--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Over the last several months, I and others have found quite a few
packages that embed build paths via rpath when building with cmake. I
found myself slowly edging into a mass bug filing, one bug report at a
time...

I ended up submitting a few patches and noting some affected packages:

https://tests.reproducible-builds.org/debian/issues/unstable/cmake_rpath_contains_build_path_issue.html

There are almost certainly packages missing from that list, as it is
generated by human confirmation...


In many cases I've tested so far, passing an argument via a
dh_auto_configure override in debian/rules fixes the issue:

override_dh_auto_configure:
dh_auto_configure -- -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON


Alternately, the experimental debhelper compat level v14 does include a
fix for these embedded rpaths, though in the current state, passing both -DCMAKE_SKIP_RPATH=ON and -DCMAKE_RPATH_USE_ORIGIN=ON, it triggers build failures 263 packages, according to a test run by Lucas Nussbaum in
October:

http://qa-logs.debian.net/2021/10/25/diff.dcsr.txt


Since debhelper v14 is not finalized yet, I just sent a request to
debhelper to only pass one of the arguments,
-DCMAKE_RPATH_USE_ORIGIN=ON, which should significantly reduce the
number of build failures while still making many packages reproducible
with debhelper compat v14:

https://bugs.debian.org/1004939


I've attached a list of the maintainers of affected packages produced
with dd-list, getting the list of packages from the above-mentioned reproducible builds issue and diff.dcsr.txt from archive rebuild.

If you're on the list, would love if you could check if your package
still builds correctly when passing only
-DCMAKE_BUILD_RPATH_USE_ORIGIN=ON. For a few of the packages, there are already patches in the Debian bug tracking system waiting for you!


Thanks everyone!


live well,
vagrant

--=-=-Content-Type: text/plain; charset=utf-8
Content-Disposition: inline; filename�-list.txt
Content-Transfer-Encoding: quoted-printable

"Adam C. Powell, IV" <[email protected]>
oce (U)

A. Maitland Bottoms <[email protected]>
gr-funcube (U)
gr-gsm (U)
gr-hpsdr (U)
gr-iqbal
gr-limesdr (U)
gr-satellites (U)
libad9361

Adam Borowski <[email protected]>
pmemkv
vmemcache

Aigars Mahinovs <[email protected]>
dlt-daemon

Alastair McKinstry <[email protected]>
libtool
mathgl (U)

Alberto Luaces Fernández <[email protected]>
openscenegraph

Alessio Di Mauro <[email protected]>
yubico-piv-tool (U)

Alessio Treglia <[email protected]>
leveldb (U)
libsoxr (U)

Alexander GQ Gerasiov <[email protected]>
croaring

Alexandre Marie <[email protected]>
ufo-core (U)

Alf Gaida <[email protected]>
juffed (U)
screengrab (U)

Andrea Capriotti <[email protected]>
userbindmount (U)
vdeplug4 (U)

Andreas Beckmann <[email protected]>
pocl (U)

Andreas Bombe <[email protected]>
gr-limesdr (U)
soapyosmo (U)
soapysdr (U)

Andreas Rönnquist <[email protected]>
allegro5 (U)

Andreas Tille <[email protected]>
libbpp-seq (U)
libbpp-seq-omics (U)
liblemon (U)
libminc (U)
libvbz-hdf-plugin (U)
libzeep (U)
openmm (U)
spoa (U)

Andrew Lee (李健秋) <[email protected]>
screengrab (U)

Andrew Pollock <[email protected]>
log4cplus

Andrey Rahmatullin <[email protected]>
librsync

Andrius Merkys <[email protected]>
openmm (U)
openstructure (U)

Ansgar <[email protected]>
dune-common (U)
dune-geometry (U)
dune-grid (U)
dune-grid-glue (U)
dune-uggrid (U)

Anthony Fok <[email protected]>
fontforge (U)

Anton Gladky <[email protected]>
alglib (U)
benchmark (U)
cctz (U)
kim-api (U)
libopenshot (U)
liggghts (U)
metis (U)
tetgen (U)
vtk9 (U)

Apollon Oikonomopoulos <[email protected]>
leatherman (U)

Arne Bernin <[email protected]>
libfreenect (U)

Aron Xu <[email protected]>
fcitx (U)
libgooglepinyin (U)

