Bug#1105119: python3.13: please enable deterministic LTO output

[James Addison]

Source: python3.13
Severity: wishlist
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org
User: reproducible-builds at lists.alioth.debian.org
Usertags: randomness

Dear Maintainer,

I'm an occasional volunteer contributor to the Reproducible Builds[1] project,
and noticed recently that python3.13 fails to build reproducibly according to
automated reproducibility testing[2] on Debian.

If I understand correctly, the packaging for src:python3.13 enables link-time
optimization (LTO) with fat link-time objects enabled (the -ffat-lto-objects
flag to GCC).

According to GCC bugreport[3] 66305, enabling this flag causes nondeterministic
output; and the bugthread also provides a potential workaround/resolution for
that, namely to enable the -frandom-seed GCC option[4].

Another detail from the thread is that GCC8 introduced a bug that meant that
the random seed value of zero caused the option to be ignored.

I would like to request that we enable the random-seed GCC option of one (1),
in order to enable deterministic (reproducible) link-time optimized object
files during the build of python3.13-related packages.

I _think_ the relevant line of code to adjust in the buildscript is found at:

  https://salsa.debian.org/cpython-team/python3/-/blob/f04d169fe2dc39d34b7f983b17ae6a5190714cb6/debian/rules#L235

...however I also note that a subsequent line in the script may also require an
update, to consistently filter out LTO-related flags:

  https://salsa.debian.org/cpython-team/python3/-/blob/f04d169fe2dc39d34b7f983b17ae6a5190714cb6/debian/rules#L244

I hope (but cannot guarantee) to find time to test this theory using a
triplicate set of builds; once without the adjustment applied (producing what I
expect to be a somewhat-random build output), then with two subsequent builds
with the random-seed enabled (to confirm whether those two additional builds
emit identical binary packages).

Regards,
James

[1] - https://reproducible-builds.org/

[2] - https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/python3.13.html

[3] - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66305

[4] - https://gcc.gnu.org/onlinedocs/gcc/Developer-Options.html#index-frandom-seed