Debian Bug report logs - #1003495
gcc-xtensa-lx106: reproducible builds: embeds path to various binaries

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: gcc-xtensa-lx106: reproducible builds: embeds path to various binaries

Date: Mon, 10 Jan 2022 19:02:27 -0800

[Message part 1 (text/plain, inline)]

Source: gcc-xtensa-lx106
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge shell
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The paths to various binaries are embedded which differs on a usrmerge
vs. non-usrmerge system.

  https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/gcc-xtensa-lx106.html

  ./usr/lib/gcc/xtensa-lx106-elf/10.3.1/install-tools/fixincl
 	
  /bin/sed	
vs.
  /usr/bin/sed

  ./usr/lib/gcc/xtensa-lx106-elf/10.3.1/install-tools/mkheaders

  for·shell·in·$CONFIG_SHELL·$SHELL·/bin/bash·/bin/sh·"";·do
vs.
  for·shell·in·$CONFIG_SHELL·$SHELL·/bin/sh·/bin/sh·"";·do


Patch attached which passes variables to configure to use the
non-usrmerge locations, as usrmerge installations typically have
compatibility symlinks, but not vice-versa. The patch also sets
variables to ensure consistent values for bash, which can be triggered
when /bin/sh points to bash.


This patch alone does not fix all reproducibility issues (e.g. build
paths, which are only tested on unstable and experimental), but it
should build reproducibly in bookworm/testing once binutils-xtensa-lx106
is built with deterministic archives enabled:

  https://bugs.debian.org/1003494


Thanks for maintaining gcc-xtensa-lx106!


live well,
  vagrant

[0001-debian-rules-Pass-variables-to-configure-to-make-the.patch (text/x-diff, inline)]

From cf21d21676939698399a9f8ee6b0048f9dbefc5b Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Tue, 11 Jan 2022 02:53:34 +0000
Subject: [PATCH] debian/rules: Pass variables to configure to make the package
 build reproducibly regardless of usrmerge.

The variables SED, SHELL, BASH and CONFIG_SHELL should all point to
their non-usrmerge locations.

https://tests.reproducible-builds.org/debian/issues/paths_vary_due_to_usrmerge_issue.html
---
 debian/rules | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/debian/rules b/debian/rules
index eb94981..c9fae9a 100755
--- a/debian/rules
+++ b/debian/rules
@@ -80,6 +80,10 @@ configure_flags = \
 	--without-newlib \
 	"--with-pkgversion=$(deb_version)" \
 	--without-included-gettext \
+	SED=/bin/sed \
+	SHELL=/bin/sh \
+	BASH=/bin/bash \
+	CONFIG_SHELL=/bin/bash \
 	$(buildflags) \
 	$(target_tools)
 
-- 
2.30.2

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 1003495@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 1003495@bugs.debian.org

Cc: Vagrant Cascadian <vagrant@reproducible-builds.org>

Subject: Re: Bug#1003495: gcc-xtensa-lx106: reproducible builds: embeds path to various binaries

Date: Sun, 17 Jul 2022 12:55:28 +0100

[Message part 1 (text/plain, inline)]

Control: severity -1 serious

On Mon, 10 Jan 2022 at 19:02:27 -0800, Vagrant Cascadian wrote:
> The paths to various binaries are embedded which differs on a usrmerge
> vs. non-usrmerge system.
> 
>   https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/gcc-xtensa-lx106.html
> 
>   ./usr/lib/gcc/xtensa-lx106-elf/10.3.1/install-tools/fixincl
>  	
>   /bin/sed	
> vs.
>   /usr/bin/sed

This will be a practical problem as soon as Debian starts using merged-/usr
on official buildds, and the Debian technical committee resolution
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994388#110 recommends
treating this class of bug as release-critical for Debian 12, so I'm
raising the severity of this bug.

The problem scenario is:

- build the package on a system where both /bin/sed and /usr/bin/sed exist
  (merged-/usr)
- install and run the package on a system where only /bin/sed exists
  (non-merged-/usr)
- result: the feature that runs sed will not work

I don't know the specifics of how the tools that embed these paths work,
so it's possible that I am overstating the severity of this bug. If the
embedded paths are not used at runtime in practice, then the severity of
this bug can be downgraded to non-RC (but it would be better to fix it
anyway, because reproducible builds are a useful goal for other reasons).

> Patch attached which passes variables to configure to use the
> non-usrmerge locations, as usrmerge installations typically have
> compatibility symlinks, but not vice-versa. The patch also sets
> variables to ensure consistent values for bash, which can be triggered
> when /bin/sh points to bash.