Aurelien Jarno <[email protected]>
libftdi
libftdi1

Aurélien COUDERC <[email protected]>
analitza (U)
artikulate (U)
elisa-player (U)
kdebugsettings (U)
keditbookmarks (U)
kget (U)
libkeduvocdocument (U)
okteta (U)

Ayatana Packagers <[email protected]>
qmenumodel

Barak A. Pearlmutter <[email protected]>
cppad (U)
mlpack (U)

Bartosz Fenski <[email protected]>
supertux (U)

Bas Couwenberg <[email protected]>
geos (U)
qgis (U)
sfcgal (U)

Ben Burton <[email protected]>
regina-normal

Benjamin Barenblat <[email protected]>
abseil

Benjamin Drung <[email protected]>
libsoxr (U)

Bjoern Ricks <[email protected]>
grantlee5 (U)

Boian Bonev <[email protected]>
gammu

Boris Pek <[email protected]>
eiskaltdcpp

Boyuan Yang <[email protected]>
cjson
fcitx5 (U)
fcitx5-gtk (U)
fcitx5-qt (U)
go-for-it
libavif (U)
libime (U)
libxlsxwriter (U)
qevercloud
tidy-html5 (U)
xcb-imdkit (U)
zxing-cpp

Bret Curtis <[email protected]>
recastnavigation (U)

Carlos Donizete Froes <[email protected]>
surgescript (U)

CESNET <[email protected]>
libyang (U)

ChangZhuo Chen (陳昌倬) <[email protected]>
juffed (U)
screengrab (U)

Chow Loong Jin <[email protected]>
tinyxml2

Christoph Berg <[email protected]>
gr-limesdr (U)
gr-satellites (U)
libcm256cc (U)

Christoph Junghans <[email protected]>
votca-csg (U)
votca-tools (U)

Christoph Martin <[email protected]>
nfs-ganesha (U)

Connor Imes <[email protected]>
powercap

Cristian Greco <[email protected]>
poco (U)

Dain Nilsson <[email protected]>
yubico-piv-tool (U)

Daniel Kahn Gillmor <[email protected]>
fontforge (U)

Daniel Schepler <[email protected]>
kpat (U)
libkdegames (U)

David Bremner <[email protected]>
ledger

David Lamparter <[email protected]>
libyang

David Prévot <[email protected]>
cmocka

Davide Viti <[email protected]>
fontforge (U)

Debian Astro Team <[email protected]>
purify
sopt

Debian Authentication Maintainers <[email protected]>
yubico-piv-tool

Debian Bridges Team <[email protected]>
libcork
libcorkipset

Debian Deep Learning Team <[email protected]>
pthreadpool

Debian Deepin Packaging Team <[email protected]>
libxlsxwriter (U)

Debian Fonts Task Force <[email protected]>
fontforge

Debian Games Team <[email protected]>
allegro5
colobot
hedgewars
ogre-1.9
recastnavigation
spring
supertux
surgescript

Debian GIS Project <[email protected]>
geos
qgis
sfcgal

Debian GNOME Maintainers <[email protected]>
evolution
evolution-ews

Debian Hamradio Maintainers <[email protected]>
gr-funcube
gr-gsm
gr-hpsdr
gr-limesdr
gr-satellites
libcm256cc
soapyosmo
soapysdr

Debian Input Method Team <[email protected]>
fcitx
fcitx5
fcitx5-gtk
fcitx5-qt
libgooglepinyin
libime
xcb-imdkit

Debian IoT Maintainers <[email protected]>
hoel
iddawc
orcania
rhonabwy
ulfius
yder

Debian KDE Extras Team <[email protected]>
alkimia
gammaray
kdiagram
kphotoalbum
ktorrent
lensfun
soundkonverter

Debian Kolab Maintainers <[email protected]>
libkolabxml

Debian Krap Maintainers <[email protected]>
grantlee5
indi

Debian Med Packaging Team <[email protected]>
camp
cassiopee
ciftilib
ismrmrd
libbpp-seq
libbpp-seq-omics
liblemon
libminc
libqes
libvbz-hdf-plugin
libvistaio
libzeep
spdlog
spoa

Debian Med Packaging Team <[email protected]>
maxflow

Debian Mobcom Maintainers <[email protected]>
freediameter

Debian Multimedia Maintainers <[email protected]>
csound
inkscape
kissfft
libavif
libmysofa
libopenshot
libsoxr
libwebm
nordlicht
x265

