Debian Bug report logs - #993275
ng: stores wrong paths to cp and ls if built on merged-/usr system

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: ng: stores wrong paths to cp and ls if built on merged-/usr system

Date: Sun, 29 Aug 2021 23:23:48 +0100

[Message part 1 (text/plain, inline)]

Source: ng
Version: 1.5~beta1-9
Severity: important
Tags: patch bookworm sid
User: reproducible-builds@lists.alioth.debian.org
Usertags: usrmerge
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

If gnunet is built on a merged-/usr system (as created by new
installations of Debian >= 10, debootstrap --merged-usr, or installing
the usrmerge package into an existing installation), the paths to cp and
ls are recorded in the binary package as being in /usr/bin, rather than the
canonical /bin.

This can be seen on the reproducible-builds.org infra:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/ng.html

If you have sbuild available, an easy way to reproduce this is to build
twice, once with --add-depends=usrmerge and once without.

I suspect the same thing would happen if ng was built on a system where
/bin and /usr/bin had instead been unified via a symlink farm.

The problematic situation is if the package is *built* on a unified-/usr
system, but *used* on a non-unified-/usr system. In this situation,
/usr/bin/cp, etc. exist on the build system but not on the system where
the package will be used, resulting in the features that use this
executable not working correctly.

Technical Committee resolution #978636 mandates heading towards a
transition to merged-/usr, and this will become a non-issue at the end of
that transition; but variation between merged-/usr and non-merged-/usr
builds is a problem while that transition is taking place, because it
can lead to partial upgrades behaving incorrectly. It is likely that
this class of bugs will become release-critical later in the bookworm
development cycle.

The attached patch resolves this: with it applied, the package builds
identically with and without --add-depends=usrmerge.

Some developers advocate unifying /bin with /usr/bin via a symlink farm
in /bin instead of merged-/usr, but that strategy would have a similar
practical effect on this particular package, and the same solution would
be required.

A side benefit of fixing this is that this change seems likely to be
sufficient to make the package reproducible (as recommended by Policy
§4.15).

    smcv

[0001-d-rules-Specify-canonical-paths-of-cp-ls-mv-rmdir.patch (text/x-diff, attachment)]

Message #10 received at 993275@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>

To: Simon McVittie <smcv@debian.org>, 993275@bugs.debian.org

Subject: Re: Bug#993275: ng: stores wrong paths to cp and ls if built on merged-/usr system

Date: Fri, 17 Sep 2021 10:46:31 -0700

[Message part 1 (text/plain, inline)]

On 2021-08-29, Simon McVittie wrote:
> If gnunet is built on a merged-/usr system (as created by new
> installations of Debian >= 10, debootstrap --merged-usr, or installing
> the usrmerge package into an existing installation), the paths to cp and
> ls are recorded in the binary package as being in /usr/bin, rather than the
> canonical /bin.

gnunet -> ng ? ... Or should this be reassigned to gnunet?

> From 483dd087b93e02d30a7bf1f022c35d3f88f74d07 Mon Sep 17 00:00:00 2001
> From: Simon McVittie <smcv@debian.org>
> Date: Sun, 29 Aug 2021 22:15:25 +0100
> Subject: [PATCH] d/rules: Specify canonical paths of cp, ls, mv, rmdir
>
> When ng is built on a system where both /usr/bin/cp and /bin/cp
> exist (either merged-/usr or via a symlink farm), this results in storing
> /usr/bin/cp in the installed programs, which will not work as intended
> on systems where only the traditional path /bin/cp exists.
>
> ls is in a similar situation. mv and rmdir are checked by ./configure
> but not hard-coded anywhere; give them the same treatment for symmetry.

Thanks for the patch!

Since ng is maintained by QA, you could upload the fix yourself, or I
may get to it in the coming weeks...


live well,
  vagrant

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 993275@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Vagrant Cascadian <vagrant@reproducible-builds.org>

Cc: 993275@bugs.debian.org

Subject: Re: Bug#993275: ng: stores wrong paths to cp and ls if built on merged-/usr system

Date: Fri, 17 Sep 2021 19:07:07 +0100

[Message part 1 (text/plain, inline)]

On Fri, 17 Sep 2021 at 10:46:31 -0700, Vagrant Cascadian wrote:
> On 2021-08-29, Simon McVittie wrote:
> > If gnunet is built on a merged-/usr system
> 
> gnunet -> ng ? ... Or should this be reassigned to gnunet?

