Dear maintainer.

The package rsnapshot currently fails to build reproducibly on
merged-usr vs non-merged systems.

Please see attached patch fixing this issue.

Regards, Andreas Henriksson

We believe that the bug you reported is fixed in the latest version of
rsnapshot, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 915850@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mark Hindley <leepen@debian.org> (supplier of updated rsnapshot package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 24 Jun 2022 13:02:11 +0100
Source: rsnapshot
Architecture: source
Version: 1.4.4-2
Distribution: unstable
Urgency: medium
Maintainer: Mark Hindley <leepen@debian.org>
Changed-By: Mark Hindley <leepen@debian.org>
Closes: 883437 915850
Changes:
 rsnapshot (1.4.4-2) unstable; urgency=medium
 .
   * d/rules: specify PATH for build so unmerged usr paths are discovered
     first (Closes: #915850).
   * Enable upstream tests.
   * Downgrade logrotate dependency to recommends (Closes: #883437).
   * d/control:
      - remove redundant debhelper versioned dependency.
      - change to debhelper compat 13.
   * Run wrap-and-sort -ta.
Checksums-Sha1:
 e56e876544b92b148ea9a24eff23791b2738aea0 1918 rsnapshot_1.4.4-2.dsc
 676195b542f560615c489b60b6046c099899a241 15632 rsnapshot_1.4.4-2.debian.tar.xz
 b8ffdfc3982a85261bdfebb09c6580f375780f6e 6959 rsnapshot_1.4.4-2_amd64.buildinfo
Checksums-Sha256:
 d6a084e3de1bd8b661cee023047fdfa829d0b26cf9b9e26d40063deb5202fe58 1918 rsnapshot_1.4.4-2.dsc
 43edcd29e8a8671c829595a96bba9f79289d5dc54eac5739ea65d7378eabe6b7 15632 rsnapshot_1.4.4-2.debian.tar.xz
 106bc81c8685d7f38a6be3b0f765669ef495d864466d4c48fb0616a69b281caa 6959 rsnapshot_1.4.4-2_amd64.buildinfo
Files:
 7149a2f8f81a9884ede46f34c2656dda 1918 utils optional rsnapshot_1.4.4-2.dsc
 4fa46bdbf867b6588051d4ad7ebcb281 15632 utils optional rsnapshot_1.4.4-2.debian.tar.xz
 6f47d71fcbd8c2d04b63084f4238dc01 6959 utils optional rsnapshot_1.4.4-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEUGwVpCsK9aCoVCPu0opFvzKH1kkFAmK1se8ACgkQ0opFvzKH
1kmmUg//dDT/cvdp1iFFou6SiHCnW2UDiYSp1aWbtK6P9Cn+Gm1UHxOvq/sSuDdu
Ey+l7m8tIScqZmtuL1YgT5bnp0e8HbaQOlwhAKyu2rkK5Tqhykq0zE2iG8V8rvg6
s2x5pM6I5YTo8TdyPIWu5ii6gAmhJcHlW7uKWdLwHb2kAxmOLLIj5wz0z9gxXCOg
Q6puOJrgHNLGkEqnJn+g58ph4dQUoVgOQWcS3vHnUsiYHjTaMU9tM+l02MxkFfBT
tv3uDLyg3VJEmsLOLex4mLGjuN38IS+PFq48a+1GHmvmDZ7i8IZizOJ7QmT29GTm
qm5GRkB7mkAZnIHrGdGTQjcUEYsn2/ufoQhzXXi0rMnccI5alGY8jNRqW7U3HTkN
yNVhYtZLq7gY9/VcPcyk8v7gBLFDxTW2+MzbIHSaPeCgU1w4EYGisIc6YXG0CKUC
gbyV5kSVo4tY3UpCkh2JK+m2XpTyNxH99e5ia+cZQ63V8SQzIdwCo0oelC7PGk4O
ejK70XsuQ/k7IUfE+3UGFPWRIvdmFWLonoJDKeJvsP8ZQz980aAONxCAFEGrDT/0
8zack3XgGOwqtDNVwPZ6jRgYiAIj8y18ZS4hesHz4ffbM9fGPKriZSq4ukqfIXCX
f+ICWhu1Mm8kQ390Ln6UifizFG9TbKx3DZkghxqkNAzqPG3ikrk=
=DBzG
-----END PGP SIGNATURE-----

On Fri, 24 Jun 2022 at 13:12:07 +0000, Debian Bug Tracking System forwarded:
problem as originally reported (for cp, rm, lvcreate, etc.), but also
causes the opposite problem for tools that are canonically in /usr/bin
(rsync, ssh, logger, du, perl).

(It also seems to have interfered with the generation of an automatic
dependency on perl:any.)

You can see this in:
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/rsnapshot.html
where the first build (b1) was done on an unmerged-/usr system, and the
second build (b2) on a merged-/usr system for comparison.