Debian OpenCL Maintainers <[email protected]>
pocl

Debian PhotoTools Maintainers <[email protected]>
ilmbase
imath

Debian QA Group <[email protected]>
libcue
liblaxjson
wbxml2

Debian Qt Extras Team <[email protected]>
gcompris-qt

Debian Qt/KDE Maintainers <[email protected]>
akonadi
akonadi-contacts
akonadi-import-wizard
akonadi-mime
akonadi-notes
akonadiconsole
akregator
analitza
artikulate
attica-kf5
bluez-qt
clazy
elisa-player
k3b
kalarmcal
kcmutils
kcodecs
kcompletion
kconfigwidgets
kcontacts
kcrash
kdebugsettings
kdeclarative
kdesu
keditbookmarks
kget
kholidays
kitemmodels
kitinerary
kjs
kldap
kmbox
kmediaplayer
kontact
kpackage
kparts
kpat
kpkpass
ksyntax-highlighting
ktextwidgets
ktnef
kuserfeedback
kwallet-kf5
kxmlrpcclient
libkdegames
libkeduvocdocument
libkf5calendarsupport
pim-sieve-editor
pkg-kde-tools
plasma-nm
plasma-thunderbolt
prison-kf5
qca2
syndication
threadweaver

Debian Remote Maintainers <[email protected]>
libvncserver

Debian Robotics Team <[email protected]>
fastcdr
foonathan-memory

Debian Science Maintainers <[email protected]>
mlpack

Debian Science Maintainers <[email protected]>
asl
cld2
clfft
dart
docopt.cpp
dune-common
dune-geometry
dune-grid
dune-grid-glue
dune-uggrid
fcl
gemmlowp
glbinding
globjects
graywolf
hepmc3
ignition-common
ignition-math
ignition-msgs
libccd
liggghts
mathgl
metis
netgen
nsync
oce
orocos-bfl
primesieve
ros-rosconsole-bridge
ros-rospack
scalapack
segyio
simbody
sleef
trilinos
ufo-core
urdfdom
visp
xeus
xeus-python

Debian Science Team <[email protected]>
cg3
cppad

Debian Science Team <[email protected]>
alglib
benchmark
cctz
cryptominisat
kim-api
meshlab
nexus
schroedinger-coordgenlibs
schroedinger-maeparser
simage
tetgen
vtk9

Debian SSSD Team <[email protected]>
uid-wrapper

Debian UBports Team <[email protected]>
libqtdbusmock (U)
libqtdbustest (U)
lomiri-api
lomiri-thumbnailer
net-cpp
qmenumodel (U)

Debian VirtualSquare Team <[email protected]>
userbindmount
vdeplug4

Debian X Strike Force <[email protected]>
vulkan-loader

Debian XMPP Maintainers <[email protected]>
dino-im

Debian/Kubuntu Qt/KDE Maintainers <[email protected]>
okteta
pulseaudio-qt

Debichem Team <[email protected]>
chemps2
openmm
openstructure
votca-csg
votca-tools
votca-xtp

Denis Barbier <[email protected]>
oce (U)

Dennis Braun <[email protected]>
csound (U)

Diane Trout <[email protected]>
libkolabxml (U)

Dimitrios Eftaxiopoulos <[email protected]>
mathgl (U)

Dmitry E. Oboukhov <[email protected]>
hedgewars (U)

Dmitry Shachnev <[email protected]>
pkg-kde-tools (U)

Dmitry Smirnov <[email protected]>
gnucash

Dr. Tobias Quathamer <[email protected]>
libopenshot (U)

Eduard Bloch <[email protected]>
encfs

Eugene V. Lyubimkin <[email protected]>
cupt

Fabian Wolff <[email protected]>
z3 (U)

Fabien Spindler <[email protected]>
visp (U)

Felix Geyer <[email protected]>
qca2 (U)

Flavien Bridault <[email protected]>
camp (U)

Forrest Cahoon <[email protected]>
csound (U)

Francesco Paolo Lovergine <[email protected]>
geos (U)
qgis (U)

Georges Khaznadar <[email protected]>
enki-aseba

Gert Wollny <[email protected]>
maxflow (U)
vtk9 (U)

Gert Wollny <[email protected]>
libvistaio (U)

