Debian Bug report logs - #969352
dh-python: pybuild flit: build path included in RECORD file (makes build non reproducible)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Philip Rinn <rinni@inventati.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dh-python: pybuild flit: build path included in RECORD file (makes build non reproducible)

Date: Mon, 31 Aug 2020 23:19:22 +0200

[Message part 1 (text/plain, inline)]

Package: dh-python
Version: 4.20200804
Severity: normal

Hi,

while I was working on packaging solo-python, I noticed, that using the flit
plugin for pybuild results in a RECORD file that includes the build path for a
file

[...]
solo/__pycache__/dfu.cpython-38.pyc,,
solo/fido2/__init__.py,sha256=0e13fe5ec32f9fff284ebe986d9367732bde267280c87f0ff38466e247e696e0,1518
/build/solo-python-0.0.26/debian/solo-
python/usr/bin/solo,sha256=6a0396bfbe0c7eb59498dc99bf08a013ebda611dd573740edaa4ad80961ae1de,91
solo_python-0.0.26.dist-
info/METADATA,sha256=92e4e62ef2ff499a82380ef2180ae39e7c435ce5b5682cf4ee06decc4bdd62cc,6022
[...]

This obviously makes the build unreproducible but might also have other side
effects (as the file mentioned is not present after installation).

I attached the full RECORD file and the build log.

Best,
Philip



-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (600, 'testing'), (550, 'unstable'), (450, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.7.0-2-amd64 (SMP w/4 CPU threads)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dh-python depends on:
ii  python3            3.8.2-3
ii  python3-distutils  3.8.5-1

dh-python recommends no packages.

Versions of packages dh-python suggests:
ii  dpkg-dev      1.20.5
ii  libdpkg-perl  1.20.5

-- no debconf information

[RECORD (application/csv, attachment)]

[solo-python_0.0.26-1_amd64.build (text/plain, attachment)]

Message #10 received at 969352@bugs.debian.org (full text, mbox, reply):

From: Philip Rinn <rinni@inventati.org>

To: 969352@bugs.debian.org

Subject: Re: dh-python: pybuild flit: build path included in RECORD file (makes build non reproducible)

Date: Mon, 21 Dec 2020 14:39:45 +0100

Hi,

I investigated a little ;-).

From what I understand flit tries to use a relative path in the RECORD file [1] 
but that doesn't seem to work always. So my idea would be to strip the build path 
from the resulting RECORD file directly in the install_directly() function at [2]. 
Not entirely sure how to get the path of the file, but you probably have am idea 
;-) BTW: This is how flit does it [3].

Best regards
Philip



[1] https://github.com/takluyver/flit/blob/master/flit/install.py#L404

[2] 
https://salsa.debian.org/python-team/tools/dh-python/-/blob/master/dhpython/build/plugin_flit.py#L78

[3] https://github.com/takluyver/flit/blob/master/flit/install.py#L356-L359

Message #15 received at 969352@bugs.debian.org (full text, mbox, reply):

From: Philip Rinn <rinni@inventati.org>

To: 969352@bugs.debian.org

Subject: Re: dh-python: pybuild flit: build path included in RECORD file (makes build non reproducible)

Date: Mon, 21 Dec 2020 22:20:15 +0100

Hi,

I think I found a solution, I created a MR on salsa:

https://salsa.debian.org/python-team/tools/dh-python/-/merge_requests/17

Best regards
Philip

Message #22 received at 969352-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 969352-close@bugs.debian.org

Subject: Bug#969352: fixed in dh-python 5.20211016

Date: Sat, 16 Oct 2021 15:18:25 +0000

Source: dh-python
Source-Version: 5.20211016
Done: Stefano Rivera <stefanor@debian.org>

