[CC sudo maintainer since this was triggered by a change in sudo]

reprotest just started failing in trixie.  Compare these two logs:

https://salsa.debian.org/freexian-team/debusine/-/jobs/7775488
https://salsa.debian.org/freexian-team/debusine/-/jobs/7776774

The relevant parts of the diff are (a) that the failing version
installed sudo 1.9.16p2-3, and (b) the following:

+sudo: a remote host may only be specified when listing privileges.
+sudo: a remote host may only be specified when listing privileges.
+sudo: a remote host may only be specified when listing privileges.
+rmdir: '/tmp/reprotest.A2zxWh/const_build_path/' kustutamine ebaõnnestus: Aucun fichier ou dossier de ce nom
+cleanup failed with exit code 1
+Traceback (most recent call last):
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 862, in run
+    return 0 if check_func(*check_args) else 1
+                ~~~~~~~~~~^^^^^^^^^^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 379, in check
+    local_dists += [proc.send(nv) for nv in zip(bnames[1:], build_variations[1:])]
+                    ~~~~~~~~~^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 339, in corun_builds
+    bctx.run_build(testbed, build, os.environ, artifact_pattern, testbed_build_pre, no_clean_on_error)
+    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 218, in run_build
+    testbed.check_exec2(build_argv,
+    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^
+        xenv=['-i'] + ['%s=%s' % (k, v) for k, v in build.env.items()],
+        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+        kind='build')
+        ^^^^^^^^^^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 63, in check_exec2
+    self.bomb('"%s" failed with status %i' % (' '.join(argv), code),
+    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+              adtlog.AutopkgtestError)
+              ^^^^^^^^^^^^^^^^^^^^^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 70, in bomb
+    raise _type(m)
+reprotest.lib.adtlog.AutopkgtestError: "sh -ec run_build() {
+    mkdir -p /tmp/reprotest.A2zxWh/build-experiment-1-aux && \
+    mv /tmp/reprotest.A2zxWh/build-experiment-1/ /tmp/reprotest.A2zxWh/const_build_path && \
+    SETARCH_ARCH=$(for a in $(setarch --list); do setarch $a true && echo $a || true; done) && \
+    DROP_ARCH="-v -e ^$(uname -m)\$" && \
+    WORDSIZE=64 && \
+    if [ $WORDSIZE -eq 64 ]; then     for _ARCH_TO_DROP in armh armv7b armv7l         armv8b armv8l arm athlon i386 i486         i586 i686 linux32 mips32 mips parisc32         parisc ppc32le ppc32 ppcle ppc s390         sparc32bash sparc32 sparc;     do         DROP_ARCH="$DROP_ARCH -e ^$_ARCH_TO_DROP\$";     done; fi && \
+    SETARCH_ARCH=$(echo "$SETARCH_ARCH" | grep $DROP_ARCH | shuf -n1) && \
+    KERNEL_VERSION=$(uname -r) && \
+    if [ ${KERNEL_VERSION#2.6} = $KERNEL_VERSION ]; then SETARCH_OPTS=--uname-2.6; fi && \
+    echo "INFO:reprotest.build:KERNEL variation: SETARCH_ARCH = '$SETARCH_ARCH' SETARCH_OPTS = '$SETARCH_OPTS'" >&2 && \
+    CPU_MAX=$(nproc) && \
+    CPU_MIN=$({ echo $CPU_MAX; echo 2; } | sort -n | head -n1) && \
+    CPU_NUM=$(if [ $CPU_MIN = $CPU_MAX ];             then echo $CPU_MIN; echo >&2 "only 1 CPU is available; num_cpus is ineffective";             else shuf -i$((CPU_MIN + 1))-$CPU_MAX -n1; fi) && \
+    export CPU_LIST="$(echo $(shuf -i0-$((CPU_MAX - 1)) -n$CPU_NUM) | tr ' ' ,)" && \
+    echo "INFO:reprotest.build:NUM_CPUS variation: cpu_list = $CPU_LIST" >&2 && \
+    sh -ec '
+        mkdir -p "/tmp/reprotest.A2zxWh/bin"
+        printf '"'"'#!/bin/sh\nsudo -h localhost -E -u salsa-ci env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER /usr/bin/disorderfs "$@"\n'"'"' > "/tmp/reprotest.A2zxWh/bin"/disorderfs
+        chmod +x "/tmp/reprotest.A2zxWh/bin"/disorderfs
+        printf '"'"'#!/bin/sh\nsudo -h localhost -E -u salsa-ci env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER /bin/mkdir "$@"\n'"'"' > "/tmp/reprotest.A2zxWh/bin"/mkdir
+        chmod +x "/tmp/reprotest.A2zxWh/bin"/mkdir
+        printf '"'"'#!/bin/sh\nsudo -h localhost -E -u salsa-ci env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER /bin/fusermount "$@"\n'"'"' > "/tmp/reprotest.A2zxWh/bin"/fusermount
+        chmod +x "/tmp/reprotest.A2zxWh/bin"/fusermount
+    ' && \
+    export PATH="/tmp/reprotest.A2zxWh/bin:$PATH" && \
+    mv /tmp/reprotest.A2zxWh/const_build_path/ /tmp/reprotest.A2zxWh/const_build_path-before-disorderfs/ && \
+    mkdir -p /tmp/reprotest.A2zxWh/const_build_path/ && \
+    disorderfs >&2 --shuffle-dirents=yes /tmp/reprotest.A2zxWh/const_build_path-before-disorderfs/ /tmp/reprotest.A2zxWh/const_build_path/ && \
+    touch /tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts && \
+    sudo -h localhost unshare --uts=/tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts true && \
+    sudo -h localhost nsenter --uts=/tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts hostname reprotest-capture-hostname && \
+    sudo -h localhost nsenter --uts=/tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts domainname reprotest-capture-domainname && \
+    umask 0002 && \
+    export REPROTEST_BUILD_PATH=/tmp/reprotest.A2zxWh/const_build_path/ && \
+    export REPROTEST_UMASK=$(umask) && \
+    sudo -h localhost -E nsenter --uts=/tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts sudo -h localhost -E -u salsa-ci -g users env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER \
+    sudo -h localhost -E -u salsa-ci env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER \
+    taskset -a -c $CPU_LIST \
+    setarch $SETARCH_ARCH $SETARCH_OPTS \
+    sh -ec 'cd "$REPROTEST_BUILD_PATH"; unset REPROTEST_BUILD_PATH; umask "$REPROTEST_UMASK"; unset REPROTEST_UMASK; dpkg-source -x "debusine_0.11.1+salsaci+20250630+7992.dsc" "$(basename "$PWD")" && cd "$(basename "$PWD")" && dpkg-buildpackage --no-sign -b'
+}

