Debian Bug report logs - #825643
dash: please make the build reproducible

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: submit@bugs.debian.org

Subject: dash: please make the build reproducible

Date: Sat, 28 May 2016 14:17:30 +0200

[Message part 1 (text/plain, inline)]

Source: dash
Version: 0.5.8-2.2
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: locale
X-Debbugs-Cc: reproducible-builds@lists.alioth.debian.org

Hi!

While working on the "reproducible builds" effort [1], we have noticed
that dash could not be built reproducibly.
The script src/mkbuiltins is used to generate a C file (builtins.c).
The order of elements in the struct builtincmd is varying because they
are not sorted locale-independently.

The attached patch fixes this by setting LC_ALL instead of LC_COLLATE to C.

Regards,
 Reiner

[1]: https://wiki.debian.org/ReproducibleBuilds

[dash.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 825643@bugs.debian.org (full text, mbox, reply):

From: HW42 <hw42@ipsumj.de>

To: 825643@bugs.debian.org, Reproducible Builds discussion list <reproducible-builds@lists.alioth.debian.org>

Cc: Reiner Herrmann <reiner@reiner-h.de>

Subject: Re: [Reproducible-builds] Bug#825643: dash: please make the build reproducible

Date: Mon, 13 Jun 2016 02:16:07 +0200

[Message part 1 (text/plain, inline)]

Hi,

in addition to the sorting problem found by Reiner dash is also not
reproducible since it indirectly captures the shell used as /bin/sh.

The problem is that that dash sets argv[0] to the relative path if
'exec' is called with a relative path and bash sets argv[0] to the
absolute path. When executing 'exec configure' in debian/rules argv[0]
gets captured by the configure script as $srcdir which is later used in
$DEFAULT_INCLUDES and passed to gcc. This leads to different build-ids
depending on the choice of /bin/sh.

The attached patch fix this by simply avoiding the exec call.

Thanks, HW42

[fix-unreproducible-configure-call.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 825643@bugs.debian.org (full text, mbox, reply):

From: Ximin Luo <infinity0@debian.org>

To: Debian Bug Tracking System <825643@bugs.debian.org>

Subject: Re: dash: please make the build reproducible

Date: Wed, 28 Jun 2017 18:34:23 +0200

[Message part 1 (text/plain, inline)]

Package: src:dash
Followup-For: Bug #825643

Hi, I've uploaded this to DELAYED/14.

The patch is attached, it's just a combined version of what the previous two
bug reporters submitted, plus a changelog.

X

-- System Information:
Debian Release: 9.0
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (300, 'unstable'), (200, 'experimental'), (1, 'experimental-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

[dash_0.5.8-2.5.debdiff (text/plain, attachment)]

Message #20 received at 825643-close@bugs.debian.org (full text, mbox, reply):

From: Ximin Luo <infinity0@debian.org>

To: 825643-close@bugs.debian.org

Subject: Bug#825643: fixed in dash 0.5.8-2.5

Date: Wed, 12 Jul 2017 17:33:58 +0000

Source: dash
Source-Version: 0.5.8-2.5

We believe that the bug you reported is fixed in the latest version of
dash, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 825643@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ximin Luo <infinity0@debian.org> (supplier of updated dash package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 28 Jun 2017 18:26:52 +0200
Source: dash
Binary: dash ash
Architecture: source
Version: 0.5.8-2.5
Distribution: unstable
Urgency: low
Maintainer: Gerrit Pape <pape@smarden.org>
Changed-By: Ximin Luo <infinity0@debian.org>
Description:
 ash        - compatibility package for dash
 dash       - POSIX-compliant shell
Closes: 825643
Changes:
 dash (0.5.8-2.5) unstable; urgency=low
 .
   * Non-maintainer upload.
 .
   [ Reiner Herrmann ]
   * Improve build reproducibility: set LC_ALL instead of LC_COLLATE to C.
 .
   [ HW42 ]
   * Improve build reproducibility: avoid exec call which embeds different paths
     between different system shells. (Closes: #825643)
Checksums-Sha1:
 5b2e12c7d081105784f616da210e128c85df3cec 1807 dash_0.5.8-2.5.dsc
 0abc579d0086d56ee86bdc8961a3fce7b9e6ed41 44513 dash_0.5.8-2.5.diff.gz
 9f259c54e139f2b97ee173870b46cfbc2dce5501 4648 dash_0.5.8-2.5_source.buildinfo
Checksums-Sha256:
 42e77c37a5a4db1cc8274c3183d83e7173883cc611339815d92358562b74d066 1807 dash_0.5.8-2.5.dsc
 53f55bbcb327b0e2dd687c44bf0610f5e304dd00733c81c101be46e0adf8ec89 44513 dash_0.5.8-2.5.diff.gz
 99dc80ed08973f67f865c6480af1311ece4972ab5cb93447cbbf6ee9efbc5042 4648 dash_0.5.8-2.5_source.buildinfo
Files:
 55b608318ff0cb5f372a8a0d39a68b5a 1807 shells optional dash_0.5.8-2.5.dsc
 80c4d4392d71f32347fdcdd7188ad794 44513 shells optional dash_0.5.8-2.5.diff.gz
 359441572a0727bb48f0931b200314aa 4648 shells optional dash_0.5.8-2.5_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJJBAEBCgAzFiEENmdIajJtsnZtJVVGhg3vO49lC3kFAllT2ZgVHGluZmluaXR5
MEBkZWJpYW4ub3JnAAoJEIYN7zuPZQt5QhkQAI2v1AmjTflcPlnho8bW7OoSF6KH
NwO+ttaUtVAPiZhV9+ewxfc07bOvkjLClUuRAcjEIz1XQmMdLXKnSqAA5TLi3nde
bSgiVZZDGs1s6Yy4hMNKRvOIWtSjudekzrG3VUQJuf4cemnKp93UmE1eFWQES6eM
xi4TfaTVzz4gNEqcWyTvPOrhDJKfV75NUGX2fummyMhoFqvbqf5cRxSfIzTvubxK
d72Y3X3Zx+EEpjk4x0v+Bx6CtMNB/DCo+P5MlcLFz8l0O3NE+n88FfJvKzlp6bSu
cLp/POv+x7rmKluWboaFUXROerp9EP7hXgP9RnFnavb46KzeguYHSD5BqOTgveox
nxeG7Iz2DfNNXDMmlyCQiFNLPzWKKpPqHuy0OlmMbTfUZgyGkidS9blTWuDS3EVg
oAPs9H030ie54htWwE6r/96B1DEnJEBW+ykMh+SSSXQXIge0JjlY4ye8gwC5vHDl
ARqtxplAojtdr0KN4TUTwqbGPEeeOKncJ5uUZ56ZiLKMnM+DQh1QrlJ82ydh/1Sd
nUJjZE2KA9kjrQxPDnKM0KRqdKNI0js7/ce1djbh/BNDI+/EzTI0e0G5PTptTCxA
K+i/0Qqe2PKLHnqcQYUVlWm8/l9j97eFb4S/+OzU8tFdrjMCziHvYJlcJK3SA4kO
rqoc2AZtV3EQNEYi
=+LMj
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.