Debian Bug report logs - #778862
ispell: please make building .hash files reproducible

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: submit@bugs.debian.org

Subject: ispell: please make building .hash files reproducible

Date: Fri, 20 Feb 2015 21:01:26 +0100

[Message part 1 (text/plain, inline)]

Source: ispell
Version: 3.3.02-6
Severity: wishlist
User: reproducible-builds@lists.alioth.debian.org
Usertags: randomness toolchain

Hi!

While working on Debian's “reproducible builds” effort [1], we have
noticed that buildhash from ispell produces unreproducible .hash files
(example [2]).

After some investigation, I found out that those undeterministic lines
come when "sflaglist" (which is a list of "flagent" structs) is written [3].
The problem is that "sizeof(struct flagent)" is 800 bytes, while the summed up
size of the individual members is only 794 bytes [4].
So after those 794 bytes are written, the remaining 6 bytes are read from
uninitialized memory (which is undeterministic).
Packing the struct (__attribute__ ((__packed__))) would probably help, but
is no solution as this would change the size of the .hash files and other
tools reading them will probably have problems.

The best solution is probably to initialize the whole sflaglist
(or each flagent) with zero when it is allocated.


Regards,
 Reiner

[1]: https://wiki.debian.org/ReproducibleBuilds
[2]: https://packages.debian.org/jessie/lava-server
[3]: https://sources.debian.net/src/ispell/3.3.02-6/buildhash.c/#L398
[4]: https://sources.debian.net/src/ispell/3.3.02-6/ispell.h/#L332

[signature.asc (application/pgp-signature, attachment)]

Message #10 received at 778862@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: 778862@bugs.debian.org

Subject: Re: Bug#778862: ispell: please make building .hash files reproducible

Date: Fri, 20 Feb 2015 21:31:52 +0100

[Message part 1 (text/plain, inline)]

> [2]: https://packages.debian.org/jessie/lava-server

Sorry, I pasted the wrong link. The correct one is:

[2]: https://reproducible.debian.net/iitalian

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 778862@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: 778862@bugs.debian.org

Subject: Re: Bug#778862: ispell: please make building .hash files reproducible

Date: Sat, 21 Feb 2015 00:28:51 +0100

[Message part 1 (text/plain, inline)]

Control: tags -1 + patch

I attached a patch that initializes the parsed tables with 0,
before they are assigned to sflaglist.

[ispell.patch (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, attachment)]

Message #24 received at 778862-close@bugs.debian.org (full text, mbox, reply):