This will be a practical problem as soon as Debian starts using merged-/usr
on official buildds, and the Debian technical committee resolution
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994388#110 recommends
treating this class of bug as release-critical for Debian 12, so I'm
raising the severity of this bug to serious.

The problem scenario with 1.4.2-1 was:

- build the package on a system where both /bin/cp and /usr/bin/cp exist
  (merged-/usr)
- install and run the package on a system where only /bin/cp exists
  (non-merged-/usr)
- result: the feature that runs cp will not work

and the problem scenario with 1.4.4-2 is similar, but with /bin and
/usr/bin reversed:

- build the package on a system where both /bin/perl and /usr/bin/perl
  exist (merged-/usr)
- install and run the package on a system where only /usr/bin/perl exists
  (non-merged-/usr)
- result: the feature that runs perl will not work

Please upload a fixed package before the Debian 12 freeze. Reverting the
PATH change, and applying Andreas' patch instead, looks appropriate.

Thanks,
    smcv

Simon,

Thanks for this.

Yes, I had realised this and have already queued the patch that was originally
suggested.

Mark

We believe that the bug you reported is fixed in the latest version of
rsnapshot, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 915850@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mark Hindley <leepen@debian.org> (supplier of updated rsnapshot package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 17 Jul 2022 15:16:36 +0100
Source: rsnapshot
Architecture: source
Version: 1.4.4-3
Distribution: unstable
Urgency: medium
Maintainer: Mark Hindley <leepen@debian.org>
Changed-By: Mark Hindley <leepen@debian.org>
Closes: 915850
Changes:
 rsnapshot (1.4.4-3) unstable; urgency=medium
 .
   * d/rules: specify paths so merged usr build is reproducible (Closes:
     #915850).
Checksums-Sha1:
 6793391e0e9319c21d8e95153a81b0571ca0e42e 1918 rsnapshot_1.4.4-3.dsc
 d78bf43b16772a389a6a8951f53c8be45726229a 15740 rsnapshot_1.4.4-3.debian.tar.xz
 909e522cdf3d64ee1799982e636914a41ecea366 7181 rsnapshot_1.4.4-3_amd64.buildinfo
Checksums-Sha256:
 b9d966d7d6cdb1eed9252cfb790e2927cb783eee2aecc38921d413669a9c4309 1918 rsnapshot_1.4.4-3.dsc
 09754e80d245814fba43a922196b3568a38ac58e697f316eec2c60c79e938807 15740 rsnapshot_1.4.4-3.debian.tar.xz
 a11c726fad5c2430805b02c3e4709deb57f753ce9e5c1790da27f6f9acfc8823 7181 rsnapshot_1.4.4-3_amd64.buildinfo
Files:
 9968e908b3caf8050d67f7e3ee832f4c 1918 utils optional rsnapshot_1.4.4-3.dsc
 7a9518cf9aefeecdd41e7efe3aea62bc 15740 utils optional rsnapshot_1.4.4-3.debian.tar.xz
 7e3dbfd6771a46c45b85c3559e9f8728 7181 utils optional rsnapshot_1.4.4-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEUGwVpCsK9aCoVCPu0opFvzKH1kkFAmLUG+gACgkQ0opFvzKH
1klUxA//SabkSolK/ObO2xzoA190ctEbswddmptl4lxmbiDRRT6nU5tt1JSWKr1z
p5/AJ4p5qsnumjtfOHrksg5JJEoav1l6mTq1Bld4XXwnOR/WLpW7hWW/HVdAUfNh
Pq+pt7EgRB1a5sQP1ZHTkxa93tOcxEP/JDh8r1ELIEHtVQ1jO04GhB+m8S9szgKZ
FhfvDsO3VMEw2SYHSXU4kU9J35IZpfwmFMuG/wLQPminIsl3wYL+smjrwbRNxKyQ
kg84zJa4R8+BSqTVJelD/9IU+DTQqdDnmssVSUx+56D7uZvrj2D40Uv0p1AA7AqZ
nK08Fwv4W0eMQVNs3xW32zOMOkvvdCR5ljT9EAdsKACG4ZbiVx3ajSDrONpgwKG/
NSjPF107J38rUmxIDQrAaOlY/Kpxx67uM/mjKC0pzmroirdk0ATU/oKVRv5vCGxK
Hzh+k4rvHFJl4vOPgseB72BgTs4k+UV0X4w8HZF/OMvb/J8ct7SLZmerpz3XvIvn
0VmvaM/YiLw8bjTSoZhtXyx7Jd0vjDJVXrhiZ4y4PscCrdCU34lw/BetOB6WTvyx
wOh5+Pd6ffCat+DJ5GfpP3j0rS1memB/kTqpTofAuts+UTRHGkfY9L+idtoHuke3
Fntg5wShF6NmCTfryvcVvXSSCX5RW/xIvbO0gbCVhKnyjgRcpUE=
=5o6j
-----END PGP SIGNATURE-----