Sorry, that was copypasta from a previously-reported bug. ng and gnunet
both have bugs of this class. This one, #993275, is about ng's use of
cp and ls. The similar bug about gnunet's use of ifconfig is #993249.

> Since ng is maintained by QA, you could upload the fix yourself, or I
> may get to it in the coming weeks...

I don't know what ng is or how to test it, only how to build it and
throw it at diffoscope, so I'm unlikely to do a QA upload.

Looking at its package tracker page, it seems to be an Emacs-style
editor with CJK input support, and hasn't had an upstream release since
2003. I have to question whether this is something we really want in
the distribution, if nobody either inside or outside Debian wants to
maintain it...

    smcv

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 993275-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 993275-close@bugs.debian.org

Subject: Bug#993275: fixed in ng 1.5~beta1-10

Date: Tue, 28 Sep 2021 22:33:37 +0000

Source: ng
Source-Version: 1.5~beta1-10
Done: Vagrant Cascadian <vagrant@debian.org>

We believe that the bug you reported is fixed in the latest version of
ng, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 993275@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Vagrant Cascadian <vagrant@debian.org> (supplier of updated ng package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 28 Sep 2021 15:13:46 -0700
Source: ng
Architecture: source
Version: 1.5~beta1-10
Distribution: unstable
Urgency: medium
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Vagrant Cascadian <vagrant@debian.org>
Closes: 993275
Changes:
 ng (1.5~beta1-10) unstable; urgency=medium
 .
   * QA upload.
 .
   [ Debian Janitor ]
   * Trim trailing whitespace.
   * Set debhelper-compat version in Build-Depends.
   * Update standards version to 4.5.0, no changes needed.
 .
   [ Simon McVittie ]
   * d/rules: Specify canonical paths of cp, ls, mv, rmdir
     (Closes: #993275)
 .
   [ Vagrant Cascadian ]
   * debian/control: Set Rules-Requires-Root to "no".
   * debian/control: Update Standards-Version to 4.6.0.
   * Switch to debhelper-compat 13 and dh.
   * debian/rules: Remove boilerplate comments.
   * Use dh_install to install ng binaries and documentation.
   * Remove debian/*.dirs files as they are no longer necessary.
Checksums-Sha1:
 b400aff9d329554c77905cacd829a2b0a1ae16e7 1382 ng_1.5~beta1-10.dsc
 26a84ba4f183a9e43ffef35b99b1ae4143750de1 75936 ng_1.5~beta1-10.debian.tar.xz
 065f55bb36d06b4136d9c5fc003e36b116e6b774 6962 ng_1.5~beta1-10_amd64.buildinfo
Checksums-Sha256:
 7b56d5111002f5ca16f241de26a85087f8578c28fe5884ee3a4f117f41bfd45c 1382 ng_1.5~beta1-10.dsc
 cddf14c95e5fb6b7252daf388955ec8dacd1a714f8c6af22ae77da91ed277bea 75936 ng_1.5~beta1-10.debian.tar.xz
 270feedc5b349062ded26cabdd855bd83b4436f82b2a431c11e6ffc2d789b1d8 6962 ng_1.5~beta1-10_amd64.buildinfo
Files:
 6e5378e84093940b9c97afb3ab4abb5d 1382 editors optional ng_1.5~beta1-10.dsc
 435b19d77d4bf422f2d6a40677a2be4f 75936 editors optional ng_1.5~beta1-10.debian.tar.xz
 d6688401e35e4fa48f1ac955ad4f09d8 6962 editors optional ng_1.5~beta1-10_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iIkEARYKADEWIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYVOVSBMcdmFncmFudEBk
ZWJpYW4ub3JnAAoJENxRj8h/lxaq1nUBANRTFvgU0YekIQmvXXzK/tDsdXcjd3WP
kSFJM3pNorpdAP479u2D48B5YelTs5nEkfnk6On0xo+V5j5WQpKb39Z0Bg==
=P8M2
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.