[DSE-Dev] Bug#1118350: libselinux: frequent parallel FTBFS

[Adrian Bunk]

Source: libselinux
Version: 3.9-1
Severity: serious
Tags: ftbfs patch

https://buildd.debian.org/status/logs.php?pkg=libselinux&ver=3.9-1

...
/usr/bin/make pywrap ARCH=i386 USE_PCRE2=y PYTHON=python3.13
\
/usr/bin/make rubywrap ARCH=i386 USE_PCRE2=y RUBY=ruby3.3
make[2]: Entering directory '/build/reproducible-path/libselinux-3.9'
make[2]: Entering directory '/build/reproducible-path/libselinux-3.9'
/usr/bin/make -C src pywrap
/usr/bin/make -C src rubywrap
make[3]: Entering directory '/build/reproducible-path/libselinux-3.9/src'
make[3]: Entering directory '/build/reproducible-path/libselinux-3.9/src'
...
ar rcs libselinux.a avc.o avc_internal.o avc_sidtab.o booleans.o callbacks.o canonicalize_context.o checkAccess.o check_context.o checkreqprot.o compute_av.o compute_create.o compute_member.o compute_relabel.o compute_user.o context.o deny_unknown.o disable.o enabled.o fgetfilecon.o freecon.o freeconary.o fsetfilecon.o get_context_list.o get_default_type.o get_initial_context.o getenforce.o getfilecon.o getpeercon.o init.o is_customizable_type.o label.o label_db.o label_file.o label_media.o label_support.o label_x.o lgetfilecon.o load_policy.o lsetfilecon.o mapping.o matchmediacon.o matchpathcon.o policyvers.o procattr.o query_user_context.o regex.o reject_unknown.o selinux_check_securetty_context.o selinux_config.o selinux_internal.o selinux_restorecon.o sestatus.o setenforce.o setexecfilecon.o setfilecon.o setrans_client.o seusers.o sha1.o stringrep.o validatetrans.o
ar rcs libselinux.a avc.o avc_internal.o avc_sidtab.o booleans.o callbacks.o canonicalize_context.o checkAccess.o check_context.o checkreqprot.o compute_av.o compute_create.o compute_member.o compute_relabel.o compute_user.o context.o deny_unknown.o disable.o enabled.o fgetfilecon.o freecon.o freeconary.o fsetfilecon.o get_context_list.o get_default_type.o get_initial_context.o getenforce.o getfilecon.o getpeercon.o init.o is_customizable_type.o label.o label_db.o label_file.o label_media.o label_support.o label_x.o lgetfilecon.o load_policy.o lsetfilecon.o mapping.o matchmediacon.o matchpathcon.o policyvers.o procattr.o query_user_context.o regex.o reject_unknown.o selinux_check_securetty_context.o selinux_config.o selinux_internal.o selinux_restorecon.o sestatus.o setenforce.o setexecfilecon.o setfilecon.o setrans_client.o seusers.o sha1.o stringrep.o validatetrans.o
cc -Wdate-time -D_FORTIFY_SOURCE=2 -D_LARGEFILE64_SOURCE -D_LARGEFILE64_SOURCE -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/libselinux-3.9=. -fstack-protector-strong -Wformat -Werror=format-security -fno-semantic-interposition -Wall -Wextra -Wdate-time -D_FORTIFY_SOURCE=2 -D_LARGEFILE64_SOURCE -D_LARGEFILE64_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I../include -D_GNU_SOURCE -DNO_ANDROID_BACKEND -DUSE_PCRE2 -DPCRE2_CODE_UNIT_WIDTH=8 -DHAVE_STRLCPY -DHAVE_REALLOCARRAY -Wl,-z,relro -Wl,-z,now -shared -o libselinux.so.1 avc.lo avc_internal.lo avc_sidtab.lo booleans.lo callbacks.lo canonicalize_context.lo checkAccess.lo check_context.lo checkreqprot.lo compute_av.lo compute_create.lo compute_member.lo compute_relabel.lo compute_user.lo context.lo deny_unknown.lo disable.lo enabled.lo fgetfilecon.lo freecon.lo freeconary.lo fsetfilecon.lo get_context_list.lo get_default_type.lo get_initial_context.lo getenforce.lo getfilecon.lo getpeercon.lo init.lo is_customizable_type.lo label.lo label_db.lo label_file.lo label_media.lo label_support.lo label_x.lo lgetfilecon.lo load_policy.lo lsetfilecon.lo mapping.lo matchmediacon.lo matchpathcon.lo policyvers.lo procattr.lo query_user_context.lo regex.lo reject_unknown.lo selinux_check_securetty_context.lo selinux_config.lo selinux_internal.lo selinux_restorecon.lo sestatus.lo setenforce.lo setexecfilecon.lo setfilecon.lo setrans_client.lo seusers.lo sha1.lo stringrep.lo validatetrans.lo -lpcre2-8   -ldl -Wl,-soname,libselinux.so.1,--version-script=libselinux.map,-z,defs,-z,relro
ranlib libselinux.a
ranlib libselinux.a
ranlib: libselinux.a: error reading regex.o: file truncated
make[3]: *** [Makefile:168: libselinux.a] Error 1
make[3]: *** Waiting for unfinished jobs....
make[3]: Leaving directory '/build/reproducible-path/libselinux-3.9/src'
ln -sf libselinux.so.1 libselinux.so
make[2]: *** [Makefile:62: pywrap] Error 2
make[2]: Leaving directory '/build/reproducible-path/libselinux-3.9'
make[1]: *** [debian/rules:58: build-python-3.13] Error 2



pywrap and rubywrap are currently building libselinux.a twice in parallel,
which is both inefficient and causes build failures due to the obvious
race conditions.

The following patch fixes this by doing the all build before
instead of after the bindings builds:

--- libselinux-3.9/debian/rules.old	2025-10-18 10:25:10.459170850 +0000
+++ libselinux-3.9/debian/rules	2025-10-18 10:26:41.555059101 +0000
@@ -52,11 +52,13 @@
 extra_make_args += USE_PCRE2=y
 
 override_dh_auto_build: $(PY3VERSIONS:%=build-python-%) \
-                        $(RUBY_VERSIONS:%=build-ruby-%)
+                        $(RUBY_VERSIONS:%=build-ruby-%) \
+                        build-all
+build-all:
 	$(MAKE) all $(extra_make_args)
-build-python-%:
+build-python-%: build-all
 	$(MAKE) pywrap $(extra_make_args) PYTHON=python$*
-build-ruby-%:
+build-ruby-%: build-all
 	$(call ruby_env,$*) \
 	$(MAKE) rubywrap $(extra_make_args) RUBY=$*