Package: dpkg-dev
Version: 1.17.16
Severity: minor
Tags: patch
Usertags: toolchain randomness


As part of the “reproducible builds” effort [1], I came to investigate a
couple of failures related to dpkg-shlibdeps.

An example is visible in the output of debbindiff for gemanx-gtk2:

In the Depends field of the control file of libgemanx-core0, one build
has `libglib2.0-0 (>= 2.12.0)` while the other has
`libglib2.0-0 (>= 2.16.0)`.

dpkg-shlibdeps outputs a warning, as it is actually a useless
dependency. So the issue is probably a minor one. Here's my analysis and
possible solution:

The minimal version numbers differ from one run to another because when
the .symbols file is loaded, the order of the entries in the `libfiles`
hash are random. Only the minimal required version for the first
encountered shared library of a package will be currently used.

libglib2.0-0 exhibits the problem because has a minimal
required version of 2.16.0, while all other shared libraries contained
in the same package have a minimal required version of 2.12.0.

The attached patch uses `update_dependency_version` in order to raise
the initial minimum required version for each shared libraries provided
by the same package.


Lunar                                .''`.                    : :Ⓐ  :  # apt-get install anarchism
                                    `. `'` 
diff --git a/scripts/ b/scripts/
index bda1e09..6caa6d8 100755
--- a/scripts/
+++ b/scripts/
@@ -255,13 +255,9 @@ foreach my $file (keys %exec) {
                 # package and we really need it)
 		my $dep = $symfile->get_dependency($soname);
 		my $minver = $symfile->get_smallest_version($soname) || '';
-		foreach my $subdep (split /\s*,\s*/, $dep) {
-		    if (not exists $dependencies{$cur_field}{$subdep}) {
-			$dependencies{$cur_field}{$subdep} = Dpkg::Version->new($minver);
-                        print " Initialize dependency ($subdep) with minimal " .
-                              "version ($minver)\n" if $debug > 1;
-		    }
-		}
+		update_dependency_version($dep, $minver);
+		print " Initialize dependencies ($dep) with minimal " .
+		      "version ($minver)\n" if $debug > 1;
 	    } else {
 		# No symbol file found, fall back to standard shlibs
                 print "Using shlibs+objdump for $soname (file $lib)\n" if $debug;

Attachment: signature.asc
Description: Digital signature

Reproducible-builds mailing list

Reply via email to