Debian Bug report logs - #992782
virt-p2v: stores wrong path to sed if built on merged-/usr system

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: virt-p2v: stores wrong path to sed if built on merged-/usr system

Date: Mon, 23 Aug 2021 12:03:33 +0100

[Message part 1 (text/plain, inline)]

Source: virt-p2v
Version: 1.42.0-2
Severity: important
Tags: patch bookworm sid
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

If virt-p2v is built on a merged-/usr system (as created by new
installations of Debian >= 10, debootstrap --merged-usr, or installing
the usrmerge package into an existing installation), the path to sed
is recorded in the binary package as /usr/bin/sed, rather than the
canonical /bin/sed.

This can be seen on the reproducible-builds.org infra:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/virt-p2v.html

If you have sbuild available, an easy way to reproduce this is to build
twice, once with --add-depends=usrmerge and once without.

I suspect the same thing would happen if virt-p2v was built on a system
where /bin and /usr/bin had instead been unified via a symlink farm.

The problematic situation is if the package is *built* on a unified-/usr
system, but *used* on a non-unified-/usr system. In this situation,
/usr/bin/sed exists on the build system but not on the system where
virt-p2v will be used, resulting in the features that use this
executable not working correctly.

Technical Committee resolution #978636 mandates heading towards a
transition to merged-/usr, and this will become a non-issue at the end of
that transition; but variation between merged-/usr and non-merged-/usr
builds is a problem while that transition is taking place, because it
can lead to partial upgrades behaving incorrectly. It is likely that
this class of bugs will become release-critical later in the bookworm
development cycle.

The attached patch resolves this: with it applied, the package builds
identically with and without --add-depends=usrmerge.

Some developers advocate unifying /bin with /usr/bin via a symlink farm
in /bin instead of merged-/usr, but that strategy would have a similar
practical effect on this particular package, and the same solution would
be required.

A side benefit of fixing this is that this change seems likely to be
sufficient to make the package reproducible (as recommended by Policy
§4.15).

    smcv

[0001-d-rules-Specify-canonical-path-to-sed.patch (text/x-diff, attachment)]

Message #10 received at 992782-done@bugs.debian.org (full text, mbox, reply):

From: Hilko Bengen <bengen@debian.org>

To: 992782-done@bugs.debian.org

Subject: Fixed in 1.42.0-3

Date: Sat, 25 Dec 2021 22:29:12 +0100

control: fixed -1 1.42.0-3

I had applied this fix but never closed the bug.

Message #15 received at 992782@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 992782@bugs.debian.org

Subject: Re: Bug#992782 closed by Hilko Bengen <bengen@debian.org> (Fixed in 1.42.0-3)

Date: Sat, 25 Dec 2021 22:19:05 +0000

Control: fixed -1 1.42.0-3

On Sat, 25 Dec 2021 at 21:51:06 +0000, Debian Bug Tracking System forwarded:
> control: fixed -1 1.42.0-3
> 
> I had applied this fix but never closed the bug.

Thanks!

Mail to the -done address doesn't read Control: pseudo-headers, so this
wasn't marked as fixed in 1.42.0-3, only as fixed in an unspecified version.
This mail should resolve that.

FYI, the way to mark a bug as fixed in a particular version without using
d/changelog is to use the Version: pseudo-header in preference to Control:

    To: nnnnnn-done@

    Version: 1.42.0-3

    explanation here

Season's greetings,
    smcv

Send a report that this bug log contains spam.