Debian Bug report logs - #992702
nbdkit: stores wrong path to mke2fs if built on merged-/usr system

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: nbdkit: stores wrong path to mke2fs if built on merged-/usr system

Date: Sun, 22 Aug 2021 15:33:41 +0100

[Message part 1 (text/plain, inline)]

Source: nbdkit
Version: 1.26.5-1
Severity: important
Tags: patch bookworm sid
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

If nbdkit is built on a merged-/usr system (as created by new
installations of Debian >= 10, debootstrap --merged-usr, or installing
the usrmerge package into an existing installation), the path to bash
is recorded in the binary as /usr/bin/bash.

This can be seen on the reproducible-builds.org infra:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/nbdkit.html
(search for "/sbin/mke2fs" to see the difference I'm concerned about).

If you have sbuild available, an easy way to reproduce this is to build
twice, once with --add-depends-arch=usrmerge and once without.

The problematic situation is if the package is *built* on a merged-/usr
system, but *used* on a non-merged-/usr system. In this situation,
/usr/sbin/mke2fs exists on the build system but not on the system where
sharutils will be used, resulting in the feature that uses mke2fs not being
available.

Technical Committee resolution #978636 mandates heading towards a
transition to merged-/usr, and this will become a non-issue at the end of
that transition; but variation between merged-/usr and non-merged-/usr
builds is a problem while that transition is taking place, because it
can lead to partial upgrades behaving incorrectly. It is likely that
this class of bugs will become release-critical later in the bookworm
development cycle.

Some Debian developers advocate that instead of merged-/usr, we should use
a different strategy where /sbin becomes a "symlink farm" with individual
symlinks such as /sbin/mke2fs-> /usr/sbin/mke2fs. If that route is taken
instead of merged-/usr, then resolving bugs like this one will be equally
important as part of that transition, because it shares the property
that both /sbin/mke2fs and /usr/bin/mke2fs exist after the transition,
but only /sbin/mke2fs exists on untransitioned systems.

The attached patch resolves this: with it applied, the package builds
identically with and without --add-depends-arch=usrmerge, other than an
unrelated unreproducibility where CFLAGS that include the build path
are compiled into another part of the package.

A side benefit of fixing this is that this change is a step towards
making the package reproducible (as recommended by Policy §4.15).

    smcv

[0001-d-rules-Specify-canonical-path-to-mke2fs.patch (text/x-diff, attachment)]

Message #10 received at 992702@bugs.debian.org (full text, mbox, reply):

From: Hilko Bengen <bengen@debian.org>

To: Simon McVittie <smcv@debian.org>

Cc: 992702@bugs.debian.org

Subject: Re: Bug#992702: nbdkit: stores wrong path to mke2fs if built on merged-/usr system

Date: Mon, 23 Aug 2021 10:15:15 +0200

control: tag -1 pending

Thanks for the patch, I have applied it in Git.

-Hilko

Message #17 received at 992702@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 992702@bugs.debian.org

Subject: Re: Bug#992702: nbdkit: stores wrong path to mke2fs if built on merged-/usr system

Date: Mon, 23 Aug 2021 09:51:47 +0100

Control: tags -1 + pending

On Sun, 22 Aug 2021 at 15:33:41 +0100, Simon McVittie wrote:
> The attached patch resolves this: with it applied, the package builds
> identically with and without --add-depends-arch=usrmerge, other than an
> unrelated unreproducibility where CFLAGS that include the build path
> are compiled into another part of the package.

Applied in git as
<https://salsa.debian.org/debian/nbdkit/-/commit/b8c28ac31ee731341fbe216a228034d0f1d0b7d0>.
Please remember to close this bug in the first upload that includes
that change - I was unable to include a Closes: statement in the patch
because I didn't have a bug number at the time I submitted it.

    smcv

Message #22 received at 992702-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 992702-close@bugs.debian.org

