[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#915348: foomatic-db-engine: reproducible build (usrmerge): embeds path of gzip (et.al.) found via PATH



Control: tags -1 +patch

Hi there Andreas,

Le dimanche, 2 décembre 2018, 22.47:12 h CET Andreas Henriksson a écrit :
> Thanks for looking into trying to make foomatic-dbengine reproducible
> on merged-usr vs non-merged, unfortunately you seem to have missed
> *atleast* one variable that still makes your package non-reproducible.

Indeed I did; so embarassing.

> The new version 4.0.13-2 still has problems with gzip.
> This should be easily fixable by just passing GZIP=/bin/gzip to
> configure the same way as the others, but bear with me because there
> are several other semi-related issues that you might also want to
> fix while at it (even though they have absolutely no relation to
> usrmerge).

Great, thanks for the scrutiny!

> Here's a snippet  from the diffoscope output by reproducible-builds:
> 
> │ │ │ ├── ./usr/share/perl5/Foomatic/Defaults.pm
> │ │ │ │ @@ -70,12 +70,12 @@
> │ │ │ │      'rlpr' => '/usr/bin/rlpr',
> │ │ │ │      'smbclient' => '/usr/bin/smbclient',
> │ │ │ │      'nprint' => '/usr/bin/nprint',
> │ │ │ │      'ptal-connect' => '/usr/bin/ptal-connect',
> │ │ │ │      'ptal-pipes' => '/var/run/ptal-printd',
> │ │ │ │      'mtink-pipes' => '/var/mtink',
> │ │ │ │      'cat' => '/bin/cat',
> │ │ │ │ -    'gzip' => '/bin/gzip',
> │ │ │ │ +    'gzip' => '/usr/bin/gzip',
> │ │ │ │      'wget' =>
> '/usr/bin:/bin:/usr/local/bin:/usr/sbin:/sbin:/usr/local/sbin:/etc/sbin', │
> │ │ │      'curl' =>
> '/usr/bin:/bin:/usr/local/bin:/usr/sbin:/sbin:/usr/local/sbin:/etc/sbin' │
> │ │ │  };
> 
> 
> Please notice the values for wget and curl!
> 
> Here's a quoted snippet from the configure.ac file in the source:
> > AC_PATH_PROG(CAT,cat,CAT_NOT_FOUND,$BSB)
> > AC_PATH_PROG(GS,gs,GHOSTSCRIPT_NOT_FOUND,$BSB)
> > AC_PATH_PROG(A2PS,a2ps,A2PS_NOT_FOUND,$BSB)
> > AC_PATH_PROG(WGET,wget,$BSB)
> 
> The $BSB should be the *fourth* argument. Now the search path is instead
> being used as the default value when wget is not found.
> 
> > AC_PATH_PROG(CURL,curl,$BSB)
> 
> Same as previous.
> 
> > if test -z "$CURL" -a -z "$CURL" ; then
> 
> One of these should likely be $WGET.
> 
> >         AC_MSG_ERROR("cannot find wget and curl.  You need to install at
> >         least o
> > 
> > ne");
> > fi
> > AC_PATH_PROG(PRINTF,printf,$BSB)dnl
> 
> Same problem as with WGET and CURL. The $BSB should be forth argument.
> 
> The above mentioned things are ofcourse upstream bugs which you
> might want to discuss to get fixed upstream.

Indeed. The following patch should do it.

-- a/configure.ac
+++ b/configure.ac
@@ -116,12 +116,12 @@ fi
 AC_PATH_PROG(CAT,cat,CAT_NOT_FOUND,$BSB)
 AC_PATH_PROG(GS,gs,GHOSTSCRIPT_NOT_FOUND,$BSB)
 AC_PATH_PROG(A2PS,a2ps,A2PS_NOT_FOUND,$BSB)
-AC_PATH_PROG(WGET,wget,$BSB)
-AC_PATH_PROG(CURL,curl,$BSB)
-if test -z "$CURL" -a -z "$CURL" ; then
+AC_PATH_PROG(WGET,wget,WGET_NOT_FOUND,$BSB)
+AC_PATH_PROG(CURL,curl,CURL_NOT_FOUND,$BSB)
+if test -z "$CURL" -a -z "$WGET" ; then
        AC_MSG_ERROR("cannot find wget and curl.  You need to install at least 
one");
 fi
-AC_PATH_PROG(PRINTF,printf,$BSB)dnl
+AC_PATH_PROG(PRINTF,printf,PRINTF_NOT_FOUND,$BSB)dnl
 
 # disable ghostscript check
 AC_MSG_CHECKING(Ghostscript check)

> Please also note that you most likely want to go over *all* AC_PROG_*
> and AC_PATH_PROG variables, see which ones gets embedded into shipped
> files (or just assume all of them), and pass all of those explicitly.
> If you don't do that then god forbid someone installed something in
> /usr/local which will instead be picked up.

I checked now that all the AC_* statements make sense. BUT… Setting all 
binaries through their fullpaths really feels like something that should be 
done through either automake globally, in debhelper (dh_auto_configure), or by 
having our packaging wrappers (dpkg comes to mind) provide PATHS with the 
expected binaries in the right places.

Worst case, diffoscope will come to help. :-)

> Hope this helps.

It does; thank you very much!

Cheers
    OdyX

Attachment: signature.asc
Description: This is a digitally signed message part.


Reply to: