Debian Bug report logs - #952762
openstack-pkg-tools: please make the build reproducible

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: submit@bugs.debian.org

Subject: openstack-pkg-tools: please make the build reproducible

Date: Fri, 28 Feb 2020 10:15:20 -0800

[Message part 1 (text/plain, inline)]

Source: openstack-pkg-tools
Version: 108
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: toolchain
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0] we noticed that
openstack-pkg-tools is causing other packages to be built in an
unreproducible manner.

In particular, the "/usr/bin/pkgos-dh_auto_install" script may nondeterministically create packages with differing shebangs and binary dependencies. For example, this is from src:redfishtool:

│ -#!/usr/bin/python3.7
│ +#!/usr/bin/python3.8

[…]

│ │ │ │ -Depends: python3-requests, python3.8:any, python3:any
│ │ │ │ +Depends: python3-requests, python3.7:any, python3:any

§

This is caused by a number of layered reasons. First, we are building
all supported Python versions (eg. Python 3.7 and Python 3.8) in
separate directories but then seqeuentially installing them to the
same destination, debian/${TARGET_DIR}.

However, this causes problems because if latter installations complete
in less than one second, distutils may decide to skip copying files in
the shared destination as it incorrectly believes them to be up-to-
date. This will result in a package arbitrarily containing scripts
with different version shebangs depending on the approximate total
execution speed of installation. This is, needless to say,
nondeterminstic.

For example, if we build for both Python 3.7 and Python 3.8 but the
installation of the latter occurs within the same wall clock second of
the former, the Python 3.8 version will not overwrite the Python 3.7
verison and lead to a shebang of #!/usr/bin/python3.7 … whilst if it
does not occur within the same second, the shebang will be overwritten
to #!/usr/bin/python3.8.

A patch is attached that passes --force to `setup.py install [..]`
which will avoid the underlying calls to distutils's `dep_util.newer`
and thus will always update.

  [0] https://reproducible-builds.org/


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

[openstack-pkg-tools.diff.txt (text/plain, attachment)]

Message #10 received at 952762@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>

To: Chris Lamb <lamby@debian.org>, 952762@bugs.debian.org

Subject: Re: Bug#952762: openstack-pkg-tools: please make the build reproducible

Date: Sat, 29 Feb 2020 01:41:33 +0100

On 2/28/20 7:15 PM, Chris Lamb wrote:
> Source: openstack-pkg-tools
> Version: 108
> Severity: wishlist
> Tags: patch
> User: reproducible-builds@lists.alioth.debian.org
> Usertags: toolchain
> X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org
> 
> Hi,
> 
> Whilst working on the Reproducible Builds effort [0] we noticed that
> openstack-pkg-tools is causing other packages to be built in an
> unreproducible manner.
> 
> In particular, the "/usr/bin/pkgos-dh_auto_install" script may nondeterministically create packages with differing shebangs and binary dependencies. For example, this is from src:redfishtool:
> 
> │ -#!/usr/bin/python3.7
> │ +#!/usr/bin/python3.8
> 
> […]
> 
> │ │ │ │ -Depends: python3-requests, python3.8:any, python3:any
> │ │ │ │ +Depends: python3-requests, python3.7:any, python3:any
> 
> §
> 
> This is caused by a number of layered reasons. First, we are building
> all supported Python versions (eg. Python 3.7 and Python 3.8) in
> separate directories but then seqeuentially installing them to the
> same destination, debian/${TARGET_DIR}.
> 
> However, this causes problems because if latter installations complete
> in less than one second, distutils may decide to skip copying files in
> the shared destination as it incorrectly believes them to be up-to-
> date. This will result in a package arbitrarily containing scripts
> with different version shebangs depending on the approximate total
> execution speed of installation. This is, needless to say,
> nondeterminstic.
> 
> For example, if we build for both Python 3.7 and Python 3.8 but the
> installation of the latter occurs within the same wall clock second of
> the former, the Python 3.8 version will not overwrite the Python 3.7
> verison and lead to a shebang of #!/usr/bin/python3.7 … whilst if it
> does not occur within the same second, the shebang will be overwritten
> to #!/usr/bin/python3.8.
> 
> A patch is attached that passes --force to `setup.py install [..]`
> which will avoid the underlying calls to distutils's `dep_util.newer`
> and thus will always update.
> 
>   [0] https://reproducible-builds.org/
> 
> 
> Regards,

Hi Chris!

This is very nice, but in fact, having python3.8 or python3.7, can be
considered as a bug in the packages I maintain. Indeed, what it means is
that the package is missing:

override_dh_python3:
        dh_python3 --shebang=/usr/bin/python3

Without this, the package incorrectly will have python3.x as dependency
instead of python3:any.

Do I understand well that you saw this in redfishtool? In such case,
that's where the bug should be filled, IMO.

