Bug#1108550: reprotest: fails with "sudo: a remote host may only be specified when listing privileges"

[Colin Watson]

Package: reprotest
Version: 0.7.29
Severity: grave
Justification: renders package unusable

[CC sudo maintainer since this was triggered by a change in sudo]

reprotest just started failing in trixie.  Compare these two logs:

  https://salsa.debian.org/freexian-team/debusine/-/jobs/7775488
  https://salsa.debian.org/freexian-team/debusine/-/jobs/7776774

The relevant parts of the diff are (a) that the failing version 
installed sudo 1.9.16p2-3, and (b) the following:

+sudo: a remote host may only be specified when listing privileges.
+sudo: a remote host may only be specified when listing privileges.
+sudo: a remote host may only be specified when listing privileges.
+rmdir: '/tmp/reprotest.A2zxWh/const_build_path/' kustutamine ebaõnnestus: Aucun fichier ou dossier de ce nom
+cleanup failed with exit code 1
+Traceback (most recent call last):
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 862, in run
+    return 0 if check_func(*check_args) else 1
+                ~~~~~~~~~~^^^^^^^^^^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 379, in check
+    local_dists += [proc.send(nv) for nv in zip(bnames[1:], build_variations[1:])]
+                    ~~~~~~~~~^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 339, in corun_builds
+    bctx.run_build(testbed, build, os.environ, artifact_pattern, testbed_build_pre, no_clean_on_error)
+    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 218, in run_build
+    testbed.check_exec2(build_argv,
+    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^
+        xenv=['-i'] + ['%s=%s' % (k, v) for k, v in build.env.items()],
+        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+        kind='build')
+        ^^^^^^^^^^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 63, in check_exec2
+    self.bomb('"%s" failed with status %i' % (' '.join(argv), code),
+    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+              adtlog.AutopkgtestError)
+              ^^^^^^^^^^^^^^^^^^^^^^^^
+  File "/usr/lib/python3/dist-packages/reprotest/__init__.py", line 70, in bomb
+    raise _type(m)
+reprotest.lib.adtlog.AutopkgtestError: "sh -ec run_build() {
+    mkdir -p /tmp/reprotest.A2zxWh/build-experiment-1-aux && \
+    mv /tmp/reprotest.A2zxWh/build-experiment-1/ /tmp/reprotest.A2zxWh/const_build_path && \
+    SETARCH_ARCH=$(for a in $(setarch --list); do setarch $a true && echo $a || true; done) && \
+    DROP_ARCH="-v -e ^$(uname -m)\$" && \
+    WORDSIZE=64 && \
+    if [ $WORDSIZE -eq 64 ]; then     for _ARCH_TO_DROP in armh armv7b armv7l         armv8b armv8l arm athlon i386 i486         i586 i686 linux32 mips32 mips parisc32         parisc ppc32le ppc32 ppcle ppc s390         sparc32bash sparc32 sparc;     do         DROP_ARCH="$DROP_ARCH -e ^$_ARCH_TO_DROP\$";     done; fi && \
+    SETARCH_ARCH=$(echo "$SETARCH_ARCH" | grep $DROP_ARCH | shuf -n1) && \
+    KERNEL_VERSION=$(uname -r) && \
+    if [ ${KERNEL_VERSION#2.6} = $KERNEL_VERSION ]; then SETARCH_OPTS=--uname-2.6; fi && \
+    echo "INFO:reprotest.build:KERNEL variation: SETARCH_ARCH = '$SETARCH_ARCH' SETARCH_OPTS = '$SETARCH_OPTS'" >&2 && \
+    CPU_MAX=$(nproc) && \
+    CPU_MIN=$({ echo $CPU_MAX; echo 2; } | sort -n | head -n1) && \
+    CPU_NUM=$(if [ $CPU_MIN = $CPU_MAX ];             then echo $CPU_MIN; echo >&2 "only 1 CPU is available; num_cpus is ineffective";             else shuf -i$((CPU_MIN + 1))-$CPU_MAX -n1; fi) && \
+    export CPU_LIST="$(echo $(shuf -i0-$((CPU_MAX - 1)) -n$CPU_NUM) | tr ' ' ,)" && \
