[Debian-med-packaging] Bug#862039: r-bioc-gviz: accesses the internet during build

[Andreas Tille]

Hi,

the gviz package received a bug report about trying to access a remote
location at package build time which is forbidden by Debian policy.

I wonder if there is an easy way to prevent this.  Due to so called
Build-Depends it is granted that biocinstaller code is installed on
the building machine so there should be no reason to access
  http://bioconductor.org/BiocInstaller.dcf
at least for my possibly naive understanding.

Do you have any hints how this access could be prevented?

Kind regards

       Andreas.

On Tue, May 09, 2017 at 09:00:09AM -0500, Dirk Eddelbuettel wrote:
> 
> On 9 May 2017 at 14:57, Andreas Tille wrote:
> | Hi Chris,
> | 
> | On Sun, May 07, 2017 at 06:06:10PM +0100, Chris Lamb wrote:
> | > 
> | > Whilst r-bioc-gviz builds successfully on unstable/amd64, according to
> | > Debian Policy 4.9 packages may not attempt network access during
> | > a build.
> | > 
> | >    00:00:00.000000 IP 5f02d4499efa.36140 > dns.z9.domain: 4778+ A? bioconductor.org. (34)
> | >    00:00:00.000051 IP 5f02d4499efa.36140 > dns.z9.domain: 45901+ AAAA? bioconductor.org. (34)
> | >    00:00:01.725656 IP dns.z9.domain > 5f02d4499efa.36140: 45901 0/1/0 (121)
> | >    00:00:03.219280 IP dns.z9.domain > 5f02d4499efa.36140: 4778 8/4/0 A 52.222.253.6, A 52.222.253.158, A 52.222.253.218, A 52.222.253.224, A 52.222.253.45, A 52.222.253.252, A 52.222.253.94, A 52.222.253.219 (298)
> | >    00:00:03.306580 IP 5f02d4499efa.44448 > 52.222.253.6.https: Flags [S], seq 4243355363, win 29200, options [mss 1460,sackOK,TS val 493652159 ecr 0,nop,wscale 7], length 0
> | >    00:00:03.347988 IP 52.222.253.6.https > 5f02d4499efa.44448: Flags [S.], seq 1407308632, ack 4243355364, win 28960, options [mss 1412,sackOK,TS val 1448496045 ecr 493652159,nop,wscale 8], length 0
> | >    00:00:03.348046 IP 5f02d4499efa.44448 > 52.222.253.6.https: Flags [.], ack 1, win 229, options [nop,nop,TS val 493652169 ecr 1448496045], length 0
> | >    00:00:03.450001 IP 5f02d4499efa.44448 > 52.222.253.6.https: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 493652195 ecr 1448496045], length 517
> | >    00:00:03.491891 IP 52.222.253.6.https > 5f02d4499efa.44448: Flags [.], ack 518, win 118, options [nop,nop,TS val 1448496060 ecr 493652195], length 0
> | >    00:00:03.495857 IP 52.222.253.6.https > 5f02d4499efa.44448: Flags [.], seq 1:1401, ack 518, win 118, options [nop,nop,TS val 1448496060 ecr 493652195], length 1400
> | > 
> | >   [..]
> | > 
> | > The full build log (including tcpdump output) is attached.
> | 
> | I can confirm that the build log contains
> | 
> |   URL 'http://bioconductor.org/BiocInstaller.dcf': status was 'Couldn't connect to server'
> | 
> | when using pbuilder or sbuild.  I guess the problem remained hidden
> | since so far nobody did a tcpdump while building the package and since
> | the build runs fine after checking that the resource is not available
> | nobody noticed so far.
> | 
> | I admit I'm a bit clueless how to fix the issue since the build process
> | of R packages is a bit "encapsulated" and I'm afraid about simply
> | seeking the said URL and patching it out.  I'm not sure about the
> | potential side effects for the resulting deb at package installation
> | time.
> | 
> | Thus I'm forwarding the bug to Debian Science list for further advise.
> 
> I am fairly certain that this must be coming from the BioConductor side of
> things.  R does call 'home' when you 'R CMD check --as-cran', but we of
> course do not do that during builds.  We just call 'R CMD INSTALL ...'
> 
> Dirk
> 
> -- 
> http://dirk.eddelbuettel.com | @eddelbuettel | edd at debian.org
> 

-- 
http://fam-tille.de