Debian Bug report logs - #624460
libextutils-cbuilder-perl: shouldn't override $Config{ccflags} with $ENV{CFLAGS}

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Niko Tyni <ntyni@debian.org>

To: submit@bugs.debian.org

Subject: libextutils-cbuilder-perl: shouldn't override $Config{ccflags} with $ENV{CFLAGS}

Date: Thu, 28 Apr 2011 19:03:04 +0300

[Message part 1 (text/plain, inline)]

Package: libextutils-cbuilder-perl
Version: 0.280202-1 
Severity: serious
Justification: potential for hidden binary incompatibility
Forwarded: http://rt.perl.org/rt3//Public/Bug/Display.html?id=89478
Tags: patch
x-debbugs-cc: perl@packages.debian.org

Since ExtUtils::CBuilder 0.27_04, CFLAGS and LDFLAGS from the environment
have overridden the Config.pm ccflags and ldflags settings. This can
cause binary incompatibilities between the core Perl and extensions
built with EU::CBuilder.

The issue seems to have been introduced with
 https://github.com/dagolden/extutils-cbuilder/commit/e653d24a

This is particularly nasty on Debian, because dpkg-buildpackage sets
CFLAGS to "-g -O2" by default.

Comparing for example these build logs:

 https://buildd.debian.org/status/fetch.php?pkg=libparams-validate-perl&arch=amd64&ver=0.93-1&stamp=1259695361
 https://buildd.debian.org/status/fetch.php?pkg=libparams-validate-perl&arch=amd64&ver=0.97-1&stamp=1303329531

we see the old correct behaviour:

 cc -Ic -I/usr/lib/perl/5.10/CORE -DXS_VERSION="0.93" -DVERSION="0.93" -fPIC -c -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -o lib/Params/Validate.o lib/Params/Validate.c

and the new incorrect one:

 cc -Ic -I/usr/lib/perl/5.10/CORE -DXS_VERSION="0.97" -DVERSION="0.97" -fPIC -c -g -O2 -O2 -g -o lib/Params/Validate.o lib/Params/Validate.c

Omitting the Config.pm flags ($Config{ccflags}) can cause hidden
binary incompatibilities between the Perl core and extensions built with
EU::CBuilder. I'm not aware of any reports of this in current sid, but
the problem was originally spotted while testing Perl 5.14.0-RC1 on i386,
where omitting -D_FILE_OFFSET_BITS=64 made some extensions fail to load.
See the threads at
 http://lists.alioth.debian.org/pipermail/perl-maintainers/2011-April/001883.html
 http://www.nntp.perl.org/group/perl.perl5.porters/2011/04/msg171535.html

I'm attaching the patch I've sent upstream in [perl #89478], it applies
cleanly with -p3. It may be good to wait a bit for upstream comments,
but I think this is a real problem for Debian even if upstream doesn't
care that much.

To be on the safe side, I think that after this is fixed we should
binNMU all the XS modules built with buggy libextutils-builder-perl
package versions (starting at 2010-12-11 at 0.2801-1, inclusive.) I
haven't looked at how to identify those builds.
-- 
Niko Tyni   ntyni@debian.org

[0001-Append-CFLAGS-and-LDFLAGS-to-their-Config.pm-counter.patch (text/x-diff, attachment)]

Message #12 received at 624460@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Niko Tyni <ntyni@debian.org>, 624460@bugs.debian.org

Subject: Re: Bug#624460: libextutils-cbuilder-perl: shouldn't override $Config{ccflags} with $ENV{CFLAGS}

Date: Thu, 28 Apr 2011 17:36:47 +0100

On Thu, Apr 28, 2011 at 07:03:04PM +0300, Niko Tyni wrote:

