Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.rc > #323859 > unrolled thread

Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries

Back to article view | Back to linux.debian.bugs.rc

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries Antonio Terceiro <terceiro@debian.org> - 2022-07-27 14:00 +0200
    Processed: Re: Bug#1006471: ruby3.0: reproducible builds: embeds  path to various binaries "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-07-27 14:00 +0200
    Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries Simon McVittie <smcv@debian.org> - 2022-07-27 16:00 +0200
      Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries Antonio Terceiro <terceiro@debian.org> - 2022-07-29 13:10 +0200
        Processed: Re: Bug#1006471: ruby3.0: reproducible builds: embeds  path to various binaries "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-07-29 13:10 +0200

#323859 — Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries

[Multipart message — attachments visible in raw view] — view raw

Control: clone -1 -2
Control: reassign -2 src:ruby3.1
Control: retitle -2 ruby3.1: reproducible builds: embeds path to various binaries

Hi,

On Sun, Jul 17, 2022 at 12:04:45PM +0100, Simon McVittie wrote:
> Control: severity -1 serious
> 
> On Fri, 25 Feb 2022 at 15:26:51 -0800, Vagrant Cascadian wrote:
> > The paths to various binaries, which differs on a usrmerge
> > vs. non-usrmerge system, are embedded in rbconfig.rb:
> > 
> >   https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/diffoscope-results/ruby3.0.html
> > 
> >   /usr/lib/x86_64-linux-gnu/ruby/3.0.0/rbconfig.rb
> > 
> >   CONFIG["EGREP"]·=·"/bin/grep·-E"
> >   vs.
> >   CONFIG["EGREP"]·=·"/usr/bin/grep·-E"
> 
> If these CONFIG variables are used for something at runtime, then this
> will become a practical problem as soon as Debian starts using merged-/usr
> buildds. The problem scenario is:
> 
> - ruby3.0 is built on a merged-/usr buildd
> - /usr/bin/grep is recorded in rbconfig.rb
> - this build of ruby3.0 is installed on a non-merged-/usr system during
>   the upgrade from Debian 11 to Debian 12
> - whatever feature uses CONFIG["EGREP"] will not work, because
>   non-merged-/usr systems only have /bin/grep
> 
> Technical Committee resolution
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994388#110 recommends
> that this class of bug is treated as release-critical, so I'm raising the
> severity of this bug report.
> 
> If none of the affected CONFIG variables are actually used for anything
> on installed systems, then the severity of this bug can be downgraded
> to non-RC (but it would be better to fix it anyway, because reproducible
> builds are a useful goal for other reasons).

Those variables are read from config.status during the builds. Maybe
this should be fixed centrally in autoconf instead?

> > Patch attached which passes variables to configure to use the
> > non-usrmerge locations, as usrmerge installations typically have
> > compatibility symlinks, but not vice-versa.
> 
> To clarify: in Debian, merged-/usr installations are *guaranteed* to
> have these compatibility symlinks. The patch looks appropriate to me,
> although I have not tested it.

Sure.

[toc] | [next] | [standalone]

#323860 — Processed: Re: Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries

Processing control commands:

> clone -1 -2
Bug #1006471 [src:ruby3.0] ruby3.0: reproducible builds: embeds path to various binaries
Bug 1006471 cloned as bug 1016110
> reassign -2 src:ruby3.1
Bug #1016110 [src:ruby3.0] ruby3.0: reproducible builds: embeds path to various binaries
Bug reassigned from package 'src:ruby3.0' to 'src:ruby3.1'.
Ignoring request to alter found versions of bug #1016110 to the same values previously set
Ignoring request to alter fixed versions of bug #1016110 to the same values previously set
> retitle -2 ruby3.1: reproducible builds: embeds path to various binaries
Bug #1016110 [src:ruby3.1] ruby3.0: reproducible builds: embeds path to various binaries
Changed Bug title to 'ruby3.1: reproducible builds: embeds path to various binaries' from 'ruby3.0: reproducible builds: embeds path to various binaries'.