Ghislain Antony Vaillant <[email protected]>
ciftilib (U)
clfft (U)
docopt.cpp (U)
glbinding (U)
globjects (U)
ismrmrd (U)

Gianfranco Costamagna <[email protected]>
cld2 (U)
cpprest
dlt-daemon (U)
hedgewars (U)
yaml-cpp (U)

Gijs Molenaar <[email protected]>
purify (U)
sopt (U)

Gordon Ball <[email protected]>
xeus (U)
xeus-python (U)

Graham Inggs <[email protected]>
trilinos (U)

Gudjon I. Gudjonsson <[email protected]>
alglib (U)

Gürkan Myczko <[email protected]>
meshlab (U)

Harlan Lieberman-Berg <[email protected]>
nanomsg

Henning Glawe <[email protected]>
libktoblzcheck (U)

HepMC developers <[email protected]>
hepmc3 (U)

Hideki Yamane <[email protected]>
fontforge (U)

Hubert Chathi <[email protected]>
olm (U)

Håvard Flaget Aasen <[email protected]>
c-blosc

Héctor Orón Martínez <[email protected]>
intel-processor-trace (U)

Iain Lane <[email protected]>
evolution-ews (U)

IOhannes m zmölnig (Debian/GNU) <[email protected]>
csound (U)
libmysofa (U)

Jakub Adam <[email protected]>
gammaray (U)

James Cowgill <[email protected]>
mbedtls

James McCoy <[email protected]>
msgpack-c

Jeremy Bicha <[email protected]>
evolution (U)
evolution-ews (U)

Jerome Benoit <[email protected]>
primesieve (U)

Jerome Kieffer <[email protected]>
clfft (U)

Jerome Lebleu <[email protected]>
rspamd (U)

Jochen Sprickerhof <[email protected]>
orocos-bfl (U)
poco (U)
ros-rosconsole-bridge (U)
ros-rospack (U)

Johannes 'josch' Schauer <[email protected]>
fuzzylite

Johannes Schauer <[email protected]>
orocos-bfl (U)

Jonas Smedegaard <[email protected]>
cmark
editorconfig-core
fontforge (U)
olm (U)

Jonathan Carter <[email protected]>
calamares

Jordan Justen <[email protected]>
piglit

Jose Luis Rivero <[email protected]>
dart (U)
fcl (U)
ignition-common (U)
ignition-math (U)
ignition-msgs (U)
libccd (U)
simbody (U)
urdfdom (U)

Julian Rüth <[email protected]>
cryptominisat (U)

Julien Dutheil <[email protected]>
libbpp-seq (U)
libbpp-seq-omics (U)

Julien Puydt <[email protected]>
cryptominisat (U)

Jørgen Kvalsvik <[email protected]>
segyio (U)

Kamal Mostafa <[email protected]>
hershey-fonts

Kartik Mistry <[email protected]>
cg3 (U)

Keith Packard <[email protected]>
cmark-gfm

Kevin Murray <[email protected]>
libqes (U)

Klas Lindfors <[email protected]>
yubico-piv-tool (U)

Krzysztof Burghardt <[email protected]>
poco

Kurt Kremitzki <[email protected]>
netgen (U)

Laszlo Boszormenyi (GCS) <[email protected]>
gflags
leveldb
nng
snappy
upb

Laurent Bigonville <[email protected]>
evolution (U)

Leandro Ramos <[email protected]>
go-for-it (U)

Leopold Palomo-Avellaneda <[email protected]>
fcl (U)
ros-rosconsole-bridge (U)
ros-rospack (U)

Lev Lamberov <[email protected]>
swi-prolog

Lisandro Damián Nicanor Pérez Meyer <[email protected]>
akonadi-contacts (U)
akonadi-mime (U)
akonadi-notes (U)
kpat (U)
pkg-kde-tools (U)

LLVM Packaging Team <[email protected]>
z3

Lucas Nussbaum <[email protected]>
pajeng (U)

Lukas Märdian <[email protected]>
zziplib (U)

LXQt Packaging Team <[email protected]>
juffed
screengrab

Ma Aiguo <[email protected]>
libxlsxwriter

Maarten L. Hekkelman <[email protected]>
libzeep (U)

Manuel A. Fernandez Montecelo <[email protected]>
ogre-1.9 (U)
openscenegraph (U)