This looks appropriate. To clarify, Debian installations with merged-/usr
are *guaranteed* to have the compatibility symlinks such as /bin ->
usr/bin, so it is always appropriate to use the canonical non-merged-/usr
paths such as /bin/sed.

Thanks,
    smcv

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 1003495-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1003495-close@bugs.debian.org

Subject: Bug#1003495: fixed in gcc-xtensa-lx106 10

Date: Mon, 18 Jul 2022 10:18:55 +0000

Source: gcc-xtensa-lx106
Source-Version: 10
Done: Jonathan McDowell <noodles@earth.li>

We believe that the bug you reported is fixed in the latest version of
gcc-xtensa-lx106, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1003495@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jonathan McDowell <noodles@earth.li> (supplier of updated gcc-xtensa-lx106 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 18 Jul 2022 08:32:48 +0100
Source: gcc-xtensa-lx106
Architecture: source
Version: 10
Distribution: unstable
Urgency: medium
Maintainer: Debian Electronics Packaging Team <pkg-electronics-devel@alioth-lists.debian.net>
Changed-By: Jonathan McDowell <noodles@earth.li>
Closes: 961090 1003495
Changes:
 gcc-xtensa-lx106 (10) unstable; urgency=medium
 .
   * Enable D compiler. Thanks to Witold Baryluk. (Closes: #961090)
   * Update to GCC 11
   * Fix compilation with usrmerge by forcibly configuring paths. Thanks
     to Vagrant Cascadian (Closes: #1003495)
Checksums-Sha1:
 32e27afdb8a2b5a66ec080b88885052e09389fbe 1944 gcc-xtensa-lx106_10.dsc
 c1fb5ea6e8684b14a85a10e64f28e2dbcfac2379 8840 gcc-xtensa-lx106_10.tar.xz
 b0d74275321a89d69e79ef81e5520bc6974ae6f7 7815 gcc-xtensa-lx106_10_amd64.buildinfo
Checksums-Sha256:
 8250f04170280f94c7fd4fef0aedc469d3cd9a53213ed8e18ab36b9a09e63b59 1944 gcc-xtensa-lx106_10.dsc
 15dc34de4e11ed4e0867512a2db2ef89ac9f7983b3d764fb6988c886511646f2 8840 gcc-xtensa-lx106_10.tar.xz
 4310ba0101fbd51e24f1254ac05b2f7d8ef981bc4664def565bf22561b8eb360 7815 gcc-xtensa-lx106_10_amd64.buildinfo
Files:
 3452167fca1c586cd791d69b1804ae68 1944 devel optional gcc-xtensa-lx106_10.dsc
 fb553e26de3ec0623f115fe4bf96e678 8840 devel optional gcc-xtensa-lx106_10.tar.xz
 0ab4503fce6508f6866f4cb1ee9d68b9 7815 devel optional gcc-xtensa-lx106_10_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERUuPEyEc/2gMWDpQ/xYvxc8/utEFAmLVL48ACgkQ/xYvxc8/
utHYxQ/8CUNgH50mgQAEm57Bz1uCB2dqwEyLsVWSuS6KXydylDpjKDlyfFqfz+hi
OKTrl3+qV1T3GRgEiVqQGdve1tQ9NfiD2BAkWMN4EQV2M05/eTmYr2K7/JvvlT8i
TNPv9R9czLu7l/RXEB9xAilt4HXjCm7Hnzke/W/VugWMoos0pUIalQoogrbj6ApC
/x6VDOom4rMlRmScnQP7c0q1DSTfClHFiKoCq1ls+2fuyTY970ZELo7qy/xBPHXQ
n7EZx0s8RtALuyMX5KVGGQkTwZB6gTeZFt/jVbmVWqGo1zbeU89kS9N6fcCsNH8P
Ex2L6UAtaiOhiW6iIFWvcYtSsltuLRMUHUn/0OGaaD8G/n0JEcbZ5H8ZwJX1ISyQ
QkKR2DQ1Ir4M//LM7ZF3hbEKa/7g3PQ54rQ5ojZJgHt3bWR1eH/rS4MakJ65nAjM
/xSJrAz/iCcGQeenKVEa01Dc1kyS/aOmMlM7VbKeRgH+L/tzL7MtK5F/PyNOuowP
w3DIYU58bFc9xIK9kXB54Y/SFPTvCqx6pXAFWSXdqD61XvWMYwil+FgeZ/bZSFvf
pvFBEF6c52gZZuFNC/TWjS7bA0nV2c9NK5RlD+JYGcCKhtjIGoMY/j1SJJkflIdG
yBEQkfPjxhMDSqy9S/HNNtbe8q+nGgbK9uOdCtju2jd6hDBgiSg=
=cHHW
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.