Debian Bug report logs - #983303
imagemagick: reproducible builds: Embeds different paths on usrmerge system

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: imagemagick: reproducible builds: Embeds different paths on usrmerge system

Date: Mon, 22 Feb 2021 00:19:22 -0800

[Message part 1 (text/plain, inline)]

Source: imagemagick
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

Various files embed the full path to the "mv" and "rm" binaries, which
are different on usrmerge systems:

  https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/imagemagick.html

  /etc/ImageMagick-6/delegates.xml

  <delegate·xmlns=""·decode="bpg"·command="&quot;bpgdec&quot;·-b·16·-o·&quot;%o.png&quot;·&quot;%i&quot;;·/bin/mv·&quot;%o.png&quot;·&quot;%o&quot;"/>
  vs.
  <delegate·xmlns=""·decode="bpg"·command="&quot;bpgdec&quot;·-b·16·-o·&quot;%o.png&quot;·&quot;%i&quot;;·/usr/bin/mv·&quot;%o.png&quot;·&quot;%o&quot;"/>


The attached patch fixes this in debian/rules by passing arguments to
configure to use the paths in the non-usrmerge paths, as usrmerge
systems typically have compatibility symlinks, while non-usrmerge
systems do not.


This patch does not resolve all reproducibility issues (a patch for
consistent dates was just submitted), though the main identified issue
is build paths, which is not tested for bullseye.


Thanks for maintaining imagemagick!


live well,
  vagrant

[0002-debian-rules-Pass-MVDelegate-and-RMDelegate-to-confi.patch (text/x-diff, inline)]

From 3bf9713f938ea8cbc1fb91c167a87ac9bb9a27b5 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Mon, 22 Feb 2021 01:23:34 +0000
Subject: [PATCH 2/4] debian/rules: Pass MVDelegate and RMDelegate to
 configure.

The path to "mv" and "rm" may end up in binaries or documentation,
which may be /bin/CMD or /usr/bin/CMD depending on if the running
system is a usrmerge system or not. Consistently use /bin/CMD as this
is the most compatible path.

https://tests.reproducible-builds.org/debian/issues/paths_vary_due_to_usrmerge_issue.html
---
 debian/rules | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index 118f703..cf0a609 100755
--- a/debian/rules
+++ b/debian/rules
@@ -96,7 +96,9 @@ STATIC_CONFIGURE_OPTIONS := \
 	--without-rsvg
 CONFIGURE_OPTIONS ?= $(STATIC_CONFIGURE_OPTIONS) \
 			    $(CONFIGURE_OPTIONS_CACHE) \
-			    $(CONFIGURE_ARCH_FLAGS)
+			    $(CONFIGURE_ARCH_FLAGS) \
+			    MVDelegate=/bin/mv \
+			    RMDelegate=/bin/rm
 
 # export for alternatives
 export MAGICK_PROGRAMS := compare animate convert composite conjure import identify stream display montage mogrify
-- 
2.20.1

[signature.asc (application/pgp-signature, inline)]

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: 983303@bugs.debian.org, submit@bugs.debian.org

Subject: Re: Bug#983303: imagemagick: reproducible builds: Embeds different paths on usrmerge system

Date: Tue, 16 Nov 2021 16:04:06 -0800

[Message part 1 (text/plain, inline)]

On 2021-02-22, Vagrant Cascadian wrote:
> Various files embed the full path to the "mv" and "rm" binaries, which
> are different on usrmerge systems:
>
>   https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/imagemagick.html
>
>   /etc/ImageMagick-6/delegates.xml
>
>   <delegate·xmlns=""·decode="bpg"·command="&quot;bpgdec&quot;·-b·16·-o·&quot;%o.png&quot;·&quot;%i&quot;;·/bin/mv·&quot;%o.png&quot;·&quot;%o&quot;"/>
>   vs.
>   <delegate·xmlns=""·decode="bpg"·command="&quot;bpgdec&quot;·-b·16·-o·&quot;%o.png&quot;·&quot;%i&quot;;·/usr/bin/mv·&quot;%o.png&quot;·&quot;%o&quot;"/>
>
>
> The attached patch fixes this in debian/rules by passing arguments to
> configure to use the paths in the non-usrmerge paths, as usrmerge
> systems typically have compatibility symlinks, while non-usrmerge
> systems do not.
>
>
> This patch does not resolve all reproducibility issues (a patch for
> consistent dates was just submitted), though the main identified issue
> is build paths, which is not tested for bullseye.

Thanks for fixing:

  Bug#983302: imagemagick: reproducible builds: Embeds date dependent on timezone

It reduced the reproducibility diff in bookworm significantly!

Any chance we could also get this bug fixed too; with the patch applied
it should build reproducibly once imagemagick migrates to bookworm. In
unstable and experimental, build paths will still trigger
reproducibility issues.