From: Robert Luberda <robert@debian.org>

To: 778862-close@bugs.debian.org

Subject: Bug#778862: fixed in ispell 3.4.00-1

Date: Sat, 21 Mar 2015 21:19:23 +0000

Source: ispell
Source-Version: 3.4.00-1

We believe that the bug you reported is fixed in the latest version of
ispell, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 778862@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Robert Luberda <robert@debian.org> (supplier of updated ispell package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 21 Mar 2015 11:05:08 +0100
Source: ispell
Binary: ispell ienglish-common iamerican ibritish iamerican-small ibritish-small iamerican-large ibritish-large iamerican-huge ibritish-huge iamerican-insane ibritish-insane
Architecture: source i386 all
Version: 3.4.00-1
Distribution: experimental
Urgency: medium
Maintainer: Robert Luberda <robert@debian.org>
Changed-By: Robert Luberda <robert@debian.org>
Description:
 iamerican  - American English dictionary for ispell (standard version)
 iamerican-huge - American English dictionary for ispell (huge)
 iamerican-insane - American English dictionary for ispell (insane version)
 iamerican-large - American English dictionary for ispell (large)
 iamerican-small - American English dictionary for ispell (small)
 ibritish   - British English dictionary for ispell (standard version)
 ibritish-huge - British English dictionary for ispell (huge)
 ibritish-insane - British English dictionary for ispell (insane version)
 ibritish-large - British English dictionary for ispell (large)
 ibritish-small - British English dictionary for ispell (small)
 ienglish-common - Common files for British and American ispell dictionaries
 ispell     - International Ispell (an interactive spelling corrector)
Closes: 301205 561089 745297 778862
Changes:
 ispell (3.4.00-1) experimental; urgency=medium
 .
   * New upstream version.
   * Remove no longer needed patches:
     005-Do-not-reorder-words, 0012-Fix-getline, 0017-Destdir-support,
     0019-Section-of-english-manpage, 0025-Languages.
   * Remove most of 0007-Use-termios.patch, as ispell supports termios
     by its own.
   * Update 0001-Configuration.patch to use -ltinfo instead of -lncurses,
     and 0015-CFLAFS-from-environment & 0018-Dont-strip-binaries to make
     the changes in defrmatters/Makefile.
   * Update debian/localMakefile.languages.inc for new version and pass
     `-n' to gzip to make builds reproducible.
   * english(5) man page has been removed by upstream, remove references
     to it from debian/ directory.
   * Add 0031-Initialize-table.patch which initializes buildhash tables to
     zero to make .hash files reproducible (closes: #778862).
   * Add 0032-Check-munchlist-errors.patch to break munchlist as soon as
     an error occurs (closes: #301205).
   * New 0033-Fix-NULL-pointer-dereference.patch to fix ispell crash occurring
     on hash tables built without prior call to munchlist (closes: #561089).
   * Switch to debhelper v9.
   * Drop debian/TODO.Debian - its items were copied from Debian BTS, some
     of them have been resolved already.
   * debian/rules: handle CPPFLAGS environment variable and enable LFS
     support (lintian).
   * debian/control:
     + fix a typo in british-small description (closes: #745297);
     + update dependencies on dictionaries-common-dev, wordlist packages,
       and use ${ispell:Depends} instead of hard-coded dependencies on
       ispell and dictionaries-common;
     + bump Standards-Version to 3.9.6.
Checksums-Sha1:
 4a106d494b2b140b462ca87667a8204f3e1d1087 2801 ispell_3.4.00-1.dsc
 6138ab935f0261be8162e3cdc07c127d53555837 638770 ispell_3.4.00.orig.tar.gz
 d9a7a24aaf30dc00950814ebe39569b9a4a59da3 40520 ispell_3.4.00-1.debian.tar.xz
 ec15ce051b85120d1acc8aed404a77d0237ad008 142228 ispell_3.4.00-1_i386.deb
 4f43794652081f08bb64b28f1d5914fea7cc462a 29074 ienglish-common_3.4.00-1_all.deb
 6a305bb5789de004d488cfd990db2eadcdba0d2d 188784 iamerican_3.4.00-1_all.deb
 2f3fe858dbfb3b1b5fa80a64fccee506ef0d42d1 189160 ibritish_3.4.00-1_all.deb
 196edbcbd7e58044a9f4fa46a06b5151ec917dc9 94512 iamerican-small_3.4.00-1_all.deb
