989963">

Debian Bug report logs - #989963
tclap: reproducible-builds: Embeds build path, binary paths and SHELL in example Makefiles

version graph

Package: src:tclap; Maintainer for src:tclap is Dirk Eddelbuettel <edd@debian.org>;

Reported by: Vagrant Cascadian <vagrant@reproducible-builds.org>

Date: Wed, 16 Jun 2021 20:57:01 UTC

Severity: normal

Tags: patch

Fixed in version tclap/1.2.4-2

Done: Dirk Eddelbuettel <edd@debian.org>

Bug is archived. No further changes may be made.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, reproducible-bugs@lists.alioth.debian.org, Dirk Eddelbuettel <edd@debian.org>:
Bug#989963; Package src:tclap. (Wed, 16 Jun 2021 20:57:03 GMT) (full text, mbox, link).


Acknowledgement sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
New Bug report received and forwarded. Copy sent to reproducible-bugs@lists.alioth.debian.org, Dirk Eddelbuettel <edd@debian.org>. (Wed, 16 Jun 2021 20:57:03 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@reproducible-builds.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: tclap: reproducible-builds: Embeds build path, binary paths and SHELL in example Makefiles
Date: Wed, 16 Jun 2021 13:52:05 -0700
[Message part 1 (text/plain, inline)]
Source: tclap
Severity: normal
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: buildpath usrmerge shell
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org

The build path, several binary paths, and the value of the SHELL
variable are embedded in example Makefiles shipped in the package:

  https://tests.reproducible-builds.org/debian/rb-pkg/unstable/i386/diffoscope-results/tclap.html

  /usr/share/doc/libtclap-dev/docs/Makefile.gz

  AUTOMAKE·=·${SHELL}·'/build/1st/tclap-1.2.4/config/missing'·automake-1.16
  vs.
  AUTOMAKE·=·${SHELL}·'/build/2/tclap-1.2.4/2nd/config/missing'·automake-1.16

  GREP·=·/bin/grep
  vs.
  GREP·=·/usr/bin/grep

  SHELL·=·/bin/bash
  vs.
  SHELL·=·/bin/sh


Since these values may differ with the installed system, in order to use
the example Makefiles, a person would have to regenerate them from
Makefile.am or Makefile.in, which are also provided.

The attached patch removes the Makefiles in debian/rules.

If that is somehow not an option, an alternate option would be to
sanitize the Makefiles stripping the build path (or replacing with
/usr/src?), and possibly passing various variables to configure
(e.g. GREP=/bin/grep, SHELL=/bin/sh, ...).


Thanks for maintaining tclap!


live well,
  vagrant

[0001-debian-rules-Remove-example-Makefiles-for-reproducib.patch (text/x-diff, inline)]
From 08de495eeae4305e7e68486e69b8b830e39e4797 Mon Sep 17 00:00:00 2001
From: Vagrant Cascadian <vagrant@reproducible-builds.org>
Date: Wed, 16 Jun 2021 20:21:30 +0000
Subject: [PATCH] debian/rules: Remove example Makefiles for reproducible
 builds.

The shipped Makefiles embed build paths, the content of the SHELL
variable, and paths to various binaries (e.g. /bin/grep
vs. /usr/bin/grep).
---
 debian/rules | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/debian/rules b/debian/rules
index 4c64ef9..b849adf 100755
--- a/debian/rules
+++ b/debian/rules
@@ -9,6 +9,9 @@ override_dh_installdocs:
 	dh_installdocs
         # edd 10 Jun 2011 prune CVS directory
 	find debian/ -name CVS -type d | xargs rm -rf
+	# Remove example Makefiles for reproducible builds as they
+	# embed the build path, SHELL and various paths to utilities
+	find debian/ -name Makefile -type f | xargs rm -f
 
 override_dh_auto_test:
 	echo "Skipping checks for now"
-- 
2.20.1

[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org:
Bug#989963; Package src:tclap. (Wed, 16 Jun 2021 21:48:03 GMT) (full text, mbox, link).


Acknowledgement sent to Dirk Eddelbuettel <edd@debian.org>:
Extra info received and forwarded to list. (Wed, 16 Jun 2021 21:48:03 GMT) (full text, mbox, link).


Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Dirk Eddelbuettel <edd@debian.org>
To: Vagrant Cascadian <vagrant@reproducible-builds.org>, 989963@bugs.debian.org
Cc: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Re: Bug#989963: tclap: reproducible-builds: Embeds build path, binary paths and SHELL in example Makefiles
Date: Wed, 16 Jun 2021 16:37:41 -0500
Hi there,

On 16 June 2021 at 13:52, Vagrant Cascadian wrote:
| Source: tclap
| Severity: normal
| Tags: patch
| User: reproducible-builds@lists.alioth.debian.org
| Usertags: buildpath usrmerge shell
| X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org
| 
| The build path, several binary paths, and the value of the SHELL
| variable are embedded in example Makefiles shipped in the package:
| 
|   https://tests.reproducible-builds.org/debian/rb-pkg/unstable/i386/diffoscope-results/tclap.html
| 
|   /usr/share/doc/libtclap-dev/docs/Makefile.gz
| 
|   AUTOMAKE·=·${SHELL}·'/build/1st/tclap-1.2.4/config/missing'·automake-1.16
|   vs.
|   AUTOMAKE·=·${SHELL}·'/build/2/tclap-1.2.4/2nd/config/missing'·automake-1.16
| 
|   GREP·=·/bin/grep
|   vs.
|   GREP·=·/usr/bin/grep
| 
|   SHELL·=·/bin/bash
|   vs.
|   SHELL·=·/bin/sh
| 
| 
| Since these values may differ with the installed system, in order to use
| the example Makefiles, a person would have to regenerate them from
| Makefile.am or Makefile.in, which are also provided.
| 
| The attached patch removes the Makefiles in debian/rules.

Let me try that! I presume we want an upload to experimental?

Thanks for looking into this!

Dirk

| If that is somehow not an option, an alternate option would be to
| sanitize the Makefiles stripping the build path (or replacing with
| /usr/src?), and possibly passing various variables to configure
| (e.g. GREP=/bin/grep, SHELL=/bin/sh, ...).
| 
| 
| Thanks for maintaining tclap!
| 
| 
| live well,
|   vagrant
| 
| From 08de495eeae4305e7e68486e69b8b830e39e4797 Mon Sep 17 00:00:00 2001
| From: Vagrant Cascadian <vagrant@reproducible-builds.org>
| Date: Wed, 16 Jun 2021 20:21:30 +0000
| Subject: [PATCH] debian/rules: Remove example Makefiles for reproducible
|  builds.
| 
| The shipped Makefiles embed build paths, the content of the SHELL
| variable, and paths to various binaries (e.g. /bin/grep
| vs. /usr/bin/grep).
| ---
|  debian/rules | 3 +++
|  1 file changed, 3 insertions(+)
| 
| diff --git a/debian/rules b/debian/rules
| index 4c64ef9..b849adf 100755
| --- a/debian/rules
| +++ b/debian/rules
| @@ -9,6 +9,9 @@ override_dh_installdocs:
|  	dh_installdocs
|          # edd 10 Jun 2011 prune CVS directory
|  	find debian/ -name CVS -type d | xargs rm -rf
| +	# Remove example Makefiles for reproducible builds as they
| +	# embed the build path, SHELL and various paths to utilities
| +	find debian/ -name Makefile -type f | xargs rm -f
|  
|  override_dh_auto_test:
|  	echo "Skipping checks for now"
| -- 
| 2.20.1
| 
| x[DELETED ATTACHMENT signature.asc, application/pgp-signature]

-- 
https://dirk.eddelbuettel.com | @eddelbuettel | edd@debian.org



Information forwarded to debian-bugs-dist@lists.debian.org:
Bug#989963; Package src:tclap. (Wed, 16 Jun 2021 21:48:04 GMT) (full text, mbox, link).


Acknowledgement sent to Dirk Eddelbuettel <edd@debian.org>:
Extra info received and forwarded to list. (Wed, 16 Jun 2021 21:48:04 GMT) (full text, mbox, link).


Reply sent to Dirk Eddelbuettel <edd@debian.org>:
You have taken responsibility. (Wed, 16 Jun 2021 22:36:03 GMT) (full text, mbox, link).


Notification sent to Vagrant Cascadian <vagrant@reproducible-builds.org>:
Bug acknowledged by developer. (Wed, 16 Jun 2021 22:36:03 GMT) (full text, mbox, link).


