[Reproducible-builds] Bug#827155: dpkg-buildflags: reproducible/fixdebugpath doesn't escape build path

[HW42]

Daniel Kahn Gillmor:
> On Sun 2016-06-12 23:25:33 -0400, HW42 wrote:
>> as Mattia noticed dpkg-buildflags doesn't escape the build path in the
>> -fdebug-prefix-map CC argument when enabling the 'fixdebugpath' option.
>>
>> What assumptions does dpkg make about the build path? I think there are a
>> lot of build scripts which anyway break if the build path contains a
>> space.
> 
> that seems likely to me -- not just debian packaging scripts either, but
> likely upstream build toolchain decisions as well.
> 
>> Unfortunately this isn't trivially fixed since the flags are
>> concatenated as a string and later exported in different languages
>> (shell, Makefile). So if we want to support spaces in buildpaths this
>> need to be changed to an array. What do you think?
> 
> I think you mean that the flags should be internally stored as an array
> inside dpkg-dev instead of a concatenated string.

exactly

> That sounds right to me, and a worthwhile change in its own right.
> 
> It won't fix any upstream toolchain bugs, of course, and if we start to
> vary by having whitespace (or even weirder characters) in paths, we're
> likely to see a large number of FTBFS.

I don't think that should be done as part of the reproducible builds
efforts. I raised this only because if dpkg-dev would assume a space
free build path anyway an escape(split(flags, ' ')) would have been
enough.

> fixing dpkg-dev to treat the flags internally as an array seems like a
> good first step, though.

Ack.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/reproducible-builds/attachments/20160630/e4ef545c/attachment.sig>