> Since ExtUtils::CBuilder 0.27_04, CFLAGS and LDFLAGS from the environment
> have overridden the Config.pm ccflags and ldflags settings. This can
> cause binary incompatibilities between the core Perl and extensions
> built with EU::CBuilder.
> 
> The issue seems to have been introduced with
>  https://github.com/dagolden/extutils-cbuilder/commit/e653d24a
> 
> This is particularly nasty on Debian, because dpkg-buildpackage sets
> CFLAGS to "-g -O2" by default.
> 
> Comparing for example these build logs:
> 
>  https://buildd.debian.org/status/fetch.php?pkg=libparams-validate-perl&arch=amd64&ver=0.93-1&stamp=1259695361
>  https://buildd.debian.org/status/fetch.php?pkg=libparams-validate-perl&arch=amd64&ver=0.97-1&stamp=1303329531
> 
> we see the old correct behaviour:
> 
>  cc -Ic -I/usr/lib/perl/5.10/CORE -DXS_VERSION="0.93" -DVERSION="0.93" -fPIC -c -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -o lib/Params/Validate.o lib/Params/Validate.c
> 
> and the new incorrect one:
> 
>  cc -Ic -I/usr/lib/perl/5.10/CORE -DXS_VERSION="0.97" -DVERSION="0.97" -fPIC -c -g -O2 -O2 -g -o lib/Params/Validate.o lib/Params/Validate.c
> 
> Omitting the Config.pm flags ($Config{ccflags}) can cause hidden
> binary incompatibilities between the Perl core and extensions built with
> EU::CBuilder. I'm not aware of any reports of this in current sid, but
> the problem was originally spotted while testing Perl 5.14.0-RC1 on i386,
> where omitting -D_FILE_OFFSET_BITS=64 made some extensions fail to load.
> See the threads at
>  http://lists.alioth.debian.org/pipermail/perl-maintainers/2011-April/001883.html
>  http://www.nntp.perl.org/group/perl.perl5.porters/2011/04/msg171535.html
> 
> I'm attaching the patch I've sent upstream in [perl #89478], it applies
> cleanly with -p3. It may be good to wait a bit for upstream comments,
> but I think this is a real problem for Debian even if upstream doesn't
> care that much.
> 
> To be on the safe side, I think that after this is fixed we should
> binNMU all the XS modules built with buggy libextutils-builder-perl
> package versions (starting at 2010-12-11 at 0.2801-1, inclusive.) I
> haven't looked at how to identify those builds.

ssh buildd.debian.org

touch -d '2010-12-10' /tmp/dom-date # extra day for safety
cd /srv/buildd.debian.org/db
find -newer /tmp/dom-date -name '*_log.bz2' -type f -exec \
bzgrep -l libextutils-cbuilder-perl_0.280 {} \; # check pattern for correctness

By my experimentation this should complete in around 3 hours I'd probably
want to check with the buildd.debian.org admins before running this.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Message #17 received at 624460@bugs.debian.org (full text, mbox, reply):

From: Niko Tyni <ntyni@debian.org>

To: Dominic Hargreaves <dom@earth.li>

Cc: 624460@bugs.debian.org

Subject: Re: Bug#624460: libextutils-cbuilder-perl: shouldn't override $Config{ccflags} with $ENV{CFLAGS}

Date: Fri, 29 Apr 2011 07:55:27 +0300

On Thu, Apr 28, 2011 at 05:36:47PM +0100, Dominic Hargreaves wrote:
> On Thu, Apr 28, 2011 at 07:03:04PM +0300, Niko Tyni wrote:

> > To be on the safe side, I think that after this is fixed we should
> > binNMU all the XS modules built with buggy libextutils-builder-perl
> > package versions (starting at 2010-12-11 at 0.2801-1, inclusive.) I
> > haven't looked at how to identify those builds.

> find -newer /tmp/dom-date -name '*_log.bz2' -type f -exec \
> bzgrep -l libextutils-cbuilder-perl_0.280 {} \; # check pattern for correctness

Thanks. However, on second thought, all those modules are going to be
binNMU'd for the upcoming Perl 5.12 transition anyway. So, assuming
that's really happening in a month or so, it's probably enough unless
somebody reports actual breakage.