+    echo "INFO:reprotest.build:NUM_CPUS variation: cpu_list = $CPU_LIST" >&2 && \
+    sh -ec '
+        mkdir -p "/tmp/reprotest.A2zxWh/bin"
+        printf '"'"'#!/bin/sh\nsudo -h localhost -E -u salsa-ci env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER /usr/bin/disorderfs "$@"\n'"'"' > "/tmp/reprotest.A2zxWh/bin"/disorderfs
+        chmod +x "/tmp/reprotest.A2zxWh/bin"/disorderfs
+        printf '"'"'#!/bin/sh\nsudo -h localhost -E -u salsa-ci env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER /bin/mkdir "$@"\n'"'"' > "/tmp/reprotest.A2zxWh/bin"/mkdir
+        chmod +x "/tmp/reprotest.A2zxWh/bin"/mkdir
+        printf '"'"'#!/bin/sh\nsudo -h localhost -E -u salsa-ci env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER /bin/fusermount "$@"\n'"'"' > "/tmp/reprotest.A2zxWh/bin"/fusermount
+        chmod +x "/tmp/reprotest.A2zxWh/bin"/fusermount
+    ' && \
+    export PATH="/tmp/reprotest.A2zxWh/bin:$PATH" && \
+    mv /tmp/reprotest.A2zxWh/const_build_path/ /tmp/reprotest.A2zxWh/const_build_path-before-disorderfs/ && \
+    mkdir -p /tmp/reprotest.A2zxWh/const_build_path/ && \
+    disorderfs >&2 --shuffle-dirents=yes /tmp/reprotest.A2zxWh/const_build_path-before-disorderfs/ /tmp/reprotest.A2zxWh/const_build_path/ && \
+    touch /tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts && \
+    sudo -h localhost unshare --uts=/tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts true && \
+    sudo -h localhost nsenter --uts=/tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts hostname reprotest-capture-hostname && \
+    sudo -h localhost nsenter --uts=/tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts domainname reprotest-capture-domainname && \
+    umask 0002 && \
+    export REPROTEST_BUILD_PATH=/tmp/reprotest.A2zxWh/const_build_path/ && \
+    export REPROTEST_UMASK=$(umask) && \
+    sudo -h localhost -E nsenter --uts=/tmp/reprotest.A2zxWh/build-experiment-1-aux/ns-uts sudo -h localhost -E -u salsa-ci -g users env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER \
+    sudo -h localhost -E -u salsa-ci env -u SUDO_COMMAND -u SUDO_GID -u SUDO_UID -u SUDO_USER \
+    taskset -a -c $CPU_LIST \
+    setarch $SETARCH_ARCH $SETARCH_OPTS \
+    sh -ec 'cd "$REPROTEST_BUILD_PATH"; unset REPROTEST_BUILD_PATH; umask "$REPROTEST_UMASK"; unset REPROTEST_UMASK; dpkg-source -x "debusine_0.11.1+salsaci+20250630+7992.dsc" "$(basename "$PWD")" && cd "$(basename "$PWD")" && dpkg-buildpackage --no-sign -b'
+}

reprotest has the following comment and code:

  # -h localhost otherwise we get annoying messages about "can't resolve host"
  # especially when doing the domain_host variation
  SUDO = ['sudo', '-h', 'localhost']

So given that, I'm not sure how to fix this.  Any suggestions?

Thanks,

-- 
Colin Watson (he/him)                              [cjwatson at debian.org]

-- System Information:
Debian Release: 13.0
  APT prefers testing-security
  APT policy: (500, 'testing-security'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.32-amd64 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages reprotest depends on:
ii  apt-utils       3.0.3
ii  libdpkg-perl    1.22.20
ii  procps          2:4.0.4-8
ii  python3         3.13.3-1
ii  python3-debian  1.0.1
ii  python3-distro  1.9.0-1
ii  python3-rstr    3.2.2-1

Versions of packages reprotest recommends:
pn  diffoscope-minimal  <none>
pn  disorderfs          <none>
pn  faketime            <none>
ii  locales-all         2.41-9
ii  sudo                1.9.16p2-2

Versions of packages reprotest suggests:
ii  autodep8     0.29
pn  qemu-system  <none>
ii  qemu-utils   1:10.0.2+ds-1
ii  schroot      1.6.13-7

-- no debconf information