Mark Purcell <[email protected]>
alkimia (U)
lensfun (U)
soundkonverter (U)

Mark Renouf <[email protected]>
libfreenect (U)

Markus Koschany <[email protected]>
spring (U)

Martin <[email protected]>
dino-im (U)

Martin Quinson <[email protected]>
pajeng

Mathieu Malaterre <[email protected]>
ilmbase (U)

Matrix Packaging Team <[email protected]>
olm

Matt Palmer <[email protected]>
ledger (U)

Matteo Cypriani <[email protected]>
qmmp

Matteo F. Vescovi <[email protected]>
ilmbase (U)
imath (U)

Matthias Maier <[email protected]>
trilinos (U)

Mattia Biondi <[email protected]>
userbindmount (U)
vdeplug4 (U)

Mattia Rizzolo <[email protected]>
inkscape (U)

Mattias Ellert <[email protected]>
gfal2
scitokens-cpp

Maximiliano Curia <[email protected]>
grantlee5 (U)
indi (U)
pkg-kde-tools (U)
qca2 (U)

Micha Lenk <[email protected]>
libktoblzcheck

Michael Banck <[email protected]>
chemps2 (U)
votca-csg (U)
votca-tools (U)

Michael Meskes <[email protected]>
akonadi-import-wizard (U)
akonadiconsole (U)
akregator (U)
k3b (U)
kontact (U)
pim-sieve-editor (U)
soundkonverter (U)

Michael R. Crusoe <[email protected]>
benchmark (U)
spdlog (U)

Mike Gabriel <[email protected]>
libqtdbusmock (U)
libqtdbustest (U)
libvncserver (U)
lomiri-api (U)
lomiri-thumbnailer (U)
net-cpp (U)
qmenumodel (U)

Mikhail Gusarov <[email protected]>
rspamd (U)

Miles Lubin <[email protected]>
cppad (U)

Mirek Kratochvil <[email protected]>
apulse

Mo Zhou <[email protected]>
hepmc3 (U)

Mo Zhou <[email protected]>
gemmlowp (U)
nsync (U)
pthreadpool (U)
sleef (U)

Modestas Vainius <[email protected]>
ktorrent (U)
pkg-kde-tools (U)

Muammar El Khatib <[email protected]>
scalapack (U)

Nathan Osman <[email protected]>
qhttpengine

Nicholas Breen <[email protected]>
votca-csg (U)
votca-tools (U)
votca-xtp (U)

Nicholas Guriev <[email protected]>
rlottie

Nick Black <[email protected]>
notcurses

Nico Schlömer <[email protected]>
vtk9 (U)

Nicolas Bourdaud <[email protected]>
libfreenect

Nicolas Mora <[email protected]>
hoel (U)
iddawc (U)
json-c
libical3
orcania (U)
rhonabwy (U)
ulfius (U)
yder (U)

nicoo <[email protected]>
yubico-piv-tool (U)

Nilesh Patra <[email protected]>
libvbz-hdf-plugin (U)

Norbert Preining <[email protected]>
akonadi (U)
akonadi-contacts (U)
akonadi-import-wizard (U)
akonadi-mime (U)
akonadi-notes (U)
akonadiconsole (U)
akregator (U)
analitza (U)
artikulate (U)
attica-kf5 (U)
bluez-qt (U)
elisa-player (U)
k3b (U)
kalarmcal (U)
kcmutils (U)
kcodecs (U)
kcompletion (U)
kconfigwidgets (U)
kcontacts (U)
kcrash (U)
kdebugsettings (U)
kdeclarative (U)
kdesu (U)
keditbookmarks (U)
kget (U)
kholidays (U)
kitemmodels (U)
kitinerary (U)
kjs (U)
kldap (U)
kmbox (U)
kmediaplayer (U)
kontact (U)
kpackage (U)
kparts (U)
kpat (U)
kphotoalbum (U)
kpkpass (U)
ksyntax-highlighting (U)
ktextwidgets (U)
ktnef (U)
kwallet-kf5 (U)
kxmlrpcclient (U)
libkdegames (U)
libkeduvocdocument (U)
libkf5calendarsupport (U)
pim-sieve-editor (U)
plasma-nm (U)
plasma-thunderbolt (U)
prison-kf5 (U)
syndication (U)
threadweaver (U)

Ole Streicher <[email protected]>
purify (U)
sopt (U)