 847ba62f27e9e8b1dd94687b3c3d99b0c1dd883e 94782 ibritish-small_3.4.00-1_all.deb
 19d62933bc8775a3150ba51c26e08f7429cccbcb 365676 iamerican-large_3.4.00-1_all.deb
 f4b7dfbae648cb279230b646fd500c5cc94732a0 366570 ibritish-large_3.4.00-1_all.deb
 29891a03e03ce06ea79517a97611dbb4151ccd46 634414 iamerican-huge_3.4.00-1_all.deb
 803369fe50f11a1d5706fb7faa4a4a16b0692aa9 636048 ibritish-huge_3.4.00-1_all.deb
 c46182c271d2f166f0bbc605c0c438a449cdec7f 1291216 iamerican-insane_3.4.00-1_all.deb
 70944e62d6d083544a3321f0c05815c186a22d31 1293900 ibritish-insane_3.4.00-1_all.deb
Checksums-Sha256:
 8f200d4397a9a6c0b09557415530764fe382d32abd5c00446890bb3fce4d37eb 2801 ispell_3.4.00-1.dsc
 5dc42e458635f218032d3ae929528e5587b1e7247564f0e9f9d77d5ccab7aec2 638770 ispell_3.4.00.orig.tar.gz
 a46e49e09c2dbd3a95b796aa6e91b5cd6fcf34488a77e4c1bc8365f972e83235 40520 ispell_3.4.00-1.debian.tar.xz
 f9b820945976c371d9f18343d297b65c8f389a39235aa2e81956d8b111b453ce 142228 ispell_3.4.00-1_i386.deb
 d7d92b510abbb669fa2724cc337b4f7f04ec64bcd4c83dafa8f10c10227723f1 29074 ienglish-common_3.4.00-1_all.deb
 9160f3e878abc7c120e8b435cc8f9bcb419a1eab89ce2b21f40d5e575443f66a 188784 iamerican_3.4.00-1_all.deb
 184a5690970425385e635c4a12bb85b6c59c745616b59eafb79d1362f4308fd9 189160 ibritish_3.4.00-1_all.deb
 5f012e5d40041668e6dfd2cf21bb43f9dee3ecab73d5167576c6e814907aff06 94512 iamerican-small_3.4.00-1_all.deb
 d5474db3a5c7e0ea60b35e4979422502584b91cc34457ac21c889a2746efb36c 94782 ibritish-small_3.4.00-1_all.deb
 7ebaef813e4b2721292165ca07915823443ff95c114af6d7aec5d195053cfe76 365676 iamerican-large_3.4.00-1_all.deb
 9754443133be78baaef1bacf881229e3cbb15e4c1a67c41d77ac3750c411a28e 366570 ibritish-large_3.4.00-1_all.deb
 90b3e0dd700a7793833a3290dfa946292aca40f7870dd0af8ff8f6377c4b2e55 634414 iamerican-huge_3.4.00-1_all.deb
 7d68671f804cbe07f2a4668d1e9ce1c59bd754aab662b8a23e2ac67e044b996a 636048 ibritish-huge_3.4.00-1_all.deb
 4d386355d71eff545f945392ec5ec41db13c517fb288b3eda9be253f8177e968 1291216 iamerican-insane_3.4.00-1_all.deb
 cab412c3521daa58ba659a668df224ae1ca4e2f1614b51a3e80bf969006ebad6 1293900 ibritish-insane_3.4.00-1_all.deb
Files:
 f4bec46d296897e2729f22b338f81452 2801 text optional ispell_3.4.00-1.dsc
 051c0946858e15797aed999b21276226 638770 text optional ispell_3.4.00.orig.tar.gz
 30e51e443975fcb16ad4deac6d5f7b36 40520 text optional ispell_3.4.00-1.debian.tar.xz
 87d779282da9a043b4d5de8b314c16a2 142228 text optional ispell_3.4.00-1_i386.deb
 440ecc947b6d2cf711eef9329d5b0f27 29074 text optional ienglish-common_3.4.00-1_all.deb
 8adc57ce01b3976571cb11531e6a364b 188784 text optional iamerican_3.4.00-1_all.deb
 1f161306334881161b53462983985675 189160 text optional ibritish_3.4.00-1_all.deb
 0f48fb5569120c7300074efbcc929ce3 94512 text optional iamerican-small_3.4.00-1_all.deb
 7fb56c305ba41b20b74cb7b355229554 94782 text optional ibritish-small_3.4.00-1_all.deb
 1d353015a65ba92c5d39bebd4562b256 365676 text optional iamerican-large_3.4.00-1_all.deb
 6021542de4fb4632b12a67618cd9c57f 366570 text optional ibritish-large_3.4.00-1_all.deb
 40e327dba3c36513b8cede96f14197c2 634414 text optional iamerican-huge_3.4.00-1_all.deb
 955ae190845c7baff473512f4d965bdd 636048 text optional ibritish-huge_3.4.00-1_all.deb
 ca3772e534cd04f02304fc564a772b67 1291216 text optional iamerican-insane_3.4.00-1_all.deb
 bec032d4dfa6296d572421c8c30b894d 1293900 text optional ibritish-insane_3.4.00-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJVDUVCAAoJEGMd51U76K/UPrAP/2K32WGzyd+yWPTYlDH75wyV
AxvLwouR0ySwBpOUH1JDkVs9rSC56UdjZMfIcEOdM5MG8T4uH+H2xIwuhH31fE9f
WmRb3JXYGt6pyg/aib+EsIYTehCpfFBPQrR8dR0onpfWNcv45jnVGarnFik8Cj+3
KDP1/1SELG6AXitg3f4LhWu7CLgUULOpQz1FG8JSaXfVnj3/YZmviyTPOdYk/x8A
+5o5uVTh1VzhTMPvuzZGeyXDQPkzHjBqE60epvOol1j3kIh+PyKpH/gAo0eCF8BR
5t1fHyEpYQhVxoQIlbsQ6Ic1qNUODxgd1/r6KaTQOq2gm4QpeKKPVcl/Pet4lh5d
V560P1nlx3seiz5nI8d01VxreeYFq8+qvNNUMaoGWuF9zMZJP67CCWB2oUhzxaUS
fg6sGezbJm19RmjPhdGFbhjEyRKvcBVlUAjljUa5Lk9vi6h1qIlrTwSw82D4CmF5
JX9ihCE8kxHOKc4yps+3K2gMYKZPjnrexTs2YUbcV93tGVhNuzdkBNHfQZgnrYfF
NDsfTFi4PDPLtDwhKLydupobd1BiSBfIXQegfAPgFHyzgtfGBlEaw/+kC+GxIcAK
bKVJ+mjOm422aiuRQ8s0XpGpoq/RVoZwPQcqDodeIMTHocs3t1cnowfCsUdhWc0W
dm2xAb7m6xKZTbhQswlM
=Hlwm
-----END PGP SIGNATURE-----