reprotest has the following comment and code:

  # -h localhost otherwise we get annoying messages about "can't resolve host"
  # especially when doing the domain_host variation
  SUDO = ['sudo', '-h', 'localhost']

So given that, I'm not sure how to fix this.  Any suggestions?

Thanks,

Control: affects -1 sudo

Well, it's definitely due to the new sudo, since it has this change in
the patch for CVE-2025-32462, backported from
https://github.com/sudo-project/sudo/commit/d530367828e3713d09489872743eb92d31fb11ff:

+    /* The user may only specify a host for "sudo -l". */
+    if (!ISSET(ctx->mode, MODE_LIST|MODE_CHECK)) {
+       if (strcmp(ctx->runas.host, ctx->user.host) != 0) {
+           log_warningx(ctx, SLOG_NO_STDERR|SLOG_AUDIT,
+               N_("user not allowed to set remote host for command"));
+           sudo_warnx("%s",
+               U_("a remote host may only be specified when listing privileges."));
+           ret = false;
+           goto done;
+       }
+    }

I think reprotest's sudoers file uses "ALL" as the host throughout, and
https://www.openwall.com/lists/oss-security/2025/06/30/2 seems to say
that this security vulnerability never affected rules for the host "ALL"
in the first place.  Is it possible that the fix was overbroad?

If reprotest can't drop the -h option for other reasons, then I guess it
might be possible for reprotest to use socket.gethostname() instead of
localhost, but I'm not sure how guaranteed it is that that will match
the output of sudo_gethostname().

Good morning everybody,

sudo maintainer here.

| -h host, --host=host
|         Run the command on the specified host  if  the  security  policy
|         plugin  supports  remote  commands.  The sudoers plugin does not
|         currently support running remote commands. This may also be used
|         in conjunction with the -l option to list  a  user's  privileges
|         for the remote host.

That says that the -h host notation has two uses: To run a remote
command (which is not supported by the suoders plugin anyway) and to
list a user's privileges for the remote host.

I'd interpret this as reprotest's call sudo -h localhost using
undocumented behavior.

I will talk to sudo upstream about this and report back.

Greetings
Marc

it looks like this part of reprotest has only worked because sudo
wrongly didnt check the host name in this call.

This doesn't help you at the moment, but I have been in touch with
upstream. sudo will disable the --with-fqdn flat at compile time after
trixie's release and instead set it in the default sudoers file that
comes with sudo.

You might wanto try "Defaults !fqdn". This SHOULD turn off the fqdn flag
even in our builds that have --with-fqdn enabled at compile time. Maybe
this helps. I am not in a position to try at this time. Let me know
whether it helps.

