Bug#1141237: pdebuild --source-only-changes includes a (source + binary) $ARCH.buildinfo file

[Stefano Rivera]

Package: pbuilder
Version: 0.231.3
Severity: normal
User: debusine-team at freexian.com
Usertags: wishlist
X-Debbugs-CC: reproducible-builds at alioth-lists.debian.net

When people generate source-only uploads with "pbuilder 
--source-only-changes", the _source.changes file includes an 
_amd64.buildinfo file (for example). This would then fail to merge with 
an _amd64.buildinfo file from the amd64 binary build, that would include 
an identically named buildinfo file with likely different contents.

See: https://salsa.debian.org/freexian-team/debusine/-/work_items/1488

The Debian archive doesn't seem to care about this, at present. But it 
also doesn't actually do anything with .buildinfo files itself, it 
pushes them all off to buildinfos.debian.net. I don't see any special 
handling in there, so I don't know if these are handled or thrown away. 
Reproducible Builds people CCed.

Debusine took the stance of dissallowing .buildinfo files that are not 
named _source.buildinfo, in source-only uploads. I stand by that choice, 
but obviously it has some impact for users who were using toolchains 
that produced such things.

I would suggest that when called with --source-only-changes, pbuilder copy 
the .buildinfo file to _source.buildinfo and include *that* in the 
_source.changes instead.

sbuild has the same issue, filed #1141236 for that.

Stefano