Debian Bug report logs - #1000946
gcc-riscv64-unknown-elf: reproducible builds: embeds path to various binaries

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: gcc-riscv64-unknown-elf: reproducible builds: embeds path to various binaries

Date: Tue, 30 Nov 2021 19:18:33 -0800

[Message part 1 (text/plain, inline)]

Source: gcc-riscv64-unknown-elf
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge shell
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org, keithp@keithp.com

The paths to various binaries are embedded which differs on a usrmerge
vs. non-usrmerge system.

  https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/gcc-riscv64-unknown-elf.html

  /usr/lib/gcc/riscv64-unknown-elf/8.3.0/install-tools/fixincl

  /bin/sed
  vs.
  /usr/bin/sed

  /usr/lib/gcc/riscv64-unknown-elf/8.3.0/install-tools/mkheaders

  mkinstalldirs="/bin/bash·${itoolsdir}/mkinstalldirs"
  vs.
  mkinstalldirs="/bin/sh·${itoolsdir}/mkinstalldirs"

Patch attached which passes variables to configure to use the
non-usrmerge locations, as usrmerge installations typically have
compatibility symlinks, but not vice-versa. The patch also sets
variables to ensure consistent values for bash, which can be triggered
when /bin/sh points to bash.

This patch alone does not fix all reproducibility issues (e.g. build
paths, which are only tested on unstable and experimental), but should
build reproducibly in bookworm/testing once binutils-riscv64-unknown-elf
is built with deterministic archives enabled.


Thanks for maintaining gcc-riscv64-unknown-elf!


live well,
  vagrant

p.s. more deja-vu?

[0001-debian-rules-Pass-variables-to-configure-to-make-the.patch (text/x-diff, inline)]

From 6e8817705e2734392483bc332f1ba1df0eeee212 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Wed, 1 Dec 2021 03:13:30 +0000
Subject: [PATCH] debian/rules: Pass variables to configure to make the package
 build reproducibly regardless of usrmerge.

The variables SED, SHELL, BASH and CONFIG_SHELL should all point to
their non-usrmerge locations.

https://tests.reproducible-builds.org/debian/issues/paths_vary_due_to_usrmerge_issue.html
---
 debian/rules | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/debian/rules b/debian/rules
index 86fbda13298..c54382b8e4b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -57,6 +57,10 @@ configure_flags = \
 	--with-gnu-ld \
 	--with-as=$(target_bin)as \
 	--with-ld=$(target_bin)ld \
+        SED=/bin/sed \
+        SHELL=/bin/sh \
+        BASH=/bin/bash \
+        CONFIG_SHELL=/bin/bash \
 	$(target_tools) \
 	$(build_flags) \
 	CFLAGS_FOR_TARGET='-Os -mcmodel=medany' CXXFLAGS_FOR_TARGET='-Os -mcmodel=medany'
-- 
2.30.2

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 1000946@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 1000946@bugs.debian.org

Cc: Vagrant Cascadian <vagrant@reproducible-builds.org>

Subject: Re: Bug#1000946: gcc-riscv64-unknown-elf: reproducible builds: embeds path to various binaries

Date: Sun, 17 Jul 2022 12:53:36 +0100

Control: severity -1 serious

On Tue, 30 Nov 2021 at 19:18:33 -0800, Vagrant Cascadian wrote:
> The paths to various binaries are embedded which differs on a usrmerge
> vs. non-usrmerge system.
> 
>   https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/gcc-riscv64-unknown-elf.html
> 
>   /usr/lib/gcc/riscv64-unknown-elf/8.3.0/install-tools/fixincl
> 
>   /bin/sed
>   vs.
>   /usr/bin/sed

This will be a practical problem as soon as Debian starts using merged-/usr
on official buildds, and the Debian technical committee resolution
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994388#110 recommends
treating this class of bug as release-critical for Debian 12, so I'm
raising the severity of this bug.

The problem scenario is:

- build the package on a system where both /bin/sed and /usr/bin/sed exist
  (merged-/usr)
- install and run the package on a system where only /bin/sed exists
  (non-merged-/usr)
- result: the feature that runs sed will not work

I don't know the specifics of how the tools that embed these paths work,
so it's possible that I am overstating the severity of this bug. If the
embedded paths are not used at runtime in practice, then the severity of
this bug can be downgraded to non-RC (but it would be better to fix it
anyway, because reproducible builds are a useful goal for other reasons).

> Patch attached which passes variables to configure to use the
> non-usrmerge locations, as usrmerge installations typically have
> compatibility symlinks, but not vice-versa. The patch also sets
> variables to ensure consistent values for bash, which can be triggered
> when /bin/sh points to bash.

This looks appropriate. To clarify, Debian installations with merged-/usr
are *guaranteed* to have the compatibility symlinks such as /bin ->
usr/bin, so it is always appropriate to use the canonical non-merged-/usr
paths such as /bin/sed.

Thanks,
    smcv

Message #17 received at 1000946-done@bugs.debian.org (full text, mbox, reply):

From: Keith Packard <keithp@keithp.com>

To: 1000946-done@bugs.debian.org

Subject: Typo'd the version number in changelog

Date: Tue, 09 Aug 2022 12:22:11 -0700

[Message part 1 (text/plain, inline)]

Version: 11

I accidentally put 1000964 instead of 1000946 in changelog. 1000964 has
already been re-opened. (sorry!)

-- 
-keith

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.