Thanks for maintaining imagemagick!


live well,
  vagrant


> From 3bf9713f938ea8cbc1fb91c167a87ac9bb9a27b5 Mon Sep 17 00:00:00 2001
> From: Vagrant Cascadian <vagrant@reproducible-builds.org>
> Date: Mon, 22 Feb 2021 01:23:34 +0000
> Subject: [PATCH 2/4] debian/rules: Pass MVDelegate and RMDelegate to
>  configure.
>
> The path to "mv" and "rm" may end up in binaries or documentation,
> which may be /bin/CMD or /usr/bin/CMD depending on if the running
> system is a usrmerge system or not. Consistently use /bin/CMD as this
> is the most compatible path.
>
> https://tests.reproducible-builds.org/debian/issues/paths_vary_due_to_usrmerge_issue.html
> ---
>  debian/rules | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/debian/rules b/debian/rules
> index 118f703..cf0a609 100755
> --- a/debian/rules
> +++ b/debian/rules
> @@ -96,7 +96,9 @@ STATIC_CONFIGURE_OPTIONS := \
>  	--without-rsvg
>  CONFIGURE_OPTIONS ?= $(STATIC_CONFIGURE_OPTIONS) \
>  			    $(CONFIGURE_OPTIONS_CACHE) \
> -			    $(CONFIGURE_ARCH_FLAGS)
> +			    $(CONFIGURE_ARCH_FLAGS) \
> +			    MVDelegate=/bin/mv \
> +			    RMDelegate=/bin/rm
>  
>  # export for alternatives
>  export MAGICK_PROGRAMS := compare animate convert composite conjure import identify stream display montage mogrify
> -- 
> 2.20.1

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 983303@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 983303@bugs.debian.org

Cc: Vagrant Cascadian <vagrant@reproducible-builds.org>

Subject: Re: Bug#983303: imagemagick: reproducible builds: Embeds different paths on usrmerge system

Date: Sun, 17 Jul 2022 13:43:42 +0100

Control: severity -1 serious

On Mon, 22 Feb 2021 at 00:19:22 -0800, Vagrant Cascadian wrote:
> Various files embed the full path to the "mv" and "rm" binaries, which
> are different on usrmerge systems:
> 
>   https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/imagemagick.html
> 
>   /etc/ImageMagick-6/delegates.xml
> 
>   <delegate·xmlns=""·decode="bpg"·command="&quot;bpgdec&quot;·-b·16·-o·&quot;%o.png&quot;·&quot;%i&quot;;·/bin/mv·&quot;%o.png&quot;·&quot;%o&quot;"/>
>   vs.
>   <delegate·xmlns=""·decode="bpg"·command="&quot;bpgdec&quot;·-b·16·-o·&quot;%o.png&quot;·&quot;%i&quot;;·/usr/bin/mv·&quot;%o.png&quot;·&quot;%o&quot;"/>

This will be a practical problem as soon as Debian starts using merged-/usr
on official buildds, and the Debian technical committee resolution
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994388#110 recommends
treating this class of bug as release-critical for Debian 12, so I'm
raising the severity of this bug.

The problem scenario is:

- build the package on a system where both /bin/mv and /usr/bin/mv exist
  (merged-/usr)
- install and run the package on a system where only /bin/mv exists
  (non-merged-/usr)
- result: the feature that runs mv will not work

> The attached patch fixes this in debian/rules by passing arguments to
> configure to use the paths in the non-usrmerge paths, as usrmerge
> systems typically have compatibility symlinks, while non-usrmerge
> systems do not.

This looks appropriate. To clarify, Debian installations with merged-/usr
are *guaranteed* to have the compatibility symlinks such as /bin ->
usr/bin, so it is always appropriate to use the canonical non-merged-/usr
paths such as /bin/mv.

Please upload a fixed package to unstable before the Debian 12 freeze.
Both the unstable and experimental versions of imagemagick seem to be
affected by this problem.

Thanks,
    smcv

Message #27 received at 983303@bugs.debian.org (full text, mbox, reply):

From: Paul Gevers <elbrus@debian.org>

To: 983303@bugs.debian.org, Vagrant Cascadian <vagrant@reproducible-builds.org>

Subject: Re: imagemagick: reproducible builds: Embeds different paths on usrmerge system

Date: Sat, 31 Dec 2022 22:47:50 +0100

[Message part 1 (text/plain, inline)]