We believe that the bug you reported is fixed in the latest version of
dh-python, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 969352@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefano Rivera <stefanor@debian.org> (supplier of updated dh-python package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 16 Oct 2021 08:01:30 -0700
Source: dh-python
Architecture: source
Version: 5.20211016
Distribution: unstable
Urgency: medium
Maintainer: Piotr Ożarowski <piotr@debian.org>
Changed-By: Stefano Rivera <stefanor@debian.org>
Closes: 770265 812228 956191 968213 969352 980303 980310 987236 987296 991009 991146 994281
Changes:
 dh-python (5.20211016) unstable; urgency=medium
 .
   [ Piotr Ożarowski ]
   * DEB_BUILD_PROFILES=nocheck will skip test step in pybuild
     (just like DEB_BUILD_OPTIONS=nocheck already does)
 .
   [ Stefano Rivera ]
   * Add support for 2-digit python minor versions (3.10). Parse sonames and
     generate dependencies, correctly. Thanks Graham Inggs.
   * Version Breaks: python to allow dh-python to be co-installed with
     python-is-python2, thanks Stephen Kitt. (closes: 991009)
   * Remove build path from RECORD files, thanks Philip Rinn (closes: 969352)
   * Add integration test coverage for pybuild and flit.
   * flit: Remove direct_url.json from .dist-info, not reproducible and
     doesn't contain any useful information.
   * Re-enable package build-time test suite.
   * Run the python2.7 dh_python2 tests in an autopkgtest.
   * Replaced references to python with python2.7 in the test suite
     (closes: 956191)
   * Update pydist fallback database.
   * Recognise Debian-packaged python modules from .dist-info directories as
     well as .egg-info.
   * Generate python3:Depends from Requires-Dist entries in .dist-info (e.g.
     flit packages). (closes: 987296)
   * Suggest: flit, python3-toml. (closes: 987236)
   * Architecture-qualify py*compile and py*clean calls in maintainer scripts,
     for architecture-specific Python packages. This allows co-installation
     (and even concurrent unpacking) of different architectures of a package.
     (closes: 991146, 770265, 812228)
   * Update _PYTHON_SYSCONFIGDATA_NAME export for cross-builds, thanks Helmut
     Grohne. (closes: 968213)
   * Parse Build-Depends with a :any suffix correctly, thanks Maximilian
     Engelhardt. (closes: 980303)
   * Generate a dependency on python3 in dh_python3 when there's a script
     installed with a python3 shebang, thanks Maximilian Engelhardt.
     (closes: 980310)
   * flit: Run test suites. (closes: 994281)
Checksums-Sha1:
 42877abdc918661dd42f7c8b1ca32b0317cd1b00 1409 dh-python_5.20211016.dsc
 55ac0bc1f845adc20133cc82b6cee046e6cf8bd9 100500 dh-python_5.20211016.tar.xz
 7b91da65da613cb1c928cdc336b6a14b01f8edd1 6128 dh-python_5.20211016_source.buildinfo
Checksums-Sha256:
 8ce9c9c7a5c460dce53ffb1fe732b4667ad0b5e0dc87e4cca9c4e28d13ac4f78 1409 dh-python_5.20211016.dsc
 e5de062c1837a0fe9ef327c571aeb95f2b03dc4141541d97ce03d53aecef13d7 100500 dh-python_5.20211016.tar.xz
 604d27881b736aa788395361a3105c1b8adb19caab589071f7d7a2212ad100a5 6128 dh-python_5.20211016_source.buildinfo
Files:
 7f4e1c980a5407fadb191a3c5e404a1b 1409 python optional dh-python_5.20211016.dsc
 104f92921acee33f1e83f90821067f7e 100500 python optional dh-python_5.20211016.tar.xz
 5628654bd0f8929d1270701c565bc920 6128 python optional dh-python_5.20211016_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iIoEARYKADIWIQTumtb5BSD6EfafSCRHew2wJjpU2AUCYWrpnBQcc3RlZmFub3JA
ZGViaWFuLm9yZwAKCRBHew2wJjpU2CJYAQDV1bT/AgiHTshRVezQm8B3k/qL0CTn
SuZI7kW+mCXtFgD+IIkOAW1YRLO/IVM5N7lwnskwFgfQfJVqaN6iL8oS5g8=
=m9NL
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.