Debian Bug report logs - #1001223
dx: stores wrong path to sh if /usr/bin/sh or /usr/local/bin/sh exists

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dx: stores wrong path to sh if /usr/bin/sh or /usr/local/bin/sh exists

Date: Mon, 6 Dec 2021 15:50:32 +0000

[Message part 1 (text/plain, inline)]

Source: dx
Version: 1:4.4.4-14
Severity: important
Tags: patch bookworm sid
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

If dx is built on a merged-/usr system (as created by new
installations of Debian >= 10, debootstrap --merged-usr, or installing
the usrmerge package into an existing installation), the path to sh
is recorded in the binary package as /usr/bin/sh, rather than the
canonical /bin/sh. A previous solution to this appears to have not been
completely successful: it edited the path found in header files, but
not the path hard-coded into executable files.

This can be seen on the reproducible-builds.org infra:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/dx.html

If you have sbuild available, an easy way to reproduce this is to build
twice, once with --add-depends=usrmerge and once without.

The problematic situation is if the package is *built* on a unified-/usr
system, but *used* on a non-unified-/usr system. In this situation,
/usr/bin/sh exists on the build system but not on the system where the
package will be used, resulting in the features that use this executable
not working correctly.

Similarly, if there is a /usr/local/bin/sh visible at build-time,
then that path would likely end up hard-coded into the binary,
causing the relevant feature to fail on all systems that do not have
/usr/local/bin/sh.

Technical Committee resolution #978636 mandates heading towards a
transition to merged-/usr, and variation between merged-/usr and
non-merged-/usr builds is a problem while that transition is taking
place, because it can lead to partial upgrades behaving incorrectly. It
is likely that this class of bugs will become release-critical later in
the bookworm development cycle.

A common way to resolve this sort of thing is to pass a configure option
or a variable name to ./configure, and this package appears to provide a
--with-bsh option for this purpose, so I'd recommend using it. The attached
patch builds successfully with or without usrmerge, with the same content
(although I have not otherwise tested the resulting packages).

Thanks,
    smcv

[0001-Pass-interoperable-path-for-bin-sh-to-configure.patch (text/x-diff, attachment)]

Message #10 received at 1001223-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1001223-close@bugs.debian.org

Subject: Bug#1001223: fixed in dx 1:4.4.4-15

Date: Sun, 13 Feb 2022 13:34:02 +0000

Source: dx
Source-Version: 1:4.4.4-15
Done: Graham Inggs <ginggs@debian.org>

We believe that the bug you reported is fixed in the latest version of
dx, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1001223@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Graham Inggs <ginggs@debian.org> (supplier of updated dx package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 13 Feb 2022 13:16:06 +0000
Source: dx
Built-For-Profiles: noudeb
Architecture: source
Version: 1:4.4.4-15
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Graham Inggs <ginggs@debian.org>
Closes: 1001223
Changes:
 dx (1:4.4.4-15) unstable; urgency=medium
 .
   [ Simon McVittie ]
   * Pass interoperable path for /bin/sh to configure
     (Closes: #1001223)
 .
   [ Graham Inggs ]
   * Update debian/copyright
Checksums-Sha1:
 ac77638782ee85468271512e89ecab28a3a646e8 2415 dx_4.4.4-15.dsc
 1b7eab4f4c381ead31609277617c88390bef6690 72584 dx_4.4.4-15.debian.tar.xz
Checksums-Sha256:
 27891ba9c6bf22fd0b6288a319c124515ea12e0a70d0a050db283198c0aaaefa 2415 dx_4.4.4-15.dsc
 6664a8aa0cf138bfe6884858292ad82b42b1ad0e33b94e6cca524262395b7169 72584 dx_4.4.4-15.debian.tar.xz
Files:
 9bc9ff80510203f6a5472c3a57843fd2 2415 science optional dx_4.4.4-15.dsc
 d4fd62bcc6c09e3a9167886f893cd49e 72584 science optional dx_4.4.4-15.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJeP/LX9Gnb59DU5Qr8/sjmac4cIFAmIJBVUACgkQr8/sjmac
4cKOshAAoLFRa9xrOu3qr314QU/YPL99lkHrRVjQlQtjUtm6IZFzw+yLovwYxssG
u3OyikCXA8QBPvSszfvNFaDEX0hcfVzuc25VDLpiP8dDHAjf7wnxTOBkQ9rZ/jfQ
Tq+2APVwAvpwXvl5Df2quJ7fqwAkgEC3Gmu7f6jPqEhEQcG5urm9PuBPx8tNQdTk
9+vasqFkKSMY1Yct5uTrMZpQNMm0CuByu9YH8NmEZFXR3SkP1Jh7ugvqz5Nghs0B
gPbvBoXoQGUsV2S2uge0ACpfxy8tbygn/1TrXgJLyQooGjhm67oMOk/oQouSSNCO
T0FGJqu+xpkHYEFwqtTenYOftDlmi+N6TfYdNrMcIeG8SXXCnK7GGA8Dioborsjb
U1YQtggcG3goFsrMatW46cElbQb+w1Gz3xOevJSW7TUd6zRlLozJ6tZbq8P+UZNt
ss8d/WjyV5BlgCdrhwnoQbsAeAQdPvb8Ols5tmbuHc+v4mnQxJiv30gKaaPGEvew
rxAURcsD3Vby/baVylg8IYEYl2BYnBMaamJsd4wh8azTK++IG9mLxQmQWODqJXGj
VlQPaX2D7f066PKmRJCiPC7GBcNbl3rgQexL6Xw0sze6pZcmkYwCnSfYSdM7mbS8
3ptdb2SZsdjhHqZBzjwutcGRpEJzFfaa8BBqB8Euy08dZBpb7Hc=
=a6Hp
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.