ANNOCHECK(1)

📦
version 13.31 · 3 versions
, in centos-stream 10, centos-stream 9, fedora 44

✨ ANNOCHECK(1) — the manual name, served 💅

🦋 NAME

okay bestie, so annocheck is the tool that's literally analysing binary files and reporting info about them 🔍 it's giving detective energy fr 🕵️‍♀️✨

🎀 SYNOPSIS

annocheck
  [-h | --help]
  [--help-tool]
  [--version]
  [-v | --verbose]
  [-q | --quiet]
  [-i | --ignore-unknown]
  [-r | --report-unknown]
  [-f | --follow-links]
  [-I | --ignore-links]
  [--debug-rpm=file]
  [--debug-file=file]
  [--debug-dir=dir]
  [-p text | --prefix=text]
  [-t dir | --tmpdir=dir]
  [-u | --use-debuginfod]
  [-n | --no-use-debuginfod]
  [--enable-tool]
  [--disable-tool]
  [--tool]
  [--tool-option]
  file...

annocheck
  --builtby
  --enable-builtby
  [--all]
  [--tool=name]
  [--nottool=name]
  [--no-version-info]
  [--no-lang-info]
  [--options-info]
  file...

🌸 DESCRIPTION

okay so annocheck is modular 🧚, which means it's built out of a bunch of self-contained tools that each handle the checking part. the list of tools that are currently implemented is... um, not actually listed here, so just vibes 🫠

it can scan inside rpm files and libraries 📦 and if you point it at a directory on the command line, it'll automatically recurse into it 💅 bonus: it knows how to find debug info stored in separate debug files and will go hunting for those whenever it needs what's inside them 🔎

wanna add a new tool? ✨ make a new source file and include it in the Makefile used to build annocheck. nothing else needs updating, which is the whole main character energy of the modular design 👑

new tools have to fill out a struct checker structure (defined in annocheck.h) and define a constructor function that calls annocheck_add_checker so the tool registers itself at program start-up 🚀

annocheck also has some generic command line options that work no matter which tools are turned on 🫶

"--debug-rpm=file"

  • look inside file for separate dwarf debug info 🔍. you can stack multiple --debug-rpm options and they accumulate 💖
⚠️ note: if none of --debug-rpm, --debug-file and --debug-dir are used, and you give it a single source file whose name ends in .rpm, annocheck will automatically try to find an associated debug info rpm based on the filename. iykyk 🙈

"--debug-file=file"

  • look in file for dwarf debug info. multiple instances of this option accumulate 🧁

"--debug-dir=dir"

  • look in the directory dir for separate dwarf debug info files 📁. heads up: multiple instances of this option do not accumulate 💀

"--help" / "-h"

  • shows the generic annobin usage info and then exits 👋

"--help-tool"

  • shows the usage info for tool and then exits 📖

"--report-unknown" / "--ignore-unknown" / "-r" / "-i"

  • if enabled, unknown file types get reported when they're encountered 🚨. that includes non-ELF files, block devices, and so on. directories are never considered unknown and get automatically descended into 📂

the default depends on the file being processed 🤔. for rpm files, the default is to ignore unknowns, since they often contain non-executable files 🙅‍♀️. for everything else (including directories), the default is to report unknown files 📣

"--ignore-links" / "--follow-links" / "-I" / "-f"

  • decides whether symbolic links get followed or ignored 🔗

the default depends on the file being processed 🤔. for rpm files, links get ignored by default, since they're often unresolveable 🥀. for other file types (including directories), links get followed by default 🏃‍♀️

"--prefix=text" / "-p text"

  • includes text in the output description 🏷️

"--quiet" / "-q"

  • prints nothing at all, you only get an exit status 🤫

"--tmpdir=dir" / "-t dir"

  • uses dir as the place to hold temporary files 🗂️

"--verbose" / "-v"

  • produces informational messages while it works 🗣️. repeat it for even more info 📢

"--version"

