Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Philipp Kern]

reassign -1 ftp.debian.org
thanks

On 2018-04-12 22:29, Aurelien Jarno wrote:

On 2018-04-12 19:41, Holger Levsen wrote:
control: retitle -1 "buildd.d.o: binNMUs should be replaced by easy 
no-change-except-d/changelog-uploads"

# I hope this is correct, realistic and accurate ;)
# if not, please fixup?
#thanks
That can't be done on the wanna-build side, uploads to the archive 
needs

to be signed. Time to reassign this bug to ftp.debian.org?


Agreed. Doing so now.

Kind regards
Philipp Kern

___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Aurelien Jarno]

On 2018-04-12 19:41, Holger Levsen wrote:
> control: retitle -1 "buildd.d.o: binNMUs should be replaced by easy 
> no-change-except-d/changelog-uploads"
> # I hope this is correct, realistic and accurate ;)
> # if not, please fixup?
> #thanks

That can't be done on the wanna-build side, uploads to the archive needs
to be signed. Time to reassign this bug to ftp.debian.org?

Aurelien

-- 
Aurelien Jarno  GPG: 4096R/1DDD8C9B
aurel...@aurel32.net http://www.aurel32.net


signature.asc
Description: PGP signature
___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Holger Levsen]

On Thu, Apr 12, 2018 at 10:09:44PM +0200, Emilio Pozuelo Monfort wrote:
> On 12/04/18 21:41, Holger Levsen wrote:
> > control: retitle -1 "buildd.d.o: binNMUs should be replaced by easy 
> > no-change-except-d/changelog-uploads"
> > # I hope this is correct, realistic and accurate ;)
> > # if not, please fixup?
> > #thanks
> Removing binNMUs would be a problem whenever we need to do a large amount of
> rebuilds on just one architecture, e.g. due to a toolchain bug, a baseline 
> bump,
> or other reasons.

sure, hence the word "easy" in the bug title.


-- 
cheers,
Holger


signature.asc
Description: PGP signature
___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Holger Levsen]

control: retitle -1 "buildd.d.o: binNMUs should be replaced by easy 
no-change-except-d/changelog-uploads"
# I hope this is correct, realistic and accurate ;)
# if not, please fixup?
#thanks

-- 
cheers,
Holger


signature.asc
Description: PGP signature
___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Holger Levsen]

On Thu, Apr 12, 2018 at 02:10:37PM +0200, Guillem Jover wrote:
> Please, see my reply at . This is
> really a fundamental problem with binNMUs+multiarch-refcounting or how
> they are being issued. :)

FWIW I totally agree with what you wrote there, just that I dont see
other people agreeing so sadly I currently don't see this fixed anytime
soon. Which is pretty sad.


-- 
cheers,
Holger


signature.asc
Description: PGP signature
___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Julien Cristau]

Control: severity -1 wishlist

On 04/12/2018 02:10 PM, Guillem Jover wrote:

Control: reassign -1 buildd.debian.org

Hi!

On Thu, 2018-04-05 at 17:43:58 +0200, Jean-Michel Vourgère wrote:

On Friday, 30 March 2018 15:02:31 CEST Chris Lamb wrote:

[ https://lists.debian.org/debian-security/2017/05/msg00011.html ]


On Friday, 30 March 2018 20:15:33 CEST Sven Joachim wrote:

[ https://bugs.debian.org/843773 ]


Thanks a lot guys for pointing out that issue!

Basically, when doing bin-nmus, we really want to bump the mtime of the
distributed files. Not doing so results in some backups programs (rsync...) to
loose updates. Other programs restarting services on libraries updates
(needrestart...) would also be affected.


So, during compilation:
SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries
because it breaks Multi-Arch:same on bin-nmu.

During dpkg-deb (:
SOURCE_DATE_EPOCH must *not* ignore bin-nmu changelog entries
because it would break software relying on files mtime.

Doh!

In https://bugs.debian.org/843773#75 Ian Jackson propose to introduce a
BUILD_DATE_EPOCH (= time of sbuild binnmu invocation) be prefered over
SOURCE_DATE_EPOCH by dpkg-deb.

That would work, wouldn't it?


Please, see my reply at . This is
really a fundamental problem with binNMUs+multiarch-refcounting or how
they are being issued. :)

Indeed.  I suspect eventually we'll make no-change sourceful uploads 
less labor intensive and binNMUs will go away, but we're not there right 
now.


Cheers,
Julien

___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Guillem Jover]

Control: reassign -1 buildd.debian.org

Hi!

On Thu, 2018-04-05 at 17:43:58 +0200, Jean-Michel Vourgère wrote:
> On Friday, 30 March 2018 15:02:31 CEST Chris Lamb wrote:
> > [ https://lists.debian.org/debian-security/2017/05/msg00011.html ]
> 
> On Friday, 30 March 2018 20:15:33 CEST Sven Joachim wrote:
> > [ https://bugs.debian.org/843773 ]
> 
> Thanks a lot guys for pointing out that issue!
> 
> Basically, when doing bin-nmus, we really want to bump the mtime of the 
> distributed files. Not doing so results in some backups programs (rsync...) 
> to 
> loose updates. Other programs restarting services on libraries updates 
> (needrestart...) would also be affected.
> 
> 
> So, during compilation:
> SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries
> because it breaks Multi-Arch:same on bin-nmu.
> 
> During dpkg-deb (:
> SOURCE_DATE_EPOCH must *not* ignore bin-nmu changelog entries
> because it would break software relying on files mtime.
> 
> Doh!
> 
> In https://bugs.debian.org/843773#75 Ian Jackson propose to introduce a 
> BUILD_DATE_EPOCH (= time of sbuild binnmu invocation) be prefered over 
> SOURCE_DATE_EPOCH by dpkg-deb.
> 
> That would work, wouldn't it?

