Debian Bug report logs - #992622
pkgconf: stores different system library paths if built with/without merged-/usr

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: pkgconf: stores different system library paths if built with/without merged-/usr

Date: Sat, 21 Aug 2021 12:21:26 +0100

[Message part 1 (text/plain, inline)]

Package: pkgconf
Version: 1.7.4~git20210206+dcf529b-3
Severity: important
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

If pkgconf is built on a merged-/usr system (as created by new
installations of Debian >= 10, debootstrap --merged-usr, or installing
the usrmerge package into an existing installation), the list of
standard library directories is not the same as if pkgconf is built on
a non-merged-/usr system (for example current official buildd chroots).
This is the same bug as https://bugs.debian.org/992620 in pkg-config,
for the same reason.

This can be seen on the reproducible-builds.org infra:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/pkgconf.html
(search for "/usr/lib:" to see the difference I'm concerned about).

If you have sbuild available, an easy way to reproduce this is to build
pkgconf twice, once with --add-depends-arch=usrmerge and once without.

The potentially problematic situation is if pkgconf is *built* on a
merged-/usr system, but *used* on a non-merged-/usr system.

Technical Committee resolution #978636 mandates heading towards a
transition to merged-/usr, and this will become a non-issue at the end of
that transition; but variation between merged-/usr and non-merged-/usr
builds is a problem while that transition is taking place, because it can
lead to partial upgrades behaving incorrectly.

The attached patches resolve this: with them applied, the package builds
identically with and without --add-depends-arch=usrmerge.
I'll send a merge request for this when I have a bug number.

A side benefit of fixing this is that this change might be sufficient
to make the package reproducible (as recommended by Policy §4.15): the
rest of the variation shown on reproducible-builds.org appears to be just
side-effects from the differing length of the system library path.

    smcv

[0001-d-rules-Factor-out-computation-of-system-library-pat.patch (text/x-diff, attachment)]

[0002-d-system-libdirs.sh-Always-list-directories-with-and.patch (text/x-diff, attachment)]

Message #10 received at 992622@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 992622@bugs.debian.org

Subject: Re: Bug#992622: pkgconf: stores different system library paths if built with/without merged-/usr

Date: Sat, 21 Aug 2021 14:35:36 +0100

On Sat, 21 Aug 2021 at 12:21:26 +0100, Simon McVittie wrote:
> The attached patches resolve this: with them applied, the package builds
> identically with and without --add-depends-arch=usrmerge.

Patches acked by maintainer on IRC and pushed to salsa. I don't intend to
NMU this right now, but I might NMU if we get consensus that bugs of this
class should be RC.

    smcv

Message #15 received at 992622-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 992622-close@bugs.debian.org

Subject: Bug#992622: fixed in pkgconf 1.8.0-1

Date: Mon, 23 Aug 2021 13:04:04 +0000

Source: pkgconf
Source-Version: 1.8.0-1
Done: Andrej Shadura <andrewsh@debian.org>

We believe that the bug you reported is fixed in the latest version of
pkgconf, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 992622@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrej Shadura <andrewsh@debian.org> (supplier of updated pkgconf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 23 Aug 2021 14:48:27 +0200
Source: pkgconf
Architecture: source
Version: 1.8.0-1
Distribution: unstable
Urgency: medium
Maintainer: Andrej Shadura <andrewsh@debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Closes: 992622
Changes:
 pkgconf (1.8.0-1) unstable; urgency=medium
 .
   [ Andrej Shadura ]
   * New upstream release.
 .
   [ Simon McVittie ]
   * d/rules: Factor out computation of system library path into a script
   * d/system-libdirs.sh: Always list directories with and without /usr.
     This avoids potentially unwanted -L flags in --libs if pkgconf is
     built on a merged-/usr system and used on a non-merged-/usr system.
     (Closes: #992622)
Checksums-Sha1:
 01d6b749a979828882cdd337db4cc29457b8aa4d 1513 pkgconf_1.8.0-1.dsc
 2b76eb2d88b2c4aecba937b337d218a13b67f14b 296304 pkgconf_1.8.0.orig.tar.xz
 b41fdae7329479308cb398f6b53672ffd7da8932 9408 pkgconf_1.8.0-1.debian.tar.xz
Checksums-Sha256:
 90a4f867599a32ef7e0632e1ef727e688d9d444f068f620f3b28c564502c7f4b 1513 pkgconf_1.8.0-1.dsc
 ef9c7e61822b7cb8356e6e9e1dca58d9556f3200d78acab35e4347e9d4c2bbaf 296304 pkgconf_1.8.0.orig.tar.xz
 2626555c03602620e9f0d769aa5dc84774b0e62383f24f2374b81912308c0a26 9408 pkgconf_1.8.0-1.debian.tar.xz
Files:
 f2408e4cb9e11648cc9752f571db1508 1513 devel optional pkgconf_1.8.0-1.dsc
 823212dc241793df8ff1d097769a3473 296304 devel optional pkgconf_1.8.0.orig.tar.xz
 afb8c173ec94583d5ae156f802dcc5b0 9408 devel optional pkgconf_1.8.0-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCYSOaUgAKCRDoRGtKyMdy
YTFmAQCIJeqqfzT2eGJnASaV8yzdibuG5Wg5CKVGnrW+23+r/wD/eeirUHpjHgQl
V0f5hLHzq3C3sUiKIUqRWTLz8b3vuAs=
=w9N8
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.