[Pkg-rust-maintainers] Bug#958301: Bug#958301: dh-cargo: please make the output reproducible

[Ximin Luo]

Thanks, the file in /usr indeed should not be there and should be fixed in the next cargo upload, 0.43.1-2.

Yes, the boundary between dh-cargo and cargo-debian-wrapper (which lives in cargo) is a bit unclear and some of it is derived from historical reasons, this can certainly be improved in the future.

X

Chris Lamb:
> Source: dh-cargo
> Version: 23
> Severity: wishlist
> Tags: patch
> User: reproducible-builds at lists.alioth.debian.org
> Usertags: buildpath toolchain
> X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org
> 
> Hi,
> 
> Whilst working on the Reproducible Builds effort [0] we noticed that
> dh-cargo generates/installs non-reproducible output. For example,
> here is rust-difference 2.0.0-1:
> 
> │ │ │ ├── ./usr/.crates2.json
> │ │ │ │ │ @@ -1,10 +1,10 @@
> │ │ │ │ │  {
> │ │ │ │ │      "installs": {
> │ │ │ │ │ -        "difference 2.0.0 (path+file:///build/1st/rust-difference-2.0.0)": {
> │ │ │ │ │ +        "difference 2.0.0 (path+file:///build/2/rust-difference-2.0.0/2nd)": {
> 
> Proof-of-concept patch attached that strips all these files. It might
> be better to do this elsewhere, up to you.
> 
>   --- a/cargo.pm
>   +++ b/cargo.pm
>   @@ -170,6 +170,7 @@ sub install {
>            my $destdir = $ENV{'DESTDIR'} || $this->get_sourcepath("debian/" . $this->{binpkg});
>            doit("env", "DESTDIR=$destdir",
>                 "/usr/share/cargo/bin/cargo", "install", @_);
>   +        doit('find', $destdir, '-name', '.crates2.json', '-exec', 'rm', '{}', '+');
>            # generate Built-Using fields         
> 
> Note that this file is being installed to /usr (!) which is likely a
> pretty severe bug here or in rust-difference, but I'll leave that
> with you.
> 
> 
>   [0] https://reproducible-builds.org/
> 
> 
> Regards,
> 
> 
> _______________________________________________
> Pkg-rust-maintainers mailing list
> Pkg-rust-maintainers at alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-rust-maintainers
> 


-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git