Debian Bug report logs - #1009796
apt: reproducible-builds: BuildId differences triggered by RPATH

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: apt: reproducible-builds: BuildId differences triggered by RPATH

Date: Sun, 17 Apr 2022 18:23:20 -0700

[Message part 1 (text/plain, inline)]

Source: apt
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: buildpath
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The RPATH contains the build path resulting in different buildid:

  https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/apt.html

The attached patch to debian/rules passes
-DCMAKE_BUILD_RPATH_USE_ORIGIN=ON via a dh_auto_configure override,
which should use a relative path for RPATH.

Alternately, updating the packaging to debhelper compat level 14 should
fix this, although it is currently an experimental compat level.

Unfortunately, other issues prevent this package from being reproducible
(randomness in documentation), but this patch should at least reduce the
diff.


Thanks for maintaining apt!


live well,
  vagrant

[0001-debian-rules-Pass-DCMAKE_BUILD_RPATH_USE_ORIGIN-ON-v.patch (text/x-diff, inline)]

From 73c5b2945d385823f4291f27211c226f242c90c3 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Sun, 17 Apr 2022 23:12:47 +0000
Subject: [PATCH 1/2] debian/rules: Pass -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON via
 dh_auto_configure override.

This avoids embedding the full path in RPATH, which triggers BuildId
differences.

https://tests.reproducible-builds.org/debian/issues/unstable/cmake_rpath_contains_build_path_issue.html
---
 debian/rules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index 8a110f7a1..ce9218968 100755
--- a/debian/rules
+++ b/debian/rules
@@ -47,4 +47,4 @@ override_dh_installsystemd:
 override_dh_auto_configure-arch: flags=-DWITH_DOC=OFF
 override_dh_auto_configure-indep: flags=-DWITH_DOC=ON
 override_dh_auto_configure-arch override_dh_auto_configure-indep:
-	dh_auto_configure -- $(flags) $(configure_test_flags)
+	dh_auto_configure -- $(flags) $(configure_test_flags) -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON
-- 
2.30.2

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 1009796-submitter@bugs.debian.org (full text, mbox, reply):

From: Julian Andres Klode <noreply@salsa.debian.org>

To: 1009796-submitter@bugs.debian.org

Subject: Bug#1009796 marked as pending in apt

Date: Wed, 11 May 2022 09:21:29 +0000

Control: tag -1 pending

Hello,

Bug #1009796 in apt reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/apt-team/apt/-/commit/e6cefc7683de4f29be7ebcab004ea0ab80ce49bc

------------------------------------------------------------------------
Pass -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON via dh_auto_configure override

CMake by default sets the RPATH property on executables that link to
shared libraries in the same project with an absolute path, which
triggers BuildId differences.

References: https://tests.reproducible-builds.org/debian/issues/unstable/cmake_rpath_contains_build_path_issue.html
 https://gitlab.kitware.com/cmake/cmake/-/issues/18413
Closes: #1009796

[@donkult: reworded commit message slightly and have flag passed first]
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1009796

Message #15 received at 1009796-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1009796-close@bugs.debian.org