Subject: Bug#992702: fixed in nbdkit 1.26.6-1

Date: Mon, 25 Oct 2021 17:49:16 +0000

Source: nbdkit
Source-Version: 1.26.6-1
Done: Hilko Bengen <bengen@debian.org>

We believe that the bug you reported is fixed in the latest version of
nbdkit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 992702@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Hilko Bengen <bengen@debian.org> (supplier of updated nbdkit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 27 Sep 2021 13:40:05 +0200
Source: nbdkit
Architecture: source
Version: 1.26.6-1
Distribution: unstable
Urgency: medium
Maintainer: Hilko Bengen <bengen@debian.org>
Changed-By: Hilko Bengen <bengen@debian.org>
Closes: 992702 992722
Changes:
 nbdkit (1.26.6-1) unstable; urgency=medium
 .
   [ Simon McVittie ]
   * d/rules: Specify canonical path to mke2fs (Closes: #992702)
 .
   [ Hilko Bengen ]
   * Add patch to filter out build path from cc plugin (Closes: #992722)
   * New upstream version 1.26.6
Checksums-Sha1:
 8f258202207a3bcf628837f39ee8c7b1b514b6cf 3215 nbdkit_1.26.6-1.dsc
 ac2b7773a21edf3a8f139f018be8c8f6c3fd2434 2172775 nbdkit_1.26.6.orig.tar.gz
 2ba594153c0849515309b600d5716c85d5d633a5 11188 nbdkit_1.26.6-1.debian.tar.xz
 93cf6457a2f63fedaa08537731e6063d914b47ee 15965 nbdkit_1.26.6-1_source.buildinfo
Checksums-Sha256:
 e17b190b13631c2745e341f62e7367c6b0d1b8693e48cc96c6bce842490683ec 3215 nbdkit_1.26.6-1.dsc
 1b2a9d30bbc2186a6a296cc91dea0d6d4c8fc30c498a2676a52213eb3fadb18f 2172775 nbdkit_1.26.6.orig.tar.gz
 9980c35cae5f5f8574b6454e54ff1c8a2959ea2d7797fc69180de1f72598a978 11188 nbdkit_1.26.6-1.debian.tar.xz
 be37380ad1a9af1f1b4c0c2268988b1b1812d85ce596bc16fe83ce36c21639f6 15965 nbdkit_1.26.6-1_source.buildinfo
Files:
 18423e975e60e0b6b1575fb5fe4e7589 3215 admin optional nbdkit_1.26.6-1.dsc
 c96d0231172564104fca565d93e742e8 2172775 admin optional nbdkit_1.26.6.orig.tar.gz
 7a3824fdaf1fc5df1b7d9e3c44237844 11188 admin optional nbdkit_1.26.6-1.debian.tar.xz
 8678f20ea17870e2a7504eaf1925adba 15965 admin optional nbdkit_1.26.6-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEErnMQVUQqHZbPTUx4dbcQY1whOn4FAmFRrk4ACgkQdbcQY1wh
On5qkBAAja85HYbgriw3e5TEueN/ZRK1THkKAA3rPZAKycrTgPRMxxD78vGUFL8e
dyyw8ZhxggTxVAFmWLEc0EwqtnRsGms02IwQTc76Zhy6cc64zQH0NcoDMX8E9wB/
t+nR77yL5D+cU+P/rty7/iKhd5qd/CLgrOAuqBuX/FP6au2qtoE67ISV+fBhuwhY
Gcoz8KErgriL8Dx7N5iPy+moEecLROP8/UrFQnLP2FMTCOoGN+HovzEI3tugelpP
lYKDEJwAaehZ4h3+NIbBfklc8AIRs0thkqkg0u4lMTyMsb5kORwHJawabvKVLX46
USGANuFYbNQli+TfpYtkkZN72SkYDveh7LUhEoHmkqFdAsT48BXAsVgOJS983AGp
hsqMIlTtykq5sitSStlWhdHiHb/wIXGJOaVHedw8k9v5HU3uGPKhI9OiNrMJ8W8w
DgE65f79tUBGBy/sKiFH2Vqex+8CMb68x9lcNKhbS2mSBxxC3Jf+krlV27Vwadh9
whAsUaslZrh4IpaLbnbBTJAS7Bd9jebN36wm9mAgYNkAmnqscjWQuO8lUPzHSZGT
vQS3y/MGVX4/d+4Mdmm4eXoeaPpYkzK0KtUYworG54rdjmTiKfyKwm9AlxJ7vq1U
lpQh+a/tuwz9wKJlPWzD6Uoses8Wn5pFVGX18k3XAMfgHCsGG/0=
=dyyG
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.