Message #33 received at 778862@bugs.debian.org (full text, mbox, reply):

From: Jérémy Bobbio <lunar@debian.org>

To: 778862@bugs.debian.org

Cc: Reiner Herrmann <reiner@reiner-h.de>

Subject: Re: Bug#778862 closed by Robert Luberda <robert@debian.org> (Bug#778862: fixed in ispell 3.4.00-1)

Date: Tue, 23 Feb 2016 13:00:42 +0100

[Message part 1 (text/plain, inline)]

Control: reopen -1

Hi!

Debian Bug Tracking System:
> This is an automatic notification regarding your Bug report
> which was filed against the src:ispell package:
> 
> #778862: ispell: please make building .hash files reproducible

Sorry but the issue still exists. For example, iitalian still has the
following difference:

│   ├── data.tar.xz
│   │   ├── data.tar
│   │   │   ├── ./usr/lib/ispell/italian.hash
│   │   │   │ @@ -80871,15 +80871,15 @@
│   │   │   │  0013be60: 6cc8 0500 0000 0000 c000 0000 0000 0004  l...............
│   │   │   │  0013be70: ec90 0000 0000 0000 73c8 0500 0000 0000  ........s.......
│   │   │   │  0013be80: 0000 0000 0000 0004 ffff ffff ffff ffff  ................
│   │   │   │  0013be90: 7ec8 0500 0000 0000 0100 0000 0000 0004  ~...............
│   │   │   │  0013bea0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
│   │   │   │  0013beb0: 0000 0000 0000 0000 ffff ffff ffff ffff  ................
│   │   │   │  0013bec0: ffff ffff ffff ffff 0000 0000 0000 0000  ................
│   │   │   │ -0013bed0: 0000 0000 0000 0000 30c6 d900 0000 0000  ........0.......
│   │   │   │ +0013bed0: 0000 0000 0000 0000 30e6 3c02 0000 0000  ........0.<.....
│   │   │   │  0013bee0: 0600 0100 0000 0200 0100 0000 0000 0000  ................

https://tests.reproducible-builds.org/dbdtxt/unstable/amd64/iitalian_2.3-3.diffoscope.txt

I've verified that the uninitialized bytes above are written when writing
`sflaglist`: https://sources.debian.net/src/ispell/3.4.00-4/buildhash.c/?hl=402:403#L402

-- 
Lunar                                .''`. 
lunar@debian.org                    : :Ⓐ  :  # apt-get install anarchism
                                    `. `'` 
                                      `-   

[signature.asc (application/pgp-signature, inline)]

Message #42 received at 778862-close@bugs.debian.org (full text, mbox, reply):

