#1147372 rust-coreutils regressed in reproducibility

Package:
src:rust-coreutils
Source:
src:rust-coreutils
Submitter:
Jochen Sprickerhof
Date:
2026-10-17 11:05:01 UTC
Severity:
normal
#1147372#5
Date:
2026-09-11 11:51:27 UTC
From:
To:
Hi,

rust-coreutils in unstable can't migrate to testing because the QA
infrastructure couldn't reproduce the binary packages in unstable while
it could reproduce the version in testing [1, 2].

Feel free to reach out if you need help debugging the problem.
Alternatively you can ask the release team for an exception [3].

Cheers Jochen


[1] https://qa.debian.org/excuses.php?package=rust-coreutils
[2] https://lists.debian.org/debian-devel-announce/2026/05/msg00001.html
[3] https://lists.debian.org/debian-devel/2026/05/msg00383.html
#1147372#10
Date:
2026-09-11 12:08:11 UTC
From:
To:
Hello

Le 11/09/2026 à 13:51, Jochen Sprickerhof a écrit :
I think it is because I am using PGO builds.

How can i work around this?

Thanks
S
#1147372#15
Date:
2026-09-11 12:16:21 UTC
From:
To:
* Sylvestre Ledru <sylvestre@debian.org> [2026-09-11 14:08]:

Ah, I had missed that in the changelog, that sounds right.

By reverting the change. I am not aware of a way to make PGO
reproducible.

Note that reproduce.debian.net tries to reproduce the .deb that is
distributed by Debian so we can't just disable it in the rebuild as it
would still not be reproducible.

Cheers Jochen
#1147372#20
Date:
2026-09-11 12:22:54 UTC
From:
To:
Le 11/09/2026 à 14:16, Jochen Sprickerhof a écrit :
This means decreasing the performance by 20 to 40%...

Sylvestre
#1147372#25
Date:
2026-09-11 13:08:21 UTC
From:
To:
this probably warrants some broader discussion..

I think the only way to implement PGO and reproduciblity is to treat
the profiles as allowed generated input to the build (i.e., lift the
restriction of "all pre-generated parts of the upstream source must be
regenerated as part of the build" for them).

then you could generate the profiles at upstream release time, and put them
into the source package (or a second component tarball on the Debian side).
since the profile is static (per upstream version), the PGO build should be
reproducible then.

I guess the same applies to a lot of other (a lot more complex) projects,
e.g. AFAIK firefox and chromium upstream also heavily employ PGO, as does
the Rust toolchain.

Fabian
#1147372#30
Date:
2026-10-17 07:41:38 UTC
From:
To:
Hi,

On Fri, 11 Sep 2026 15:08:21 +0200 =?UTF-8?Q?Fabian_Gr=C3=BCnbichler?= <lists@fabian.gruenbichler.email> wrote:

So, how to move forward? This feels a bit like the community behind
reproducible builds should paper out a general solution to deal with PGO
in binary distributions, which is unlikely to happen overnight. Do we
agree on that? If so, I think we should let rust-coreutils migrate now.

Which also means that we should ensure "this probably warrants some
broader discussion". I have the impression that's somewhat already
happening, but I've only seen it on IRC. Can somebody link to broader
discussion (if it exists already)?

Paul
#1147372#35
Date:
2026-10-17 11:03:45 UTC
From:
To:
Hi Paul,

* Paul Gevers <elbrus@debian.org> [2026-10-17 09:41]:

Well, the other option is to revert enabling PGO. But as reproducible
builds are still kind of new I would be fine with letting rust-coreutils
migrate for trixie and discuss other options after the release.

There is:

https://lists.reproducible-builds.org/pipermail/rb-general/2026-September/004153.html

Cheers Jochen