#851809 mono: please make the output of dh_makeclilibs reproducible

Package:
src:mono
Source:
mono
Submitter:
Chris Lamb
Date:
2022-04-28 17:00:06 UTC
Severity:
wishlist
Tags:
#851809#5
Date:
2017-01-18 22:53:37 UTC
From:
To:
Hi,

Whilst working on the Reproducible Builds effort [0], we noticed
that dh_makeclilibs generates "clilibs" files with a non-deterministic
order.

This affects packages such as gtk-sharp-beans. For example:

│ -gtk-sharp-beans 2.14.0.0__97a95fb57b03c03a libgtk-sharp-beans-cil
│  gio-sharp 2.14.0.0__35e10195dab3c99f libgtk-sharp-beans-cil
│ +gtk-sharp-beans 2.14.0.0__97a95fb57b03c03a libgtk-sharp-beans-cil

Patch attached.

 [0] https://reproducible-builds.org/


Regards,
#851809#10
Date:
2017-02-18 21:56:33 UTC
From:
To:
Friendly ping on this :)


Best wishes,
#851809#15
Date:
2020-05-31 06:02:43 UTC
From:
To:
It looks like this was fixed some time ago:

  84aa977e3d2275a8cc43e21398dc90d01fb21b04
  Sort dh_makeclilibs output so it's deterministic. Thanks to Chris Lamb

Though a corresponding message and bug number didn't make it into
debian/changelog.

Marking as done.


live well,
  vagrant
#851809#28
Date:
2022-04-28 15:34:18 UTC
From:
To:
reopen 851809
thanks

Hi Vagrant,

Interesting. I don't see this commit SHA in the cli-common.git
repository, nor some associated change in dh_makeclilibs under a
different SHA.

But whatever the historical Git archaeology, the bug is still
affecting packages — de4dot, for example.

Hope we can get this resolved soon. If it helps, a simpler patch might
even be:

  @@ -187,7 +187,7 @@ foreach my $package (@{$dh{DOPACKAGES}}) {
           if (defined($dh{EXCLUDE_FIND}) && $dh{EXCLUDE_FIND} ne '') {
               $exclude = "! \\( $dh{EXCLUDE_FIND} \\) ";
           }
  -        open(FIND, "find $tmp -type f \\( -name '*.dll' \\) $exclude |");
  +        open(FIND, "find $tmp -type f \\( -name '*.dll' \\) $exclude | sort |");

           dll:
           while (<FIND>) {


Regards,
#851809#33
Date:
2022-04-28 16:39:25 UTC
From:
To:
https://salsa.debian.org/dotnet-team/mono/-/commit/84aa977e3d2275a8cc43e21398dc90d01fb21b04

Was this functionality moved to cli-common somehow?

Looking at the history of de4dot, it seems consistantly reproducible on
amd64 and arm64, but consistantly unreproducible on i386 and armhf:

https://tests.reproducible-builds.org/debian/history/amd64/de4dot.html
https://tests.reproducible-builds.org/debian/history/i386/de4dot.html

So the obvious difference here is 32-bit vs. 64-bit... a non-obvious
difference is choice of locale for each architecture for
tests.reproducible-builds.org infrastructure differs.

Looking at the history for the originally referenced gtk-sharp-beans is
a little less consistant, but still more frequently unreproducible on
i386/armhf:

https://tests.reproducible-builds.org/debian/history/amd64/gtk-sharp-beans.html
https://tests.reproducible-builds.org/debian/history/i386/gtk-sharp-beans.html


I wonder if you wouldn't also want to specify the locale to sort here?


live well,
  vagrant
#851809#38
Date:
2022-04-28 16:57:54 UTC
From:
To:
Hey,

Ah yes, or the issue is the other way around — the dh_makeclilibs in
the Mono repository (linked by you above) could originally have been a
code copy of the version in cli-common and has now diverged. The
history of the version in the Mono repository suggests this
interpretation, or the use of "re-synced" suggests that direction
anyway:

https://salsa.debian.org/dotnet-team/mono/-/commits/master/debian/dh_makeclilibs

The underlying direction doesn't really matter to me though, as the
version in cli-common does not sort. :)

Ah, of course! More importantly, though, the change should be the same
in both versions, so I'd be minded to go with the explicit complex_doit
call. Hah, I think my "if it helps" extra patch didn't actually "help"
at all.


Regards,