#1061055 obs-build: init_buildsystem: improper debootstrap implementation violates assumption in Debian policy

Package:
obs-build
Source:
obs-build
Submitter:
Helmut Grohne
Date:
2024-01-17 16:15:03 UTC
Severity:
normal
Tags:
#1061055#5
Date:
2024-01-17 06:27:48 UTC
From:
To:
Hi,

obs-build has its own implementation of debootstrap in init_buildsystem.
Unlike other implementations, it does not ensure that packages from the
essential set have been configured before unpacking non-essential
packages. The Debian policy requires that essential packages have to
work at all times after having been configured at least once. Since
non-essential packages may assume presence of essential in their
Pre-Depends, essential packages must be configured before unpacking
non-essential packages. obs-build's implementation does not ensure this
property. We can see this in e.g.
https://build.opensuse.org/package/live_build_log/home:unit193/certbot-dns-porkbun/Debian_Testing/x86_64
where essential package bash is installed after non-essential package
python3-cffi-backend.

The current work on /usr-merge heavily relies on this property. One of
the next steps is adding the aliasing symlinks to base-files. If any
non-essential package with aliased files is installed before base-files,
the aliasing links will be lost and the created chroot will not work at
all. I think the property expected here is reasonable and the bug
resides with obs-build. In particular, it is a bug that also affects
upstream and the upstream deployment at build.opensuse.org.

Helmut

#1061055#10
Date:
2024-01-17 16:01:12 UTC
From:
To:
init_buildsystem.
the
this
https://build.opensuse.org/package/live_build_log/home:unit193/certbot-dns-porkbun/Debian_Testing/x86_64
of
files,
at

I asked the admins and the prjconf for both testing and unstable have
been fixed so that usrmerge is installed before systemd and udev, so
builds should be working again now.

#1061055#15
Date:
2024-01-17 16:13:03 UTC
From:
To:
Hi all,
Another way, and that’s how we do it in Apertis, is to use buildengine: debootstrap.
That way obs-build only creates a minimal chroot necessary to run debootstrap, and then debootstrap is going to do the right thing.