Control: tags -1 pending

Hi,

On Mon, 22 Feb 2021 00:19:22 -0800 Vagrant Cascadian 
<vagrant@reproducible-builds.org> wrote:
> Various files embed the full path to the "mv" and "rm" binaries, which
> are different on usrmerge systems:
> 
>   https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/amd64/diffoscope-results/imagemagick.html
> 
>   /etc/ImageMagick-6/delegates.xml
> 
>   <delegate·xmlns=""·decode="bpg"·command="&quot;bpgdec&quot;·-b·16·-o·&quot;%o.png&quot;·&quot;%i&quot;;·/bin/mv·&quot;%o.png&quot;·&quot;%o&quot;"/>
>   vs.
>   <delegate·xmlns=""·decode="bpg"·command="&quot;bpgdec&quot;·-b·16·-o·&quot;%o.png&quot;·&quot;%i&quot;;·/usr/bin/mv·&quot;%o.png&quot;·&quot;%o&quot;"/>
> 
> 
> The attached patch fixes this in debian/rules by passing arguments to
> configure to use the paths in the non-usrmerge paths, as usrmerge
> systems typically have compatibility symlinks, while non-usrmerge
> systems do not.

I am building with the patch right now, I will upload when that succeeds.

Paul

[OpenPGP_signature (application/pgp-signature, attachment)]

Message #34 received at 983303@bugs.debian.org (full text, mbox, reply):

From: Paul Gevers <elbrus@debian.org>

To: 983303@bugs.debian.org

Subject: Re: imagemagick: reproducible builds: Embeds different paths on usrmerge system

Date: Sun, 1 Jan 2023 09:27:01 +0100

[Message part 1 (text/plain, inline)]

Hi,

On 31-12-2022 22:47, Paul Gevers wrote:
> I am building with the patch right now, I will upload when that succeeds.

I uploaded to DELAYED/5 with the attached debdiff.

Paul

[imagemagick-6.9.11.60+dfsg-1.4.debdiff (text/plain, attachment)]

[OpenPGP_signature (application/pgp-signature, attachment)]

Message #39 received at 983303-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 983303-close@bugs.debian.org

Subject: Bug#983303: fixed in imagemagick 8:6.9.11.60+dfsg-1.4

Date: Fri, 06 Jan 2023 09:04:16 +0000

Source: imagemagick
Source-Version: 8:6.9.11.60+dfsg-1.4
Done: Paul Gevers <elbrus@debian.org>

We believe that the bug you reported is fixed in the latest version of
imagemagick, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 983303@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <elbrus@debian.org> (supplier of updated imagemagick package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 31 Dec 2022 22:36:57 +0100
Source: imagemagick
Architecture: source
Version: 8:6.9.11.60+dfsg-1.4
Distribution: unstable
Urgency: medium
Maintainer: ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org>
Changed-By: Paul Gevers <elbrus@debian.org>
Closes: 983303
Changes:
 imagemagick (8:6.9.11.60+dfsg-1.4) unstable; urgency=medium
 .
   * Non-maintainer upload.
 .
   [ Vagrant Cascadian ]
   * debian/rules: Pass MVDelegate and RMDelegate to configure. (Closes:
     #983303)
Checksums-Sha1:
 59250aef07aec604f50d5cbf45900206a8944723 4859 imagemagick_6.9.11.60+dfsg-1.4.dsc
 5e867f4933dbf910786bf90c3fffbf4605cb0972 246984 imagemagick_6.9.11.60+dfsg-1.4.debian.tar.xz
Checksums-Sha256:
 54ebca75700629de00052fd1f9deea5956579c3d5ccd27857ca4d893c573d822 4859 imagemagick_6.9.11.60+dfsg-1.4.dsc
 aadf3bd6b7570895d6c886f1ba5817ac9e17d2fe18c6a494c671df3ffbb14da7 246984 imagemagick_6.9.11.60+dfsg-1.4.debian.tar.xz
Files:
 eba8d96af2909573a533427777aeed0e 4859 graphics optional imagemagick_6.9.11.60+dfsg-1.4.dsc
 c616830f3e6326ded40b94fbcd03d57c 246984 graphics optional imagemagick_6.9.11.60+dfsg-1.4.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAmOxQ2UACgkQnFyZ6wW9
dQpl6QgAslqdznLd1bidg/lrwHoXhtvkj+a+VbYqB/P1PsjS/rth+4rBIJaQX1jv
KY3yfbEPSlUBm1PtEVSYR+rXG6JlioRTy/GoRQTx6RlyK/n4MWlQWMhofYL5r+Tf
/C6LoSQfB7+owqrVJPVzXGEAMWxNbSdHaoPKSkshd13Ffi72cE34EQ4KjV0HP29f
l3Hqj3VkWkTGt0zTwgD41W8iZUHfz4bHGpIucPdl/goOrrlsjvieFVx4y4GUVugL
+9xWz9tiI8AWXmfAmBjJYhGtvFl9AQjdZO2oXYYy/zeZ/r74wQwJx8Orf84fVnm2
T0QCwGFbg1oGWHoOfA1MmOVqeVbTaw==
=zX1a
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.