It's also possible that this affects some packages in squeeze, as the
bug was introduced in 2010-12-11. Although the bug itself never reached
squeeze, some packages may have been built with the bug in unstable and
then transitioned to testing. I expect the number of those to be just
a handful at most because of the late stage of the freeze.
-- 
Niko Tyni   ntyni@debian.org

Message #20 received at 624460@bugs.debian.org (full text, mbox, reply):

From: pkg-perl-maintainers@lists.alioth.debian.org

To: 624460@bugs.debian.org, 624460-submitter@bugs.debian.org

Subject: Bug in libextutils-cbuilder-perl fixed in revision 73833

Date: Fri, 29 Apr 2011 11:34:21 +0000

tag 624460 + pending
thanks

Some bugs are closed in revision 73833
by Dominic Hargreaves (dom)

Commit message:

  * Add patch to append CFLAGS and LDFLAGS to their Config.pm
    counterparts rather than overriding them (Closes: #624460)

Message #30 received at 624460@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Niko Tyni <ntyni@debian.org>

Cc: 624460@bugs.debian.org

Subject: Re: Bug#624460: libextutils-cbuilder-perl: shouldn't override $Config{ccflags} with $ENV{CFLAGS}

Date: Fri, 29 Apr 2011 13:00:51 +0100

On Fri, Apr 29, 2011 at 07:55:27AM +0300, Niko Tyni wrote:
> Thanks. However, on second thought, all those modules are going to be
> binNMU'd for the upcoming Perl 5.12 transition anyway. So, assuming
> that's really happening in a month or so, it's probably enough unless
> somebody reports actual breakage.

Good point. In fact, the release team has now approved the transition,
so we should probably get this fixed shortly. I plan to upload the fix
for this tomorrow.

> It's also possible that this affects some packages in squeeze, as the
> bug was introduced in 2010-12-11. Although the bug itself never reached
> squeeze, some packages may have been built with the bug in unstable and
> then transitioned to testing. I expect the number of those to be just
> a handful at most because of the late stage of the freeze.

*nod*

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Message #35 received at 624460-close@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: 624460-close@bugs.debian.org

Subject: Bug#624460: fixed in libextutils-cbuilder-perl 0.280202-2

Date: Sat, 30 Apr 2011 19:48:08 +0000

Source: libextutils-cbuilder-perl
Source-Version: 0.280202-2

We believe that the bug you reported is fixed in the latest version of
libextutils-cbuilder-perl, which is due to be installed in the Debian FTP archive:

libextutils-cbuilder-perl_0.280202-2.debian.tar.gz
  to main/libe/libextutils-cbuilder-perl/libextutils-cbuilder-perl_0.280202-2.debian.tar.gz
libextutils-cbuilder-perl_0.280202-2.dsc
  to main/libe/libextutils-cbuilder-perl/libextutils-cbuilder-perl_0.280202-2.dsc
libextutils-cbuilder-perl_0.280202-2_all.deb
  to main/libe/libextutils-cbuilder-perl/libextutils-cbuilder-perl_0.280202-2_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 624460@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dominic Hargreaves <dom@earth.li> (supplier of updated libextutils-cbuilder-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sat, 30 Apr 2011 20:38:51 +0100
Source: libextutils-cbuilder-perl
Binary: libextutils-cbuilder-perl
Architecture: source all
Version: 0.280202-2
Distribution: unstable
Urgency: low
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: Dominic Hargreaves <dom@earth.li>
Description: 
 libextutils-cbuilder-perl - module to compile and link C code for Perl modules
Closes: 624460
Changes: 
 libextutils-cbuilder-perl (0.280202-2) unstable; urgency=low
 .
   * Add patch to append CFLAGS and LDFLAGS to their Config.pm
     counterparts rather than overriding them (Closes: #624460)
   * Update Standards-Version (no changes)
Checksums-Sha1: 
 951d3718031b60890bf91d40f8cb36955302169e 1610 libextutils-cbuilder-perl_0.280202-2.dsc
 6734e0f0e1fddd9118051f1343cfe68604fa944f 4827 libextutils-cbuilder-perl_0.280202-2.debian.tar.gz
 584e1c2b4821c4ad154c071ac7661c16ca8f5a30 34434 libextutils-cbuilder-perl_0.280202-2_all.deb
Checksums-Sha256: 
 519910f2c9314e39b6cdce3bb7c215f18872df09b0ac46b3c5acbfdb5a2392ea 1610 libextutils-cbuilder-perl_0.280202-2.dsc
 368beeb7ddf0cca3081f14f29110499650e95385a6163a281c1152d4e469f1c1 4827 libextutils-cbuilder-perl_0.280202-2.debian.tar.gz
 63cbb688672a87913bbf4814fbc37686dc2f2c479c020b1dbd9fbb34f0c031ba 34434 libextutils-cbuilder-perl_0.280202-2_all.deb
Files: 
 9735e6628b0e165a463ed5d0c9be67f0 1610 perl optional libextutils-cbuilder-perl_0.280202-2.dsc
 201ca47a23a069b9d95c35d59a5f5a6b 4827 perl optional libextutils-cbuilder-perl_0.280202-2.debian.tar.gz
 256cbde26ef06c015765b36da3e3a2c1 34434 perl optional libextutils-cbuilder-perl_0.280202-2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFNvGYCYzuFKFF44qURAqSEAJ4nbpu39ttD6WyP0egTj8HUGmz/JgCg78Fy
za1ckTESM4xCfMPNx/F1EtY=
=vtxA
-----END PGP SIGNATURE-----