  • reports the version of the tool and then exits 🏷️✨

"--use-debuginfod" / "-u"

  • enables the debuginfod service for downloading debuginfo rpms 🌐. this is on by default, but it only actually works if debuginfod server support was compiled into annocheck 🛠️

"--no-use-debuginfod" / "-n"

  • do NOT use the debuginfod service, even if it's available 🙅‍♀️

"--enable-tool"

  • enables tool. most tools are disabled by default, so you gotta enable them with this option before they'll do anything 🔛

"--disable-tool"

  • disables tool. this is normally used to turn off the hardening checker, which is enabled by default 🛡️

"--tool"

  • enables tool and disables all the other tools 🎯

"--tool-option"

  • passes option on to tool 🎁

any other command line options get passed to the tools in turn, so each one gets a chance to claim and process them 🔁

the builtby tool is disabled by default, but you can turn it on with --enable-builtby or just --builtby 🏗️. it checks the specified files for any stored info about how they were built and what source languages were involved 🧐

since the hardening checker is on by default, you might also wanna add --disable-hardened to your command line 💅. it's not needed if you're using --builtby though 🫠

the builtby tool supports a few command line options to customise its behaviour 🎨:

"--all"

  • reports all builder identification strings 📜. builtby has several different heuristics for figuring out the builder 🧩. by default it only reports the info from the first successful heuristic, but with --all, every successful result gets returned 🙌. heads up: this will probably show the same info multiple times 🔁

"--tool=name"

  • restricts the output to only files built by a specific tool 🔧. super handy when you're scanning a directory full of files and hunting for ones built by a particular compiler 🕵️. you can use this option multiple times to select a bunch of builders 🎀

"--nottool=NAME"

  • restricts the output to only files that were NOT built by a specific tool 🚫. handy when you're scanning a directory and want the ones that weren't built by a particular compiler 🙅. use it multiple times to hide multiple builders 🫥

"--lang=name"

  • restricts the output to only files written in a specific high level language 💬. note: not all binaries include info about the source code language(s), so this option might not be 100% effective 🥺. use it multiple times for a broader selection of languages 🌈

"--notlang=NAME"

  • restricts the output to only files NOT written in a specific high level language 🙈. note: not all binaries include info about source code language(s), so this might not be totally effective 🥺. use it multiple times to hide a broader selection of languages 🫣

"--no-version-info" / "--lang-info"

  • by default, builtby reports the version info for the builders it detects 🔢. enabling --no-version-info stops that info from showing up 🙊

if you need it back, the --version-info option re-enables it 🔄

"--no-lang-info" / "--lang-info"

  • by default, builtby reports the high level language(s) of the sources used to build the program, if they were recorded 🗣️. enabling --no-lang-info stops that from showing up 🤐

if you need it back, use --lang-info to re-enable it 🔁

"--no-tool-info" / "--no-builder-info" / "--tool-info"

  • by default, builtby reports the tool(s) used to build the program 🛠️. enabling --no-build-info stops that from showing, so only the high level language info will be shown 🗣️. turning this off AND --no-lang-info at the same time makes builtby basically redundant 💀

note: --no-builder-info is a synonym for --no-tool-info 👯

if you need it back, use --tool-info to re-enable it 🔄

"--options-info" / "--no-options-info"

  • by default, builtby will NOT report the command line options given to the tools that built the target binary 🙅. adding --options-info turns that display on, if the info is stored in the binary (or its debug info) 🔍

if you need to turn it off again, use --no-options-info 🫶

🍓 OPTIONS

the OPTIONS section is empty in the original, so no vibes here either 🫠

Copyright (c) 2018-2026 Red Hat. 🌈

permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation 📜. there are no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts 🫶. a copy of the license is included in the section entitled "GNU Free Documentation License" 📖

bestie, that's the whole page 💖 annobin-1 · 2026-02-23 · ANNOCHECK(1) 🦋✨ stay iconic 💅

📦 where this page comes from