Greetings
Marc

sudo Upstream confirms that adding "Defaults !fqdn" to /etc/sudoers
should work. Please report back if it doesn't.

Greetings
Marc

Simply removing (both instances of) -h localhost builds and passes
autopkgtests, but has *not* been tested beyond that; in particular, I do
*not* know whether it opens any security holes reprotest doesn't already
have.

https://salsa.debian.org/rnpalmer-guest/reprotest/-/commits/test1108550

thanks for testing, confirming and providing tested patches!

ok.

I will try to prepare an upload either today or tomorrow...

Hello,

Bug #1108550 in reprotest reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/reproducible-builds/reprotest/-/commit/513b9a529f627bf8ea5fb8b6f410e56994cc046a
(cherry picked from commit ff461c66558e59405b3475737a63ad09568b76b8)
Signed-off-by: Holger Levsen <holger@layer-acht.org>
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1108550

We believe that the bug you reported is fixed in the latest version of
reprotest, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1108550@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Holger Levsen <holger@debian.org> (supplier of updated reprotest package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 29 Jul 2025 14:21:34 +0200
Source: reprotest
Architecture: source
Version: 0.7.30
Distribution: unstable
Urgency: medium
Maintainer: Reproducible builds folks <reproducible-builds@lists.alioth.debian.org>
Changed-By: Holger Levsen <holger@debian.org>
Closes: 1108550
Changes:
 reprotest (0.7.30) unstable; urgency=medium
 .
   [ Rebecca N. Palmer ]
   * Don't call sudo with -h. Closes: #1108550
Checksums-Sha1:
 bf3e06010c2cb3576cbfa425f8015a27d9590259 2270 reprotest_0.7.30.dsc
 95a077dff7dda953840e557bd3118bd065d0ac40 113060 reprotest_0.7.30.tar.xz
 734127ade31989b1c3085c4545383873d703338b 14902 reprotest_0.7.30_source.buildinfo
Checksums-Sha256:
 5248ebc48097d2c027e786400fa77fc4b5b9f19e12dd7166f6c831edff9c8106 2270 reprotest_0.7.30.dsc
 7b535a1e1cdf460f54ee5d683bf26710b270a3454ea1da726700464b8c55aca0 113060 reprotest_0.7.30.tar.xz
 2842453b791c92d5e092b4490b8bd784d5b8f67396811a0ad0355db7029cf2f6 14902 reprotest_0.7.30_source.buildinfo
Files:
 61eb3eb2c438aae8d50ae1293df788f5 2270 devel optional reprotest_0.7.30.dsc
 942a86d4aceea55057c6ad4e7eb505db 113060 devel optional reprotest_0.7.30.tar.xz
 3dc0ab3657df5bcdc854aa5b2d729256 14902 devel optional reprotest_0.7.30_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEuL9UE3sJ01zwJv6dCRq4VgaaqhwFAmiIvUcACgkQCRq4Vgaa
qhxSuw//UkOfB0PHtrUYQ6qHsxOdaDSJBzQo6eHt0NCaYt13C2QSW2122oOxubOy
k5pJMgol/xcCHusWttserOPOs5YoXKLUQWfU89z9VqVO22QRDQ/hJwX50CVGlWir
L4RsuCRUwqOCkUSOvy9yHYYsu5XWf8+GYfe3brXRiXsfkooT/H7EawlWD18EenZV
7ocnyov61EGpzqJAhZz92Bu8Dmtt1zdZB0CHrZ2NfaQmjWSBeuUrzoZQegUpxcsR
3beEAc3UpVB1Mwr5ivA9t2Dd+6kSNpR/qJHoa+es/Feyn17R1uIbPsuU2VatV5uv
JFKcDiI3paSMPdvAMJioVUtbde23ES9X0MKhyaOUPwUVyTsEZ3n3+uONEl65/+pE
HYgulokbKZchs99/eP6ZIXMGuH8zSOh0w4vyCRSULgnP5C5/4Dh2sbJbHiawnbq9
TcuAVkvNSANkNsAjMGjwXi+DXxbUKfe7hYFC5DtjPRQNsttipeRMI6meV8aePLqD
vpJc96v6R+z23XM9cqIhsEmQ29TYZeRkmAQXsiTSW5oWFOXJ7cE9JL6bt0omx6Ny
R0FstyFAfO3NaG6Y+a9h/845R6V9yX67ZaCJE6j8j1yw/6Cz+hSY8Is06YJeiigm
oDqrmFMORN/vWpdtoPV21N2X3blRMtIWnoRl1XLYRmOQHwhAypc=
=mBWf
-----END PGP SIGNATURE-----