure"
+fi
+
+if [ -s "$tmp/missing.txt" ]; then
+   printf 'SYMBOL MISSING: following BM_PUBLIC symbols were not found from the binary:\n'
+   cat "$tmp/missing.txt" | awk '$0="> "$0'
+   touch "$tmp/failure"
+fi
+
+shift 2
+for renderer in "$@"; do
+   nm --extern-only "$renderer" | awk '/T/{print $3}' | grep -v register_renderer | awk 'NF' > "$tmp/${renderer}_leaks.txt"
+   if [ -s "$tmp/${renderer}_leaks.txt" ]; then
+      printf 'SYMBOL LEAKAGE: %s should only have a register_renderer symbol visible\n' "$renderer"
+      cat "$tmp/${renderer}_leaks.txt" | awk '$0="> "$0'
+      touch "$tmp/failure"
+   fi
+done
+
+test -f "$tmp/failure" && exit 1 || exit 0