tarantool / tarantool/tarantool

Fix build reproducibility

Open
#1,869 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

build raw idea
Dominant language
Lua
Stars
3.7k
Forks
419
Avg merge
1d 23h
Merged PRs (30d)
88

Description

https://tracker.debian.org/pkg/tarantool

Does not build reproducibly during testing
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/tarantool.html
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/tarantool.html

95  /​**·​C·​compile·​flags·​used·​to·​build·​Tarantool·​*/​    95  /​**·​C·​compile·​flags·​used·​to·​build·​Tarantool·​*/​
96  #define·​TARANTOOL_C_FLAGS·​"-​g·​-​O2·​-​fdebug-​prefix-​map=/​build-​1st/​tarantool-​1.​7.​2.​29.​g2ad1af9=.​·​-​Wformat·​-​Werror=format-​security·​-​Wdate-​time·​-​D_FORTIFY_SOURCE=2·​-​fexceptions·​-​funwind-​tables·​-​fno-​omit-​frame-​pointer·​-​fno-​stack-​protector·​-​fno-​common·​-​fopenmp·​-​msse2·​-​std=c11·​-​Wall·​-​Wextra·​-​Wno-​strict-​aliasing·​-​fno-​gnu89-​inline"    96  #define·​TARANTOOL_C_FLAGS·​"-​g·​-​O2·​-​fdebug-​prefix-​map=/​build-​2nd/​tarantool-​1.​7.​2.​29.​g2ad1af9=.​·​-​Wformat·​-​Werror=format-​security·​-​Wdate-​time·​-​D_FORTIFY_SOURCE=2·​-​fexceptions·​-​funwind-​tables·​-​fno-​omit-​frame-​pointer·​-​fno-​stack-​protector·​-​fno-​common·​-​fopenmp·​-​msse2·​-​std=c11·​-​Wall·​-​Wextra·​-​Wno-​strict-​aliasing·​-​fno-​gnu89-​inline"
97  /​**·​CXX·​compile·​flags·​used·​to·​build·​Tarantool·​*/​  97  /​**·​CXX·​compile·​flags·​used·​to·​build·​Tarantool·​*/​
98  #define·​TARANTOOL_CXX_FLAGS·​"-​g·​-​O2·​-​fdebug-​prefix-​map=/​build-​1st/​tarantool-​1.​7.​2.​29.​g2ad1af9=.​·​-​Wformat·​-​Werror=format-​security·​-​Wdate-​time·​-​D_FORTIFY_SOURCE=2·​-​fexceptions·​-​funwind-​tables·​-​fno-​omit-​frame-​pointer·​-​fno-​stack-​protector·​-​fno-​common·​-​fopenmp·​-​msse2·​-​std=c++11·​-​Wall·​-​Wextra·​-​Wno-​strict-​aliasing·​-​Wno-​invalid-​offsetof"    98  #define·​TARANTOOL_CXX_FLAGS·​"-​g·​-​O2·​-​fdebug-​prefix-​map=/​build-​2nd/​tarantool-​1.​7.​2.​29.​g2ad1af9=.​·​-​Wformat·​-​Werror=format-​security·​-​Wdate-​time·​-​D_FORTIFY_SOURCE=2·​-​fexceptions·​-​funwind-​tables·​-​fno-​omit-​frame-​pointer·​-​fno-​stack-​protector·​-​fno-​common·​-​fopenmp·​-​msse2·​-​std=c++11·​-​Wall·​-​Wextra·​-​Wno-​strict-​aliasing·​-​Wno-​invalid-​offsetof" 

=> filter CFLAGS

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Debian package page and the reproducible-builds report for tarantool, then inspect the diffoscope output to confirm which generated files differ. Trace where TARANTOOL_C_FLAGS and TARANTOOL_CXX_FLAGS are produced, and verify the build twice with the differing build paths; done means the package passes the reproducibility test without embedding those differences.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp, debian
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.