From: Robert Luberda <robert@debian.org>

To: 778862-close@bugs.debian.org

Subject: Bug#778862: fixed in ispell 3.4.00-5

Date: Fri, 04 Mar 2016 07:50:17 +0000

Source: ispell
Source-Version: 3.4.00-5

We believe that the bug you reported is fixed in the latest version of
ispell, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 778862@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Robert Luberda <robert@debian.org> (supplier of updated ispell package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 04 Mar 2016 08:34:01 +0100
Source: ispell
Binary: ispell ienglish-common iamerican ibritish iamerican-small ibritish-small iamerican-large ibritish-large iamerican-huge ibritish-huge iamerican-insane ibritish-insane
Architecture: source
Version: 3.4.00-5
Distribution: unstable
Urgency: medium
Maintainer: Robert Luberda <robert@debian.org>
Changed-By: Robert Luberda <robert@debian.org>
Description:
 iamerican  - American English dictionary for ispell (standard version)
 iamerican-huge - American English dictionary for ispell (huge)
 iamerican-insane - American English dictionary for ispell (insane version)
 iamerican-large - American English dictionary for ispell (large)
 iamerican-small - American English dictionary for ispell (small)
 ibritish   - British English dictionary for ispell (standard version)
 ibritish-huge - British English dictionary for ispell (huge)
 ibritish-insane - British English dictionary for ispell (insane version)
 ibritish-large - British English dictionary for ispell (large)
 ibritish-small - British English dictionary for ispell (small)
 ienglish-common - Common files for British and American ispell dictionaries
 ispell     - International Ispell (an interactive spelling corrector)
Closes: 778862 815160 816572
Changes:
 ispell (3.4.00-5) unstable; urgency=medium
 .
   * Add 0035-Force-text-grep-in-munchlist.patch to pass the `-a' flag to grep
     invocations not to fail on national characters (closes: #816572, #815160).
   * Add 0036-Reproducible-hashes.patch to hopefully make builds of hashes
     reproducible (closes: #778862).
   * debian/rules: Enable all hardening flags.
   * debian/control:
     + use https for Vcs-Browser field;
     + bump Standards-Version to 3.9.7.
Checksums-Sha1:
 1f4cf743d653826a382538980cd453c52722db4d 2802 ispell_3.4.00-5.dsc
 6eaa0bc3394b6f0158492c843efef4497c534bb0 42196 ispell_3.4.00-5.debian.tar.xz
Checksums-Sha256:
 498ba2e393c834478df0895d8e19f7eb099d2fc73ee9bb943c0547be99acacf0 2802 ispell_3.4.00-5.dsc
 4e567e254de66aec0cab74ebbff277f44938da1d5c35113c8ee428b2c1c3a523 42196 ispell_3.4.00-5.debian.tar.xz
Files:
 cfb7ddeccd8e882b59202486b115d4d1 2802 text optional ispell_3.4.00-5.dsc
 ca40842a5ee90eb40d3d1b8bf83a71bb 42196 text optional ispell_3.4.00-5.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW2TuXAAoJEGMd51U76K/U+FkP+weHlgvDfK+5hMX2bvhaCQLa
83OlHI2tlkFBJDvX/HPYwmh4Z2D3RICufho7+3RtXtS3UThJyDKZFLZy/wR9Wf8v
g6SJHWeiWBrvPWXtYumcN1hpXx6mpO2CAkOuVJ/Xn1+EDnAT4YUjMZWeveoU9Zix
pLcPCKgQ36V1BD2uv0EMjAoSUgaSDmzPR7hE3UwxHcjvdb0EXIAcLaMKZICzGXBC
wVbqHDPobGwi8/z4JoBibji9YWQAAZEUT+zrPOCcGHLTilIyunqtNw5caOt5uzGp
QGxi2+fZmVTjEUf/C/sW4aUaDPdDTa4mR/ZxxGjA9it3aaCRQ4zWduMJeVEnPkXa
OfRtqQFkNSFL0FbSjD2C7zsRxmbNJYRLSfQwRMkEjNTkwg5deebUwgxiY4LL6bIc
vmssq8u4dnU1/Ue2ye0zrszidiurOM5vlGHlIBODbkj+ZZ5w/j2NdhSaZ9ozLlVo
fkRFOPq8fgwWy8IYbYDnVsiwV3PN3UbUU8VQlyOyDgZrkGDiCVFCp/V4obmRGtOh
mo7wv+VlNNY2yPynhiC8oHYzXn3h/ZrDXEHlkiheP/X6e+DG6LEX1ijDm9u3oCOx
WslnKmxLZHgW73ZQ++7/z9rMOFUYMLjpnkSXN817r1BwFI3XM+kbJ7ZAXhYfOqRT
FyQyMOYwvUgnzaxapX3i
=RsJb
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.