libtool and reproducible builds

[Bill Allombert]

On Fri, Jan 11, 2019 at 05:26:44PM +0100, Helmut Grohne wrote:
> Hi Bill,
> 
> On Tue, Jan 08, 2019 at 12:49:11PM +0100, Bill Allombert wrote:
> > I found a reproducibility issue with packages that ships a libtool
> > script which differ whether multiarch is enabled or not.
> 
> That's interesting indeed. I was aware that libtool was unreproducible
> in cross builds vs. native builds. Naturally, cross builds do enable
> multiarch, but thus far I couldn't attribute it to enabling multiarch.
> Thank you.
> 
> > The script includes a line like
> > 
> >   # Detected run-time system search path for libraries.
> >   sys_lib_dlsearch_path_spec="/lib /usr/lib /usr/lib/x86_64-linux-gnu/libfakeroot /usr/local/lib /usr/local/lib/x86_64-linux-gnu /lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu "
> 
> I think that's actually fine, due to the way libtool is used.  You
> generate one for each build. It's only a temporary thing that is deleted
> at the end of the build.
> 
> The more interesting question here is: How does that leak into your
> .deb?

Very simply: some packages ships the libtool script and reuse it
to build modules.

gap-core: /usr/lib/x86_64-linux-gnu/gap/libtool
librep-dev: /usr/lib/x86_64-linux-gnu/rep/libtool

it can be argued this is a design bug (in the packages) because this
assume the set of libraries will not change.

Cheers,
Bill.