Hi team,

Thanks for maintaining this amazing tool!

I hit a weird issue that I didn’t try to debug, but that may be of some
interest to you. I’ve not been able to use diffoscope between the latest
two version of php-react-promise (arch:all package, I use diffoscope all
the time to check for regression before upload, it usually goes well).
This time, it provide a few thousand lines of (useless?) information.

$ diffoscope php-react-promise_2.*deb
--- php-react-promise_2.7.0-2_all.deb
+++ php-react-promise_2.9.0-1_all.deb
@@ -1,1166 +1,1394 @@
 00000000: 213c 6172 6368 3e0a 6465 6269 616e 2d62  !<arch>.debian-b
-00000010: 696e 6172 7920 2020 3136 3132 3133 3931  inary   16121391
-00000020: 3738 2020 3020 2020 2020 3020 2020 2020  78  0     0     
+00000010: 696e 6172 7920 2020 3136 3533 3432 3735  inary   16534275
+00000020: 3736 2020 3020 2020 2020 3020 2020 2020  76  0     0
 00000030: 3130 3036 3434 2020 3420 2020 2020 2020  100644  4
 00000040: 2020 600a 322e 300a 636f 6e74 726f 6c2e    `.2.0.control.
-00000050: 7461 722e 787a 2020 3136 3132 3133 3931  tar.xz  16121391
-00000060: 3738 2020 3020 2020 2020 3020 2020 2020  78  0     0     
-00000070: 3130 3036 3434 2020 3131 3638 2020 2020  100644  1168    
+00000050: 7461 722e 787a 2020 3136 3533 3432 3735  tar.xz  16534275
+00000060: 3736 2020 3020 2020 2020 3020 2020 2020  76  0     0
+00000070: 3130 3036 3434 2020 3131 3736 2020 2020  100644  1176
 00000080: 2020 600a fd37 7a58 5a00 0004 e6d6 b446    `..7zXZ......F
[…]

I noticed a difference in the file(1) output that might be a clue:

$ file php-react-promise_2.*deb
php-react-promise_2.7.0-2_all.deb: sticky Debian binary package (format 2.0), with control.tar.xz, data compression xz
php-react-promise_2.9.0-1_all.deb: Debian binary package (format 2.0), with control.tar.xz, data compression xz

Regards

David

bit (and not only):
https://github.com/file/file/commit/0205ccd7efb6ec1dab25d4641e42a684a2749a1c
(the recent version:
https://github.com/file/file/blob/master/src/fsmagic.c#L174)


My honest thought it that this is just distracting: the attribtes of
files are already part of stat(1) output's (also included in some cases
IIRC) and, at least for things outside of archives, it's not actually an
attribute of the file but rather of the underlying file system.

That said, changing all regex with have to prepend
'(?:(?:setuid|setgid|sticky) )?' or such feels… suboptimal :)

Hi David,

Thanks!

Huh, that's interesting! Here's the relevant code section from file's
src/fsmagic.c:

        if (sb->st_mode & S_ISVTX)
            if (file_printf(ms, "%ssticky", COMMA) == -1)
                return -1;

sb is a stat(1) struct.

So, diffoscope uses regular expressions to match the output of file,
and many of the patterns use the start-of-string anchor (ie. "^").
We'll therefore need to find a way of convincing file to either not
prefix the string with "sticky" (and "setuid" or "setgid" now that I
look at the code...), or strip it out manually within diffoscope if
that is not possible.

(Seems a little odd that file adds this info at all IMHO. I would have
guessed that those are actually properties of the ~filesystem, not the
file itself...)

Anyway, should be easily fixed; will get to this ASAP.


Regards,

tags 1011635 + pending
thanks

Fixed in Git, pending upload:

https://salsa.debian.org/reproducible-builds/diffoscope/commit/c6153ea88374864082f0a71c45a17887dd18a199

Thanks for the helpful report.