Your thoughts?
Cheers,

Thomas Goirand (zigo)

Message #15 received at 952762@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: "Thomas Goirand" <zigo@debian.org>, 952762@bugs.debian.org

Subject: Re: Bug#952762: openstack-pkg-tools: please make the build reproducible

Date: Sun, 01 Mar 2020 01:57:03 -0000

Hi Thomas,

 > Do I understand well that you saw this in redfishtool? In such case,
> that's where the bug should be filled, IMO.

I think have two issues here. This one (ie. the timing problem) in
openstack-pkg-tools is still something that should be fixed,
regardless of what other packages do IMHO.

> This is very nice, but in fact, having python3.8 or python3.7, can be
> considered as a bug in the packages I maintain. Indeed, what it means is
> that the package is missing:
> 
> override_dh_python3:
>         dh_python3 --shebang=/usr/bin/python3

This sounds logical. However, would this not be better fixed centrally
for *all* packages that use /usr/share/openstack-pkg-tools/pkgos.make
rather than add the following snippet to redfishtool? I don't see this
package doing anything particularly special, and making this change in
every leaf package doesn't seem very elegant to me.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org 🍥 chris-lamb.co.uk
       `-

Message #20 received at 952762@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>

To: Chris Lamb <lamby@debian.org>, 952762@bugs.debian.org

Subject: Re: Bug#952762: openstack-pkg-tools: please make the build reproducible

Date: Mon, 2 Mar 2020 15:04:16 +0100

On 3/1/20 2:57 AM, Chris Lamb wrote:
> Hi Thomas,
> 
>  > Do I understand well that you saw this in redfishtool? In such case,
>> that's where the bug should be filled, IMO.
> 
> I think have two issues here. This one (ie. the timing problem) in
> openstack-pkg-tools is still something that should be fixed,
> regardless of what other packages do IMHO.
> 
>> This is very nice, but in fact, having python3.8 or python3.7, can be
>> considered as a bug in the packages I maintain. Indeed, what it means is
>> that the package is missing:
>>
>> override_dh_python3:
>>         dh_python3 --shebang=/usr/bin/python3
> 
> This sounds logical. However, would this not be better fixed centrally
> for *all* packages that use /usr/share/openstack-pkg-tools/pkgos.make
> rather than add the following snippet to redfishtool? I don't see this
> package doing anything particularly special, and making this change in
> every leaf package doesn't seem very elegant to me.
> 
> 
> Regards,

The problem is, some package may need to customize dh_python3 calls even
further. For example:

override_dh_python3:
    dh_python3 --shebang=/usr/bin/python3
    dh_python3 /usr/share/foo

if there's some Python files in /usr/share/foo

So there's no "one fit all" solution. Or do you have a suggestion here?

Cheers,

Thomas Goirand (zigo)

Message #25 received at 952762@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: "Thomas Goirand" <zigo@debian.org>, 952762@bugs.debian.org

Subject: Re: Bug#952762: openstack-pkg-tools: please make the build reproducible

Date: Tue, 03 Mar 2020 01:57:06 -0000

Hi Thomas,

> The problem is, some package may need to customize dh_python3 calls even
> further. For example:
> 
> override_dh_python3:
>     dh_python3 --shebang=/usr/bin/python3
>     dh_python3 /usr/share/foo
> 
> if there's some Python files in /usr/share/foo
> 
> So there's no "one fit all" solution.

May I suggest we keep this bug (ie. #952762) strictly on the non-
determistic nature of the utility methods in openstack-pkg-tools which
exist regardless of the above difficulties. These are two highly
related yet separate issues at work here and I would not feel
comfortable if they got lost, confused with or got blocked by each
other.

Unfortunately, I'm not familar with the ramifications on your quoted
code so I'll have to leave any suggestions on the above to yourself
and/or anybody else involved in maintaining OpenStack in any case.
Thanks for understanding.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org 🍥 chris-lamb.co.uk
       `-

Message #30 received at 952762-done@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>

To: 952762-done@bugs.debian.org

Subject: Closing

Date: Mon, 11 May 2020 09:53:42 +0200

Hi Chris,

I insist: the bug is in each individual package not setting-up the
shebang as they should, it's not in openstack-pkg-tools. I don't feel
like fixing the issue here will make things better, quite the opposite:
instead of finding the issue in the reproducible build, your proposal
will hide it here, keeping the problem active and detected, which gives
a chance to fix the package.

The consequence of having the wrong shebang (ie: a specific version of
python rather than the generic python3) means it's going to be a pain
for those managing the Python 3 transitions: the package who has the
wrong shebang needs to be rebuilt. This *must* be fixed.

Cheers,

Thomas Goirand (zigo)

Send a report that this bug log contains spam.