Message #20 received at 989963-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
To: 989963-close@bugs.debian.org
Subject: Bug#989963: fixed in tclap 1.2.4-2
Date: Wed, 16 Jun 2021 22:33:38 +0000
Source: tclap
Source-Version: 1.2.4-2
Done: Dirk Eddelbuettel <edd@debian.org>

We believe that the bug you reported is fixed in the latest version of
tclap, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 989963@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dirk Eddelbuettel <edd@debian.org> (supplier of updated tclap package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 16 Jun 2021 16:40:41 -0500
Source: tclap
Architecture: source
Version: 1.2.4-2
Distribution: experimental
Urgency: medium
Maintainer: Dirk Eddelbuettel <edd@debian.org>
Changed-By: Dirk Eddelbuettel <edd@debian.org>
Closes: 989963
Changes:
 tclap (1.2.4-2) experimental; urgency=medium
 .
   * debian/rules: Remove Makefile(s) to help reproducible builds (with
     thanks to Vagrant Cascadian) 			(Closes: #989963)
Checksums-Sha1:
 9adb41e5fabadda420996ac0593fc456ec3f3614 1759 tclap_1.2.4-2.dsc
 44dd8b17f0a008f11fc08a948ac72e37ad076ef1 3188 tclap_1.2.4-2.debian.tar.xz
 41fbdf094a1d5623fa44f1486def949edf82f778 5382 tclap_1.2.4-2_amd64.buildinfo
Checksums-Sha256:
 0098b35421fe4a6f88b757f2de2c586adc34831b446556e40d4e334e3c2eec5c 1759 tclap_1.2.4-2.dsc
 8b2afd9f8a1938688f96bd6d4dd4253b058dcd24b68e167c2355a402ed531101 3188 tclap_1.2.4-2.debian.tar.xz
 a9f796c73d622b2da171c23977ce0a4e7d84db9a49f19cf9470e062f1c1d28a0 5382 tclap_1.2.4-2_amd64.buildinfo
Files:
 b23c3468132a9eb175416c2cba13b860 1759 devel optional tclap_1.2.4-2.dsc
 3146486e5c983e9a395cae3743c61bc6 3188 devel optional tclap_1.2.4-2.debian.tar.xz
 43271f0139eff5e73f88eac648160e60 5382 devel optional tclap_1.2.4-2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIVAwUBYMp2haFIn+KrmaIaAQiNNw/+J5beaSMP9Irir9S0RXG4aLj0fUPVoCZJ
rvQDPM58TqE0NhQJ5yuVq4ZlRs28lYWmHZY2tn26c+bjJR3Yctyp6bdRL2o5OAaD
xSJ2N8kvK0laS3Ly9ki0WU4xPHM1xWH+/ou5xpDYCkjLCPrQZxPID8XQyni88p+N
LVrBIMcl1Jx+s0oqxr4qElWnmyYB6iJN0GHRQLbhvEb885ATr7Ry6VjIK70YM6Od
0yWGVUvgHBHgTQ5fUTpN658UTBGRIfOmCXSVzHGxg01iCxypNK+tx/TTk9lW+LyJ
N3nOXmAOr8CDV5KIfH6ltiMGrYdvVu51y900MUkiseu4iYU1tZz2Nx6EZsboeKir
muIkWOKGvgPnEKN0+19T4kwnVHOf7e6tw82cF08/JiKeHgIddGnyKkn1d3fizjxa
qq3/7rK0Ka1bOkpNSmu6XB1B9L9p+x+WER7PgDEVbcq9CvOnfgdMTwKCNNQcguRn
9+wxTMf4ToAwV+zRE0DnJE77duo7kr9luJUSDODHaf/tXolxDlzyPTDrvPCyai1r
4460KD673l9ASTJU9nl5yCcfLpM0Iks+j0CVR+vFrqByjduzymK7tZ4NrgFRM3LA
Vmf0GJV6I0ZhUdjtUGdALOswsb73KLTow2daW1w6zHA32GZOPDxHrYBnS8ydUpjH
RaITrwoq0dk=
=Lo8A
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 23 Aug 2021 07:26:56 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Jan 31 00:37:01 2025; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.