Debian Bug report logs - #823123
libusb: debian/rules uses unportable shell constructs; please make the build reproducible (shell)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Daniel Shahaf <danielsh@apache.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libusb: debian/rules uses unportable shell constructs; please make the build reproducible (shell)

Date: Sun, 1 May 2016 01:49:00 +0000 (UTC)

Package: libusb
Version: 0.1.12
Severity: minor
User: reproducible-builds@lists.alioth.debian.org
Usertags: environment

Dear Maintainer,

While working on the “reproducible builds” effort [1], we have noticed
that libusb could not be built reproducibly; the diff between two builds
is:

    # https://tests.reproducible-builds.org/rb-pkg/unstable/amd64/libusb.html
    ├── ./usr/lib/x86_64-linux-gnu/libusb.so
    │ @@ -1,3 +1 @@
    │ -/* GNU ld script.  */
    │ -GROUP ( /lib/x86_64-linux-gnu/libusb-0.1.so.4.4.4 )
    │ -
    │ +/* GNU ld script.  */\nGROUP ( /lib/x86_64-linux-gnu/libusb-0.1.so.4.4.4 )\n

This difference is down to debian/rules calling echo(1) with an argument
that contains a literal backslash.  The behaviour of echo(1) in that
case is (according to POSIX) implementation-defined.  Since debian/rules
uses echo(1) from the building user's shell, the build output differs
when the building user uses SHELL=bash v. SHELL=dash:

    % LC_ALL=C dash -c 'echo "foo\nbar"' 
    foo
    bar
    % LC_ALL=C bash -c 'echo "foo\nbar"' 
    foo\nbar
    % 

The following patch removes the use of implementation-defined behaviour:

[[[
diff --git a/debian/rules b/debian/rules
index c51241b..af1d9db 100755
--- a/debian/rules
+++ b/debian/rules
@@ -23,7 +23,7 @@ override_dh_auto_install-arch:
        mv $(CURDIR)/debian/tmp-deb/usr/lib/$(DEB_HOST_MULTIARCH)/libusb-0.1.so.* \
           $(CURDIR)/debian/tmp-deb/lib/$(DEB_HOST_MULTIARCH)
        rm $(CURDIR)/debian/tmp-deb/usr/lib/$(DEB_HOST_MULTIARCH)/libusb.so
-       echo "/* GNU ld script.  */\nGROUP ( /lib/$(DEB_HOST_MULTIARCH)/libusb-0.1.so.4.4.4 )\n" \
+       printf "/* GNU ld script.  */\nGROUP ( /lib/%%s/libusb-0.1.so.4.4.4 )\n" "$(DEB_HOST_MULTIARCH)" \
                > $(CURDIR)/debian/tmp-deb/usr/lib/$(DEB_HOST_MULTIARCH)/libusb.so
        dh_auto_install --builddirectory build-udeb --destdir=$(CURDIR)/debian/tmp-udeb
]]]

This patch should also make the build reproducible, but I didn't test that.

Note that when built under bash, the .so file contains a literal «\n»
sequence (two bytes).  I'm assuming that might have user-visible
consequences but I don't know what exactly they would be.

Cheers,

Daniel

Message #14 received at 823123-close@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurel32@debian.org>

To: 823123-close@bugs.debian.org

Subject: Bug#823123: fixed in libusb 2:0.1.12-29

Date: Sun, 01 May 2016 16:23:22 +0000

Source: libusb
Source-Version: 2:0.1.12-29

We believe that the bug you reported is fixed in the latest version of
libusb, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 823123@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated libusb package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 01 May 2016 17:00:14 +0200
Source: libusb
Binary: libusb-0.1-4 libusb-dev libusb-0.1-udeb
Architecture: source
Version: 2:0.1.12-29
Distribution: unstable
Urgency: medium
Maintainer: Aurelien Jarno <aurel32@debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Description:
 libusb-0.1-4 - userspace USB programming library
 libusb-0.1-udeb - userspace USB programming library (udeb)
 libusb-dev - userspace USB programming library development files
Closes: 820510 823123
Changes:
 libusb (2:0.1.12-29) unstable; urgency=medium
 .
   * Drop packages providing the C++ library. It is unused in the archive
     and new developments should use libusb 1.0 instead (closes: #820510).
   * Use portable shell construct in debian/rules, thanks to Daniel Shahaf for
     the patch (closes: #823123).
   * Bump Standards-Version to 3.9.8 (no changes).
Checksums-Sha1:
 580baa419946e0ec78011bd43e723887dc14dfc5 1876 libusb_0.1.12-29.dsc
 d0568cec5053e30ca3e530bd29f1ad56cf9f8b63 21476 libusb_0.1.12-29.debian.tar.xz
Checksums-Sha256:
 a96a5e006a42c3e6c94e3c12f04427b918c0141998faff8f3de33cbfd4a4ce66 1876 libusb_0.1.12-29.dsc
 41dbb3670dc6995a300f7fd4fa3ef3c5e9995cb2a38ba600888c770382ba84b0 21476 libusb_0.1.12-29.debian.tar.xz
Files:
 838b922c1989ad797157f0303ca4c3f2 1876 libs optional libusb_0.1.12-29.dsc
 42c0ad7ba7a93a87897c43a32cb498cf 21476 libs optional libusb_0.1.12-29.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJXJhoKAAoJELqceAYd3YybmfMP/RBKxTiMEC6ZCDFZWXytPcp1
OOclYEcOLyv1q6V0zFruB3QO2PUNSVljZqs7nfgrggoiIbBpB6Ny3yQXrH6ahGL2
d16RDQt1XWvu1f4X5BoiiFgy6y3WH8/jqxKR180jJcdRfwruBV9KgCrfv/PJyFpJ
Y/pZb0DpczYaTE/UK47iHX1hSth0auP/9wOVc8hhD5nXdS6UCoOKyjqUauLEoPpQ
b6Xs+f+uhbZrdw5njZatzcLCSw2BtWADVx5p/xkgEcKs0aqyJHJHBm/OYb6S1bv9
I1MMVG2WMRcCTUdOcQsOFTbm9ft1TcmWNuIj7hWe+d+PgdkrUJuHy2ow/ZP0MShy
r071dGlkwHrtarjA+CgB54+xAQQYCxHmBIWFVfJDGO/F4gtxJcNYrbi7577KSfW0
FWcT505EL2Fo3WjYycaorSu1Lp+yeeRYYppNMSix2DSya0QJduYSgTPo0/3gMEuP
l9RljEfXxgL7JFtnsF7h/gGEY5/M3N2MnBn+ysFfqdzevD7GGWL2euLgucxeokVr
YbGc72OjQDplSrobSGpZGtu3QGwpe7lklQiqpNLnu5Bgcb/d++5iY9ftG/a9te39
MHOKZDWc4MpO06TiVrZNDPr5ncMnds7kONASsD+LGcyeWN0IFyMEGNj2syi3MvKg
8/y/rllQ8xK9ugFA4zXH
=wTOV
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.