Regards,

We believe that the bug you reported is fixed in the latest version of
diffoscope, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1011635@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated diffoscope package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 03 Jun 2022 06:54:48 +0100
Source: diffoscope
Built-For-Profiles: nocheck
Architecture: source
Version: 215
Distribution: unstable
Urgency: medium
Maintainer: Reproducible builds folks <reproducible-builds@lists.alioth.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Closes: 1011635 1012258
Changes:
 diffoscope (215) unstable; urgency=medium
 .
   [ Chris Lamb ]
   * Bug fixes:
     - Also catch IndexError (in addition to ValueError) when parsing .pyc
       files. (Closes: #1012258)
     - Strip "sticky" etc. from "x.deb: sticky Debian binary package […]".
       Thanks to David Prévot for the report. (Closes: #1011635)
     - Correctly package diffoscope's scripts/ directory, fixing the extraction
       of vmlinuz kernel images. (Closes: reproducible-builds/diffoscope#305)
     - Correct the logic for supporting different versions of argcomplete in
       debian/rules.
 .
   * New features:
     - Support both PyPDF 1.x and 2.x.
 .
   * Codebase improvements:
     - Don't call re.compile and then call .sub on the result; just call
       re.sub directly.
     - Clarify the logic around the difference between --usage and --help.
 .
   * Testsuite improvements:
     - Integrate test coverage with GitLab's concept of artifacts.
     - Re-enable Gnumeric tests as its now available again.
     - Test --help and --usage, and additionally test that --help includes
       the programmatically-generated file format list as well.
 .
   [ Holger Levsen ]
   * Bump Standards Version field in debian/control to 4.6.1.
Checksums-Sha1:
 3952f5b86fb57c88f1f7dbb0a7641b213cede492 4966 diffoscope_215.dsc
 bb1fc71692d804d673bb46edf1f23266317eb584 2097172 diffoscope_215.tar.xz
 dfc79e2ba8651808b1b20c4933a602458d857503 7119 diffoscope_215_amd64.buildinfo
Checksums-Sha256:
 60ecf0d5e95e3b69651e0881ab373c332b7f7fb942ad467adc30ea6afba79f2c 4966 diffoscope_215.dsc
 fa920480e97118e53b39cee0ced2dfec219528334eacd5d50fa9f081162ad483 2097172 diffoscope_215.tar.xz
 87a4d2e842e85fa5a29ba6910fa9634ed99a13b1bc5135f3b0d76871f35d43b6 7119 diffoscope_215_amd64.buildinfo
Files:
 934c25b7fafa4ac8de03f5e12dc55099 4966 devel optional diffoscope_215.dsc
 de5f4e9d5d06897a2516a8d0fc46f019 2097172 devel optional diffoscope_215.tar.xz
 d219047424e8b161a1a777aee7f4d750 7119 devel optional diffoscope_215_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmKZonAACgkQHpU+J9Qx
HlgUHhAAwOtGabSktlUwjtMemIgw6zkwG+fHmmSqpCCEyUkv7cM8FSD5s7kMYQBr
FYAH54wZb/MS1YapUKdVVCyJZUnPBOsZM5DeRtF1KUEIh4raiRhNGxCTPifo0ACe
zh02DkK36IxrUNPNSWxuBpKmph4yBsI9XI9XqdEPmudnVjY6mK014P+H+rxX62vC
Yl1BV848JK77A8PYsIRnftWMg7BhEeU4+niubkEHf7+2xf1/lOK57Axq+CNuxTYI
0CPJJtvXEX/VygYX8qKr9JB++HQCaEcHLFMte9O+vSloOBzds7DJZX/KCzAymmt7
BuxvLB/zCstNgOjGIug5CxPQtW054ZR05HDPwUyob0FBeEeORARsuSxpGaicUnPS
AieWfehwY77hwAwWhqyhOxa9xwGjns+6u4D304mlprGlOwjHI6gh7G81CWPvQIn6
6aV0++Wm8dfywX55rNDajOAXhFdHItFJaAWFL7vupGjVynCD0meB/KbaP659UbqE
LYXG+Q9y3hZxflhAg7/K8uQeWNogTx+BhYaPgYUN/1IoUQoV2f/IFYBkdyvB3FAO
2OFn8Pd6hTwlBW3Q3LfHwiU7bZh6nXlAarOJbBfttcCftebiiPuc7yfwiCO3ExwY
67DcBUjq3oedOJK+aPLEAGgpdB3z09UilO8OtsnuNy85uFWnmT0=
=oJ4F
-----END PGP SIGNATURE-----