Subject: Bug#1009796: fixed in apt 2.5.0

Date: Wed, 18 May 2022 08:22:18 +0000

Source: apt
Source-Version: 2.5.0
Done: Julian Andres Klode <jak@debian.org>

We believe that the bug you reported is fixed in the latest version of
apt, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1009796@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Julian Andres Klode <jak@debian.org> (supplier of updated apt package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 17 May 2022 18:50:45 +0200
Source: apt
Built-For-Profiles: noudeb
Architecture: source
Version: 2.5.0
Distribution: unstable
Urgency: medium
Maintainer: APT Development Team <deity@lists.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Closes: 1008036 1009796 1009797 1010029 1010030
Changes:
 apt (2.5.0) unstable; urgency=medium
 .
   [ Helmut Grohne ]
   * Avoid use of deprecated std::iterator (twice) (Closes: #1008036)
 .
   [ David Kalnischkies ]
   * Document tagfile-keys.h as internal to apt
   * Drop support for long obsoleted Suggests alias: Optional
   * Do not order long obsoleted fields anymore
   * Stop parsing undocumented unknown EDSP field APT-Hash
   * Avoid .c_str() on strings feed into pkgTagSection::FindS
   * Use pkgTagSection::Key in more places in src:apt
   * Parse Checksum fields via pkgTagSection::Key, too
   * Avoid building all docs in nodoc build profile
   * Add pkg.apt.nodoxygen build profile
   * Use build-dep & satisfy for our CI dependency resolution
   * Mark pkg-config-test autopkgtest as superficial
   * Avoid building inside the source dir in autopkgtest
   * Link interactive helpers against system libapt for autopkgtest
   * Remove unused public zlib include from libapt fileutl.h
   * Run ./prepare-release post-build checks in Gitlab CI
   * Do not build documentation twice in CI
   * Ignore stty failures in testcases
   * Include our config.h in all C++ files to avoid ODR violations
   * Ship our README.md in apt package
 .
   [ Frans Spiesschaert ]
   * Dutch program translation update (Closes: #1010029)
   * Dutch manpages translation update (Closes: #1010030)
 .
   [ Troy Varney ]
   * Fix mirror method dequeuing incorrect items
 .
   [ Julian Andres Klode ]
   * Do not accept arguments for apt-cache dotty, xvcg.
     These commands do not actually interpret the same
     arguments as depends, or any own ones for that matter.
   * tests: Add g++ dependency to pkg-config test
 .
   [ Vagrant Cascadian ]
   * Pass -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON via dh_auto_configure override
     (Closes: #1009796)
   * Add support for "nodoc" build profile (Closes: #1009797)
Checksums-Sha1:
 5c18d9d73517671760d3a3b4e6d6e87ad6a0da11 2933 apt_2.5.0.dsc
 88e92d17df9b3681f711d6337d68ebfef47bb344 2218792 apt_2.5.0.tar.xz
 673970e1da89025782a9a78db2a6bee5c0bfd071 10283 apt_2.5.0_source.buildinfo
Checksums-Sha256:
 2546e510fc11d17b29bc63dc0460ac58b3af2b12e953350468ab9644be653640 2933 apt_2.5.0.dsc
 61cd84d04e2a7858f70dca21160977479c74150853cdeef7c843d59e72488c1f 2218792 apt_2.5.0.tar.xz
 b2cee4c52ca4699aff3bb7fc43c317a47728ca7c2f5ec930e2af9929659008ed 10283 apt_2.5.0_source.buildinfo
Files:
 b2699c1572cf5bd85265d9f0ccc60cb2 2933 admin important apt_2.5.0.dsc
 4d0beed7d4732145269ab64fd6eaa811 2218792 admin important apt_2.5.0.tar.xz
 4b23e76db907741633655f0d2a27d826 10283 admin important apt_2.5.0_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEET7WIqEwt3nmnTHeHb6RY3R2wP3EFAmKEo8APHGpha0BkZWJp
YW4ub3JnAAoJEG+kWN0dsD9xnMoQAItMDCJQ8j5pKzqH9xcgB0117mDE1G4Zrhoq
EBWHQZJa3ITyCWYBGAekcUIXVjvtV2nxWeTlkVz7HoT3D/Cft8yfxGZkeo7+rnTE
4gC6VTJZeZ9zG07km1H4/OwHv8aYQEJZWBCbtkuduUijOJCPac7SCVbHtvFaWdXx
9KcuIg+i6WEq4b3MRCwJ/UCruj6D37KcvPUkFNP29mz34sawsPCNFqk2e67ab4Uv
3sySJzD6rP5EriWVPruno4bAriOdCDsmVpOvYXP+jOVCXips7/R67/SYVKAh/EAb
gESIevQ8+M5yUt827Jw7SEqOvB6Ca1BGMH3yZ8QF2XsHLUYWYft/zx6SRef/CVOM
tbpKfZrw9589u9b+YuzLa2Bf1p6iCX9AEmpsdiXwJQ1Zax8U7gGcepAOQ9KmDvaD
2LhSMZGBguz9W0wUUMt9KLEOipuihY8phsurVhDmxrHNIgRKXXUMEFkTyMJ47DOw
xgbry97BsjYaTNPT3++BVCuAPOzjAlQ/0WhNk9UTxb7ubIxOt1WL8r5mNr+HuZjO
I13azE6ZgJqT0eC/cvLboP14e+or3RfKwzBBPWHSaoohoZvcoFeTL+v+whCogWBW
mzUHilnD1yQ3HiF1aVJ3LFnfYTfDRUxo/FxyNeldaPCWtTNQ3ftFC2RIbhjiY2BO
4qWFMAvt
=rUGa
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.