Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries

From	Antonio Terceiro <terceiro@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries
Date	2022-07-27 14:00 +0200
Message-ID	<ENNRL-eafJ-5@gated-at.bofh.it> (permalink)
References	<DUSlQ-4lxV-17@gated-at.bofh.it> <DUSlQ-4lxV-17@gated-at.bofh.it> <EKajT-bWD8-9@gated-at.bofh.it> <DUSlQ-4lxV-17@gated-at.bofh.it> <EKajT-bWD8-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Control: clone -1 -2
Control: reassign -2 src:ruby3.1
Control: retitle -2 ruby3.1: reproducible builds: embeds path to various binaries

Hi,

On Sun, Jul 17, 2022 at 12:04:45PM +0100, Simon McVittie wrote:
> Control: severity -1 serious
> 
> On Fri, 25 Feb 2022 at 15:26:51 -0800, Vagrant Cascadian wrote:
> > The paths to various binaries, which differs on a usrmerge
> > vs. non-usrmerge system, are embedded in rbconfig.rb:
> > 
> >   https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/ruby3.0.html
> > 
> >   /usr/lib/x86_64-linux-gnu/ruby/3.0.0/rbconfig.rb
> > 
> >   CONFIG["EGREP"]·=·"/bin/grep·-E"
> >   vs.
> >   CONFIG["EGREP"]·=·"/usr/bin/grep·-E"
> 
> If these CONFIG variables are used for something at runtime, then this
> will become a practical problem as soon as Debian starts using merged-/usr
> buildds. The problem scenario is:
> 
> - ruby3.0 is built on a merged-/usr buildd
> - /usr/bin/grep is recorded in rbconfig.rb
> - this build of ruby3.0 is installed on a non-merged-/usr system during
>   the upgrade from Debian 11 to Debian 12
> - whatever feature uses CONFIG["EGREP"] will not work, because
>   non-merged-/usr systems only have /bin/grep
> 
> Technical Committee resolution
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994388#110 recommends
> that this class of bug is treated as release-critical, so I'm raising the
> severity of this bug report.
> 
> If none of the affected CONFIG variables are actually used for anything
> on installed systems, then the severity of this bug can be downgraded
> to non-RC (but it would be better to fix it anyway, because reproducible
> builds are a useful goal for other reasons).

Those variables are read from config.status during the builds. Maybe
this should be fixed centrally in autoconf instead?

> > Patch attached which passes variables to configure to use the
> > non-usrmerge locations, as usrmerge installations typically have
> > compatibility symlinks, but not vice-versa.
> 
> To clarify: in Debian, merged-/usr installations are *guaranteed* to
> have these compatibility symlinks. The patch looks appropriate to me,
> although I have not tested it.

Sure.

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries Antonio Terceiro <terceiro@debian.org> - 2022-07-27 14:00 +0200
  Processed: Re: Bug#1006471: ruby3.0: reproducible builds: embeds  path to various binaries "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-07-27 14:00 +0200
  Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries Simon McVittie <smcv@debian.org> - 2022-07-27 16:00 +0200
    Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries Antonio Terceiro <terceiro@debian.org> - 2022-07-29 13:10 +0200
      Processed: Re: Bug#1006471: ruby3.0: reproducible builds: embeds  path to various binaries "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-07-29 13:10 +0200

csiph-web