On Fri, Jan 11, 2019 at 05:26:44PM +0100, Helmut Grohne wrote: > Hi Bill, > > On Tue, Jan 08, 2019 at 12:49:11PM +0100, Bill Allombert wrote: > > I found a reproducibility issue with packages that ships a libtool > > script which differ whether multiarch is enabled or not. > > That's interesting indeed. I was aware that libtool was unreproducible > in cross builds vs. native builds. Naturally, cross builds do enable > multiarch, but thus far I couldn't attribute it to enabling multiarch. > Thank you. > > > The script includes a line like > > > > # Detected run-time system search path for libraries. > > sys_lib_dlsearch_path_spec="/lib /usr/lib > > /usr/lib/x86_64-linux-gnu/libfakeroot /usr/local/lib > > /usr/local/lib/x86_64-linux-gnu /lib/x86_64-linux-gnu > > /usr/lib/x86_64-linux-gnu " > > I think that's actually fine, due to the way libtool is used. You > generate one for each build. It's only a temporary thing that is deleted > at the end of the build. > > The more interesting question here is: How does that leak into your > .deb?
Very simply: some packages ships the libtool script and reuse it to build modules. gap-core: /usr/lib/x86_64-linux-gnu/gap/libtool librep-dev: /usr/lib/x86_64-linux-gnu/rep/libtool it can be argued this is a design bug (in the packages) because this assume the set of libraries will not change. Cheers, Bill. _______________________________________________ Reproducible-builds mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/reproducible-builds
