Debian Bug report logs - #990843
libtheora: reproducible-builds: Example Makefile embeds build paths and binary paths

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: submit@bugs.debian.org

Subject: libtheora: reproducible-builds: Example Makefile embeds build paths and binary paths

Date: Thu, 08 Jul 2021 22:48:22 -0700

[Message part 1 (text/plain, inline)]

Source: libtheora
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: buildpath usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The build path and several binary paths are embedded in example Makefile
shipped in the package:

  https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/libtheora.html

  ./usr/share/doc/libtheora-dev/examples/Makefile

  ACLOCAL·=·${SHELL}·'/build/1st/libtheora-1.1.1+dfsg.1/missing'·aclocal-1.16
  vs.
  ACLOCAL·=·${SHELL}·'/build/2/libtheora-1.1.1+dfsg.1/2nd/missing'·aclocal-1.16

  GREP·=·/bin/grep	
  vs.
  GREP·=·/usr/bin/grep

Since these values may differ with the installed system, in order to use
the example Makefile, a person would have to regenerate it from
Makefile.am, which is also provided.

The attached patch adjusts debian/libtheora-doc.examples to only install
Makefile.am.


If that is somehow not an option, an alternate option would be to
sanitize the Makefiles stripping the build path (or replacing with
/usr/src?), and possibly passing various variables to configure
(e.g. GREP=/bin/grep, SHELL=/bin/sh, ...).


Thanks for maintaining libtheora!


live well,
  vagrant

[0002-Do-not-install-example-Makefile.patch (text/x-diff, inline)]

From 680fb3e29c50fb59deb1151a850f657532b59f3f Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Fri, 9 Jul 2021 05:39:06 +0000
Subject: [PATCH 2/2] Do not install example Makefile.

The build path and several binary paths are embedded in a Makefile
shipped in the package.

Since these values may differ with the installed system, in order to
use the example Makefile, a person would have to regenerate it from
Makefile.am, which is included in the package.
---
 debian/libtheora-doc.examples | 1 -
 1 file changed, 1 deletion(-)

diff --git a/debian/libtheora-doc.examples b/debian/libtheora-doc.examples
index 7846b89..a6371a7 100644
--- a/debian/libtheora-doc.examples
+++ b/debian/libtheora-doc.examples
@@ -1,4 +1,3 @@
 examples/*.c
 examples/*.h
 examples/*.am
-examples/Makefile
-- 
2.32.0

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 990843-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 990843-close@bugs.debian.org

Subject: Bug#990843: fixed in libtheora 1.1.1+dfsg.1-16.1

Date: Tue, 18 Oct 2022 18:05:25 +0000

Source: libtheora
Source-Version: 1.1.1+dfsg.1-16.1
Done: Holger Levsen <holger@debian.org>

We believe that the bug you reported is fixed in the latest version of
libtheora, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 990843@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Holger Levsen <holger@debian.org> (supplier of updated libtheora package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 06 Oct 2022 19:18:29 +0200
Source: libtheora
Architecture: source
Version: 1.1.1+dfsg.1-16.1
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Holger Levsen <holger@debian.org>
Closes: 990843 990844
Changes:
 libtheora (1.1.1+dfsg.1-16.1) unstable; urgency=medium
 .
   * Non-maintainer upload by the Reproducible Builds team.
   * debian/libtheora-doc.examples: do not install example Makefile as it leaks
     the build path. Closes: #990843 - thanks to Vagrant Cascadian for the
     patch.
   * debian/rules: ensure texlive respects SOURCE_DATE_EPOCH, thanks again to
     Vagrant for the patch. Closes: #990844
Checksums-Sha1:
 d8b42317834c5dd94421623849c6d044eb9bebca 2540 libtheora_1.1.1+dfsg.1-16.1.dsc
 e1fb62c08f184a45788e1c4ce580eb07ffa7e171 11344 libtheora_1.1.1+dfsg.1-16.1.debian.tar.xz
 13325435fe1f8783d61130887603b1cf0cd1cd6b 9783 libtheora_1.1.1+dfsg.1-16.1_source.buildinfo
Checksums-Sha256:
 e23398c3f176df004694eb04999492ddf47ec671e1d6ec78259c8faff038f469 2540 libtheora_1.1.1+dfsg.1-16.1.dsc
 ea71764d2bfb859af830d1103b840ca627e7e0290fa022a87665baf3d4ea83c1 11344 libtheora_1.1.1+dfsg.1-16.1.debian.tar.xz
 48ac30cbd73295e9e9a930d944739dfdf68282d2b96e8439486fa23666e46750 9783 libtheora_1.1.1+dfsg.1-16.1_source.buildinfo
Files:
 a8d4fbefd568e47f262c66fcf7559f6c 2540 libs optional libtheora_1.1.1+dfsg.1-16.1.dsc
 39d2efccfb866bbf8e31d5fc77c5bf9f 11344 libs optional libtheora_1.1.1+dfsg.1-16.1.debian.tar.xz
 5e3481e497ab9b4ac89c3e40b8839dbe 9783 libs optional libtheora_1.1.1+dfsg.1-16.1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmM/DrYACgkQCRq4Vgaa
qhzU6xAAr3msCc6UfX3oE+vSHmOYLC1O2y+bF1LfUWfAs7YiMstHKZeMYhkEXDvK
j8sQTP1kPPSr1jjL0pIQ/8vatTs03Rmqsm72JHL3y33MGm0YBb1SNKLWqqrUvv4m
C5+uO8Mdx2T5IVgCX66kwit/3J5v2MmOv0Wi6X7R5zFGsl9RYxGYMryAReKlJjWF
4qn93cg/mu01PH2SIp2z0TLwdbJgEHzgB6sY0Y5qQannO/Qs7aYv72xicwUjrq0o
RpSDohpOrkdzcRu/lhVf8yF2vS2A359+jqRqHsgvX8GRGV1bQ8UNobaopKbu/KnY
vZbiBYRslkda+gBx61bLR7vy2Fk1OqRtKrVoS3PVlb5fudmwLKw14/702wxaiDCP
0K/a78f5JrEUVPa2j0HA8dVawx/XkHfuMrQgnesuU16Fr7t6kU+BNxOVSgtLOeml
YgNIu928KHL15iNfqSXV3dCpUXnHhKKqi0o4rASKDlSp89d2MKWbt7Ze+yZwCfbm
vdiOvxLdVScsfez5hT6dkk0+UmZD01f842X7lwfQeBU6hb+GOvZYtAnLGifbpiwQ
s+Rk0+t00oYm/JfnztEGV8SWEKS5MMyAPbCWsioVCYD7IrvFwSoRxjiHzcsAce/v
HR4s739wrQHUOICC02fl/1Xxg+PTKD3JE2h5wHEC2BiMNqJBt2Y=
=TBO/
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.