Bug#915348: foomatic-db-engine: reproducible build (usrmerge): embeds path of gzip (et.al.) found via PATH

[Andreas Henriksson <andreas@fatal.se>]

Package: foomatic-db-engine
Version: 4.0.13-2
Severity: normal
User: md@linux.it
Usertags: usrmerge

Dear Maintainer,

Thanks for looking into trying to make foomatic-dbengine reproducible
on merged-usr vs non-merged, unfortunately you seem to have missed
*atleast* one variable that still makes your package non-reproducible.

The new version 4.0.13-2 still has problems with gzip.
This should be easily fixable by just passing GZIP=/bin/gzip to
configure the same way as the others, but bear with me because there
are several other semi-related issues that you might also want to
fix while at it (even though they have absolutely no relation to
usrmerge).

Here's a snippet  from the diffoscope output by reproducible-builds:

│ │ │ ├── ./usr/share/perl5/Foomatic/Defaults.pm
│ │ │ │ @@ -70,12 +70,12 @@
│ │ │ │      'rlpr' => '/usr/bin/rlpr',
│ │ │ │      'smbclient' => '/usr/bin/smbclient',
│ │ │ │      'nprint' => '/usr/bin/nprint',
│ │ │ │      'ptal-connect' => '/usr/bin/ptal-connect',
│ │ │ │      'ptal-pipes' => '/var/run/ptal-printd',
│ │ │ │      'mtink-pipes' => '/var/mtink',
│ │ │ │      'cat' => '/bin/cat',
│ │ │ │ -    'gzip' => '/bin/gzip',
│ │ │ │ +    'gzip' => '/usr/bin/gzip',
│ │ │ │      'wget' => '/usr/bin:/bin:/usr/local/bin:/usr/sbin:/sbin:/usr/local/sbin:/etc/sbin',
│ │ │ │      'curl' => '/usr/bin:/bin:/usr/local/bin:/usr/sbin:/sbin:/usr/local/sbin:/etc/sbin'
│ │ │ │  };


Please notice the values for wget and curl!

Here's a quoted snippet from the configure.ac file in the source:

> AC_PATH_PROG(CAT,cat,CAT_NOT_FOUND,$BSB)
> AC_PATH_PROG(GS,gs,GHOSTSCRIPT_NOT_FOUND,$BSB)
> AC_PATH_PROG(A2PS,a2ps,A2PS_NOT_FOUND,$BSB)
> AC_PATH_PROG(WGET,wget,$BSB)

The $BSB should be the *fourth* argument. Now the search path is instead
being used as the default value when wget is not found.

> AC_PATH_PROG(CURL,curl,$BSB)

Same as previous.

> if test -z "$CURL" -a -z "$CURL" ; then

One of these should likely be $WGET.

>         AC_MSG_ERROR("cannot find wget and curl.  You need to install at least o
> ne");
> fi
> AC_PATH_PROG(PRINTF,printf,$BSB)dnl

Same problem as with WGET and CURL. The $BSB should be forth argument.

The above mentioned things are ofcourse upstream bugs which you
might want to discuss to get fixed upstream.


Please also note that you most likely want to go over *all* AC_PROG_*
and AC_PATH_PROG variables, see which ones gets embedded into shipped
files (or just assume all of them), and pass all of those explicitly.
If you don't do that then god forbid someone installed something in
/usr/local which will instead be picked up.

Hope this helps.

Regards,
Andreas Henriksson