Message #40 received at 624460@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Niko Tyni <ntyni@debian.org>

Cc: 624460@bugs.debian.org

Subject: Re: Bug#624460: libextutils-cbuilder-perl: shouldn't override $Config{ccflags} with $ENV{CFLAGS}

Date: Fri, 6 May 2011 21:55:54 +0100

On Fri, Apr 29, 2011 at 01:00:51PM +0100, Dominic Hargreaves wrote:
> On Fri, Apr 29, 2011 at 07:55:27AM +0300, Niko Tyni wrote:
> > Thanks. However, on second thought, all those modules are going to be
> > binNMU'd for the upcoming Perl 5.12 transition anyway. So, assuming
> > that's really happening in a month or so, it's probably enough unless
> > somebody reports actual breakage.
> 
> Good point. In fact, the release team has now approved the transition,
> so we should probably get this fixed shortly. I plan to upload the fix
> for this tomorrow.
> 
> > It's also possible that this affects some packages in squeeze, as the
> > bug was introduced in 2010-12-11. Although the bug itself never reached
> > squeeze, some packages may have been built with the bug in unstable and
> > then transitioned to testing. I expect the number of those to be just
> > a handful at most because of the late stage of the freeze.
> 
> *nod*

dom@grieg:/srv/buildd.debian.org/db$ nice find -newer /tmp/dom-date -name '*_log.bz2' -type f -exec bzgrep -l libextutils-cbuilder-perl_0.280 {} \; # check pattern for correctness
./l/libparams-validate-perl/0.97-1/armel_1303345703_log.bz2
./l/libparams-validate-perl/0.97-1/ia64_1303332888_log.bz2
./l/libparams-validate-perl/0.97-1/s390_1303361849_log.bz2
./l/libparams-validate-perl/0.97-1/amd64_1303329531_log.bz2
./l/libparams-validate-perl/0.97-1/mipsel_1303428627_log.bz2
./l/libparams-validate-perl/0.97-1/kfreebsd-i386_1303329603_log.bz2
./l/libparams-validate-perl/0.97-1/kfreebsd-amd64_1303339797_log.bz2
./l/libparams-validate-perl/0.97-1/mips_1303367441_log.bz2
./l/libparams-validate-perl/0.97-1/powerpc_1303368051_log.bz2
./l/libparams-validate-perl/0.97-1/sparc_1303346887_log.bz2
./l/libdatetime-perl/2:0.6700-1/amd64_1303738816_log.bz2
./l/libdatetime-perl/2:0.6700-1/s390_1303738915_log.bz2
./l/libdatetime-perl/2:0.6700-1/sparc_1303739032_log.bz2
./l/libdatetime-perl/2:0.6700-1/kfreebsd-i386_1303738886_log.bz2
./l/libdatetime-perl/2:0.6700-1/ia64_1303738883_log.bz2
./l/libdatetime-perl/2:0.6700-1/armel_1303739406_log.bz2
./l/libdatetime-perl/2:0.6700-1/mipsel_1303795768_log.bz2
./l/libdatetime-perl/2:0.6700-1/mips_1303740134_log.bz2
./l/libdatetime-perl/2:0.6700-1/kfreebsd-amd64_1303739190_log.bz2
./l/libdatetime-perl/2:0.6700-1/powerpc_1303740060_log.bz2
dom@grieg:/srv/buildd.debian.org/db$ 

Neither in squeeze; so all is fine.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Send a report that this bug log contains spam.