Bug#1141576: /usr/bin/hokey: hokey canonicalize output depends on version of libghc-hashable-dev

[Uwe Kleine-König]

Package: hopenpgp-tools
Version: 0.23.11-1
Severity: normal
File: /usr/bin/hokey
X-Debbugs-Cc: ukleinek at debian.org, clegoffic at baylibre.com

Hello,

I maintain a company-internal keyring with the certificates of my colleagues to populate our WKD.

The certificates are tracked in git in their canonical order as defined
by `hokey canonicalize`.

Now I have with hokey 0.23.11-1 (and thus libghc-hashable-dev
1.4.4.0-1+b1):

	hokey canonicalize < 7E845B82AD0A1E93 > 7E845B82AD0A1E93.canon
	hokey (hopenpgp-tools) 0.23.11
	Copyright (C) 2012-2023  Clint Adams
	hokey comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions.

	$ sha256sum baylibre-keyring/7E845B82AD0A1E93 baylibre-keyring/7E845B82AD0A1E93.canon
	048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5  7E845B82AD0A1E93
	048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5  7E845B82AD0A1E93.canon

So as expected the cert file doesn't change on canonicalizing again.

However if my colleague Clément (on Cc), who is using Arch btw, does the
same with hokey 0.23.11 linked against hashable 1.4.7.0, he gets:

	$ sha256sum baylibre-keyring/7E845B82AD0A1E93 baylibre-keyring/7E845B82AD0A1E93.canon
	048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5  7E845B82AD0A1E93
	255da847cfeb96a6bb47624e83e9310183e3bd0a021f903c5d8de65e9a3c6085  7E845B82AD0A1E93.canon

.

Clément worked out the reason (with the help of Claude, so take it with
a grain of salt given that we're not fluent in Haskell):

Packet ordering bases on comparing hashes
(Codec/Encryption/OpenPGP/Types.hs, `instance Ord Pkt`) and canonicalize
sorts using that Ord instance. Now hashable changed byte hashing in
https://github.com/haskell-unordered-containers/hashable/pull/301 and
thus canonicalization changed.

IMHO canonicalization shouldn't depend on an (unstable) hashing
algorithm. It should at least be documented that canonicalization is
unstable, or better, canonicalization should be fixed to be independent
of hashing.

Best regards
Uwe


-- System Information:
Debian Release: 13.5
  APT prefers stable-updates
  APT policy: (750, 'stable-updates'), (750, 'stable-security'), (750, 'stable-debug'), (750, 'stable'), (700, 'oldstable-security'), (700, 'oldstable-debug'), (700, 'oldstable'), (600, 'unstable'), (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'proposed-updates'), (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: arm64

Kernel: Linux 7.1.3+deb14-amd64 (SMP w/22 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages hopenpgp-tools depends on:
ii  libbz2-1.0     1.0.8-6
ii  libc6          2.42-17
ii  libffi8        3.4.8-2
ii  libgmp10       2:6.3.0+dfsg-3
ii  libnettle8t64  3.10.2-1+b1
ii  libnuma1       2.0.19-1
ii  libyaml-0-2    0.2.5-2
ii  zlib1g         1:1.3.dfsg+really1.3.1-1+b1

hopenpgp-tools recommends no packages.

hopenpgp-tools suggests no packages.

-- no debconf information