Please, see my reply at . This is
really a fundamental problem with binNMUs+multiarch-refcounting or how
they are being issued. :)

Thanks,
Guillem


___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Holger Levsen]

On Thu, Apr 05, 2018 at 05:43:58PM +0200, Jean-Michel Vourgère wrote:
> So, during compilation:
> SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries
> because it breaks Multi-Arch:same on bin-nmu.
> 
> During dpkg-deb (:
> SOURCE_DATE_EPOCH must *not* ignore bin-nmu changelog entries
> because it would break software relying on files mtime.
> 
> Doh!

different ways of parsing debian/changelog to determine S_D_E is a road
to desaster, sorry.

> In https://bugs.debian.org/843773#75 Ian Jackson propose to introduce a 
> BUILD_DATE_EPOCH (= time of sbuild binnmu invocation) be prefered over 
> SOURCE_DATE_EPOCH by dpkg-deb.
> 
> That would work, wouldn't it?

I'm also not convinced this would be a good solution.

Sadly I also don't have another idea than changing the way binNMUs are
done :( Them being no-source-changes-rebuilds with changes to
debian/changelog, which is part of the source, (IMNSHO) is poor design
and the root of this and other problems.


-- 
cheers,
Holger


signature.asc
Description: PGP signature
___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Jean-Michel Vourgère]

On Friday, 30 March 2018 15:02:31 CEST Chris Lamb wrote:
> [ https://lists.debian.org/debian-security/2017/05/msg00011.html ]

On Friday, 30 March 2018 20:15:33 CEST Sven Joachim wrote:
> [ https://bugs.debian.org/843773 ]

Thanks a lot guys for pointing out that issue!

Basically, when doing bin-nmus, we really want to bump the mtime of the 
distributed files. Not doing so results in some backups programs (rsync...) to 
loose updates. Other programs restarting services on libraries updates 
(needrestart...) would also be affected.


So, during compilation:
SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries
because it breaks Multi-Arch:same on bin-nmu.

During dpkg-deb (:
SOURCE_DATE_EPOCH must *not* ignore bin-nmu changelog entries
because it would break software relying on files mtime.

Doh!

In https://bugs.debian.org/843773#75 Ian Jackson propose to introduce a 
BUILD_DATE_EPOCH (= time of sbuild binnmu invocation) be prefered over 
SOURCE_DATE_EPOCH by dpkg-deb.

That would work, wouldn't it?

signature.asc
Description: This is a digitally signed message part.
___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Philipp Kern]

On 2018-03-30 20:15, Sven Joachim wrote:

On 2018-03-30 15:02 +0100, Chris Lamb wrote:


[adding 894441@ to CC]

Hi Jean-Michel,


Filled as #894441
https://bugs.debian.org/894441


Thanks for this. I was just briefly wondering whether this is related 
to:


  https://lists.debian.org/debian-security/2017/05/msg00011.html


It seems so.  What you are describing there had been noticed by Ian
Jackson before:

https://lists.debian.org/debian-devel/2016/11/msg00328.html

Ian then filed bug #843773 against sbuild, and as a result sbuild (as 
of

version 0.73.0-1) no longer reuses the timestamp of the last changelog
entry in binNMUs.

The same version of sbuild introduced a --binNMU-timestamp option, and 
I

think wanna-build should use it to achieve a consistent
SOURCE_DATE_EPOCH across architectures in binNMUs.  Something along
these lines had already been proposed in #843773.


I'd hold that the sourceful uploads Ubuntu does (XbuildY) are actually a 
cleaner solution to the problem. The cute hack is necessary because a) 
our policies discourage sourceful NMUs heavily and b) scheduling an 
automatic rebuild is more than a simple RPC call and involves a 
re-upload of the whole source package.


Right now wanna-build still has no notion of a consistent state across 
architectures. So just like version picking is already done in higher 
level orchestration (wb) that tool would need to provide the timestamps 
as well. Information is also lost whenever new state is merged, although 
practically that's probably not a problem here because a new sourceful 
build would be pushed to all architectures mostly at once anyway.


Kind regards
Philipp Kern

___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds

Re: Bug#894441: dpkg-buildpackage: SOURCE_DATE_EPOCH must ignore bin-nmu changelog entries. Breaks M-A:same

[Sven Joachim]

On 2018-03-30 15:02 +0100, Chris Lamb wrote:

> [adding 894441@ to CC]
>
> Hi Jean-Michel,
>
>> Filled as #894441
>> https://bugs.debian.org/894441
>
> Thanks for this. I was just briefly wondering whether this is related to:
>
>   https://lists.debian.org/debian-security/2017/05/msg00011.html

It seems so.  What you are describing there had been noticed by Ian
Jackson before:

https://lists.debian.org/debian-devel/2016/11/msg00328.html

Ian then filed bug #843773 against sbuild, and as a result sbuild (as of
version 0.73.0-1) no longer reuses the timestamp of the last changelog
entry in binNMUs.

The same version of sbuild introduced a --binNMU-timestamp option, and I
think wanna-build should use it to achieve a consistent
SOURCE_DATE_EPOCH across architectures in binNMUs.  Something along
these lines had already been proposed in #843773.

Cheers,
   Sven

___
Reproducible-builds mailing list
Reproducible-builds@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/reproducible-builds