-- 
1006471: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006471
1016110: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016110
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#323863

On Wed, 27 Jul 2022 at 08:49:27 -0300, Antonio Terceiro wrote:
> > On Fri, 25 Feb 2022 at 15:26:51 -0800, Vagrant Cascadian wrote:
> > > The paths to various binaries, which differs on a usrmerge
> > > vs. non-usrmerge system, are embedded in rbconfig.rb:
> > > 
> > >   /usr/lib/x86_64-linux-gnu/ruby/3.0.0/rbconfig.rb
> > > 
> > >   CONFIG["EGREP"]·=·"/bin/grep·-E"
> > >   vs.
> > >   CONFIG["EGREP"]·=·"/usr/bin/grep·-E"
> > 
> > If these CONFIG variables are used for something at runtime, then this
> > will become a practical problem as soon as Debian starts using merged-/usr
> > buildds.
> 
> Those variables are read from config.status during the builds. Maybe
> this should be fixed centrally in autoconf instead?

autoconf is designed to support arbitrarily bad host OSs, including those
that are non-POSIX or otherwise defective, where the only fully-functional
grep might be /opt/sw/addons/misc/gnu/grep or something; so it has a
tendency to discover a known-good absolute path and save that.

This is great if you're building Ruby on an awful 1990s Unix machine
and the result of AC_PROG_EGREP will only be used during build, or if
it is used at runtime but you only plan to run the resulting Ruby binaries
on that same machine, but it goes wrong when facts about the build system
start to diverge from facts about the host system.
In this case, the fact that is different is the merged-/usr status
of the build system and the host system, but it could be almost anything.

The macros that Ruby uses to find these commands are probably AC_PROG_GREP,
AC_PROG_EGREP, etc., which are not explicitly documented to output an
absolute path (the documentation just says "whatever is chosen"), but
looking at their implementation, it seems they do: they are like
AC_PATH_PROG rather than AC_CHECK_PROG.

It's entirely possible that Ruby is not doing this deliberately, those
macros might well be a dependency for something else.

Is the Ruby build intentionally putting EGREP into rbconfig.rb for use by
some other component, or is it just populating that file with everything
that Autoconf happens to have discovered, on the off chance that it
might become necessary at some point? If the latter, then that seems
like it will cause unpredictable action-at-a-distance if Autoconf stops
needing to discover some particular thing (for instance if Autoconf's
maintainers decide that they are only going to support systems where
the first grep in PATH is POSIX.1-2001 compliant, and stop checking for a
possibly-better-quality grep elsewhere).

    smcv

[toc] | [prev] | [next] | [standalone]

#324008

[Multipart message — attachments visible in raw view] — view raw

Control: tag -1 + pending

On Wed, Jul 27, 2022 at 02:52:47PM +0100, Simon McVittie wrote:
> Is the Ruby build intentionally putting EGREP into rbconfig.rb for use by
> some other component, or is it just populating that file with everything
> that Autoconf happens to have discovered, on the off chance that it
> might become necessary at some point? If the latter, then that seems
> like it will cause unpredictable action-at-a-distance if Autoconf stops
> needing to discover some particular thing (for instance if Autoconf's
> maintainers decide that they are only going to support systems where
> the first grep in PATH is POSIX.1-2001 compliant, and stop checking for a
> possibly-better-quality grep elsewhere).

The later. Thanks for the explanation. This has already been fixed for
ruby3.1, and is fixed in git for ruby3.0.

[toc] | [prev] | [next] | [standalone]

#324009 — Processed: Re: Bug#1006471: ruby3.0: reproducible builds: embeds path to various binaries

Processing control commands:

> tag -1 + pending
Bug #1006471 [src:ruby3.0] ruby3.0: reproducible builds: embeds path to various binaries
Added tag(s) pending.

-- 
1006471: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006471
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.rc

csiph-web