Debian Bug report logs - #958301
dh-cargo: please make the output reproducible

[Message part 1 (text/plain, inline)]
Source: dh-cargo
Version: 23
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: buildpath toolchain
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0] we noticed that
dh-cargo generates/installs non-reproducible output. For example,
here is rust-difference 2.0.0-1:

│ │ │ ├── ./usr/.crates2.json
│ │ │ │ │ @@ -1,10 +1,10 @@
│ │ │ │ │  {
│ │ │ │ │      "installs": {
│ │ │ │ │ -        "difference 2.0.0 (path+file:///build/1st/rust-difference-2.0.0)": {
│ │ │ │ │ +        "difference 2.0.0 (path+file:///build/2/rust-difference-2.0.0/2nd)": {

Proof-of-concept patch attached that strips all these files. It might
be better to do this elsewhere, up to you.

  --- a/cargo.pm
  +++ b/cargo.pm
  @@ -170,6 +170,7 @@ sub install {
           my $destdir = $ENV{'DESTDIR'} || $this->get_sourcepath("debian/" . $this->{binpkg});
           doit("env", "DESTDIR=$destdir",
                "/usr/share/cargo/bin/cargo", "install", @_);
  +        doit('find', $destdir, '-name', '.crates2.json', '-exec', 'rm', '{}', '+');
           # generate Built-Using fields         

Note that this file is being installed to /usr (!) which is likely a
pretty severe bug here or in rust-difference, but I'll leave that
with you.

  [0] https://reproducible-builds.org/

Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

[dh-cargo.diff.txt (text/plain, attachment)]
Source: cargo
Source-Version: 0.43.1-2
Done: Ximin Luo <infinity0@debian.org>

We believe that the bug you reported is fixed in the latest version of
cargo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 958301@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ximin Luo <infinity0@debian.org> (supplier of updated cargo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 20 Apr 2020 13:30:57 +0100
Source: cargo
Architecture: source
Version: 0.43.1-2
Distribution: unstable
Urgency: medium
Maintainer: Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed-By: Ximin Luo <infinity0@debian.org>
Closes: 958301
Changes:
 cargo (0.43.1-2) unstable; urgency=medium
 .
   * cargo-debian-wrapper: don't install /usr/.crates2.json. (Closes: #958301)
Checksums-Sha1:
 8af3c857613273f08a5a04bc9a444b58bada8363 1980 cargo_0.43.1-2.dsc
 00b9616de0bf6e418cc02ac6add696dba9487a0c 40460 cargo_0.43.1-2.debian.tar.xz
 7af0414d412e9627b73a24a517b4ad7e6ad1f574 7221 cargo_0.43.1-2_source.buildinfo
Checksums-Sha256:
 31ed2a4254f0904ed2ebb2688f127eed8529a6023b3c923709f39a15abf10bb1 1980 cargo_0.43.1-2.dsc
 72d99026a22b151c4e66aa94cc478bf4c60610f8aad32e437bd60ede1d494d6b 40460 cargo_0.43.1-2.debian.tar.xz
 5b23a66264c502d8d407f47f808d19479fdb98f902e19c186a46c8c44775ba04 7221 cargo_0.43.1-2_source.buildinfo
Files:
 351c4a57d620444a2a8eb181a92eebe1 1980 devel optional cargo_0.43.1-2.dsc
 ee82fe0f8d83fee1b1fa4db48e1e2f56 40460 devel optional cargo_0.43.1-2.debian.tar.xz
 51a81287d189c545a308b28e3d34bb56 7221 devel optional cargo_0.43.1-2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQReYinNQ9GpZ9TYcRrrH8jaRfspMAUCXp2WLgAKCRDrH8jaRfsp
MB8pAP91m7ckS6s6/VLLN1zl5e9OJQcVqQZd18UkuQ/8/GauBwD+IP21Bwf9IVUg
d/baONfMEKmBSl+NK2iEGL4nI40oWAY=
=t+/r
-----END PGP SIGNATURE-----

Thanks, the file in /usr indeed should not be there and should be fixed in the next cargo upload, 0.43.1-2.

Yes, the boundary between dh-cargo and cargo-debian-wrapper (which lives in cargo) is a bit unclear and some of it is derived from historical reasons, this can certainly be improved in the future.

X

Chris Lamb:
> Source: dh-cargo
> Version: 23
> Severity: wishlist
> Tags: patch
> User: reproducible-builds@lists.alioth.debian.org
> Usertags: buildpath toolchain
> X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org
> 
> Hi,
> 
> Whilst working on the Reproducible Builds effort [0] we noticed that
> dh-cargo generates/installs non-reproducible output. For example,
> here is rust-difference 2.0.0-1:
> 
> │ │ │ ├── ./usr/.crates2.json
> │ │ │ │ │ @@ -1,10 +1,10 @@
> │ │ │ │ │  {
> │ │ │ │ │      "installs": {
> │ │ │ │ │ -        "difference 2.0.0 (path+file:///build/1st/rust-difference-2.0.0)": {
> │ │ │ │ │ +        "difference 2.0.0 (path+file:///build/2/rust-difference-2.0.0/2nd)": {
> 
> Proof-of-concept patch attached that strips all these files. It might
> be better to do this elsewhere, up to you.
> 
>   --- a/cargo.pm
>   +++ b/cargo.pm
>   @@ -170,6 +170,7 @@ sub install {
>            my $destdir = $ENV{'DESTDIR'} || $this->get_sourcepath("debian/" . $this->{binpkg});
>            doit("env", "DESTDIR=$destdir",
>                 "/usr/share/cargo/bin/cargo", "install", @_);
>   +        doit('find', $destdir, '-name', '.crates2.json', '-exec', 'rm', '{}', '+');
>            # generate Built-Using fields         
> 
> Note that this file is being installed to /usr (!) which is likely a
> pretty severe bug here or in rust-difference, but I'll leave that
> with you.
> 
> 
>   [0] https://reproducible-builds.org/
> 
> 
> Regards,
> 
> 
> _______________________________________________
> Pkg-rust-maintainers mailing list
> Pkg-rust-maintainers@alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-rust-maintainers
> 

-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git

Debian Bug report logs - #958301 dh-cargo: please make the output reproducible

Debian Bug report logs - #958301
dh-cargo: please make the output reproducible