Debian Bug report logs - #992620
pkg-config: stores different system library paths if built with/without merged-/usr

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: pkg-config: stores different system library paths if built with/without merged-/usr

Date: Sat, 21 Aug 2021 11:50:00 +0100

[Message part 1 (text/plain, inline)]

Package: pkg-config
Version: 0.29.2-1
Severity: important
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

If pkg-config is built on a merged-/usr system (as created by new
installations of Debian >= 10, debootstrap --merged-usr, or installing the
usrmerge package into an existing installation), the list of standard
library directories is not the same as if pkg-config is built on a
non-merged-/usr system (for example current official buildd chroots).

This can be seen on the reproducible-builds.org infra:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/pkg-config.html
(search for "/usr/lib:" to see the difference I'm concerned about).

If you have sbuild available, an easy way to reproduce this is to build
pkg-config twice, once with --add-depends-arch=usrmerge and once without.

The potentially problematic situation is if pkg-config is *built* on a
merged-/usr system, but *used* on a non-merged-/usr system.

Technical Committee resolution #978636 mandates heading towards a
transition to merged-/usr, and this will become a non-issue at the end of
that transition; but variation between merged-/usr and non-merged-/usr
builds is a problem while that transition is taking place, because it can
lead to partial upgrades behaving incorrectly.

The attached patches resolve this: with them applied, the package builds
identically with and without --add-depends-arch=usrmerge.

A side benefit of fixing this is that this change might be sufficient
to make the package reproducible (as recommended by Policy §4.15): the
rest of the variation shown on reproducible-builds.org appears to be just
side-effects from the differing length of the system library path.

    smcv

[0001-d-rules-Factor-out-computation-of-system-library-pat.patch (text/x-diff, attachment)]

[0002-d-system-libdirs.sh-Always-list-directories-with-and.patch (text/x-diff, attachment)]

Message #10 received at 992620@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 992620@bugs.debian.org

Subject: Re: Bug#992620: pkg-config: stores different system library paths if built with/without merged-/usr

Date: Sat, 21 Aug 2021 12:09:00 +0100

[Message part 1 (text/plain, inline)]

On Sat, 21 Aug 2021 at 11:50:00 +0100, Simon McVittie wrote:
> The attached patches resolve this: with them applied, the package builds
> identically with and without --add-depends-arch=usrmerge.

Here's a slightly better version of those patches, picking up a change
from the copy of this code in pkgconf (running sort with LC_ALL=C, to
get a language-neutral normalized order, which was done in pkgconf to
fix #792285).

    smcv

[0001-d-rules-Factor-out-computation-of-system-library-pat.patch (text/x-diff, attachment)]

[0002-Sort-system-library-directories-in-a-language-neutra.patch (text/x-diff, attachment)]

[0003-d-system-libdirs.sh-Always-list-directories-with-and.patch (text/x-diff, attachment)]

Message #15 received at 992620@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 992620@bugs.debian.org

Subject: Re: Bug#992620: pkg-config: stores different system library paths if built with/without merged-/usr

Date: Sun, 17 Jul 2022 13:57:59 +0100

On Sat, 21 Aug 2021 at 11:50:00 +0100, Simon McVittie wrote:
> If pkg-config is built on a merged-/usr system (as created by new
> installations of Debian >= 10, debootstrap --merged-usr, or installing the
> usrmerge package into an existing installation), the list of standard
> library directories is not the same as if pkg-config is built on a
> non-merged-/usr system (for example current official buildd chroots).
> 
> This can be seen on the reproducible-builds.org infra:
> https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/pkg-config.html
> (search for "/usr/lib:" to see the difference I'm concerned about).

In general, the Debian technical committee resolution
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994388#110 recommends
treating this class of bug as release-critical for Debian 12.

However, I'm unsure whether this specific bug is RC or not: how important
is it that the list of standard library directories is exhaustive?
If it's important that it is a comprehensive list, then the severity of
this bug should be raised to serious.

Regardless of whether this is RC or not, it would be great to get this
fixed in Debian 12: pkg-config is an important part of our toolchain, and
having a fully reproducible build would increase confidence that it is
working correctly for both mergd-/usr and unmerged-/usr systems.

I proposed a patch in 2021 based on what is done in the pkgconf package
(a reimplementation of pkg-config aiming to have compatible semantics). A
similar patch was subsequently applied to pkgconf.

Thanks,
    smcv

Send a report that this bug log contains spam.