Olivier Sallou <[email protected]>
cassiopee (U)
visp (U)

Ondřej Surý <[email protected]>
brotli (U)
libyang (U)
libzip (U)
tidy-html5 (U)

Patrick Franz <[email protected]>
plasma-nm (U)
plasma-thunderbolt (U)

Patrick Gansterer <[email protected]>
poco (U)

Patrick Matthäi <[email protected]>
kid3

Patryk Cisek <[email protected]>
injeqt

Paul Klos <[email protected]>
libkolabxml (U)

Paulo Henrique de Lima Santana (phls) <[email protected]>
kickpass

Peter Pentchev <[email protected]>
createrepo-c

Peter Spiess-Knafl <[email protected]>
libjson-rpc-cpp
nordlicht (U)

Petter Reinholdtsen <[email protected]>
gr-gsm (U)

Philippe Deniel <[email protected]>
nfs-ganesha

Picca Frédéric-Emmanuel <[email protected]>
ufo-core (U)

Pino Toscano <[email protected]>
clazy (U)
grantlee5 (U)
indi (U)
kdiagram (U)
lensfun (U)
pkg-kde-tools (U)
plasma-thunderbolt (U)

Puppet Package Maintainers <[email protected]>
leatherman

Rafael Laboissière <[email protected]>
mathgl (U)

Renzo Davoli <[email protected]>
userbindmount (U)
vdeplug4 (U)

Rob Browning <[email protected]>
emacs

Robert McGibbon <[email protected]>
openmm (U)

Roberto C. Sanchez <[email protected]>
luabind

Roger Shimizu <[email protected]>
libcork (U)
libcorkipset (U)

Rogério Brito <[email protected]>
fontforge (U)

Roman Ondrá�ek <[email protected]>
paho.mqtt.c

Ruben Undheim <[email protected]>
freediameter (U)
graywolf (U)

Ryan Pavlik <[email protected]>
meshlab (U)

Sandro Knauß <[email protected]>
akonadi (U)
akonadi-contacts (U)
akonadi-import-wizard (U)
akonadi-mime (U)
akonadi-notes (U)
akonadiconsole (U)
akregator (U)
cmocka (U)
kalarmcal (U)
kcontacts (U)
kitinerary (U)
kldap (U)
kmbox (U)
kontact (U)
kpkpass (U)
ktnef (U)
kuserfeedback (U)
libkf5calendarsupport (U)
libkolabxml (U)
pim-sieve-editor (U)

Scarlett Clark <[email protected]>
clazy (U)

Scarlett Moore <[email protected]>
k3b (U)
kuserfeedback (U)
plasma-nm (U)
plasma-thunderbolt (U)
pulseaudio-qt (U)

Scott Howard <[email protected]>
alglib (U)
zziplib

Sebastian Ramacher <[email protected]>
x265 (U)

Sebastian Wouters <[email protected]>
chemps2 (U)

Sebastien Bacher <[email protected]>
evolution (U)

Sebastien Badia <[email protected]>
rspamd

Sepi Gair <[email protected]>
libxtrxll

Serge Cohen <[email protected]>
ufo-core (U)

Sergio Durigan Junior <[email protected]>
intel-processor-trace (U)
rspamd (U)

Shengjing Zhu <[email protected]>
fmtlib
sdbus-cpp

Simon Quigley <[email protected]>
gcompris-qt (U)
yaml-cpp

Stefan Schörghofer <[email protected]>
libzip

Steffen Moeller <[email protected]>
schroedinger-coordgenlibs (U)
schroedinger-maeparser (U)

Steve M. Robbins <[email protected]>
libminc (U)
simage (U)

Stuart Prescott <[email protected]>
nexus (U)

Sudip Mukherjee <[email protected]>
trace-cmd

Sune Vuorela <[email protected]>
akonadi (U)

Sune Vuorela <[email protected]>
akonadi-contacts (U)
akonadi-import-wizard (U)
akonadi-mime (U)
akonadi-notes (U)
akonadiconsole (U)
akregator (U)
grantlee5 (U)
keditbookmarks (U)
kget (U)
kontact (U)
kpat (U)
libkdegames (U)
okteta (U)
pim-sieve-editor (U)
pkg-kde-tools (U)

Sven Geggus <[email protected]>
sfcgal (U)

Taowa <[email protected]>
dino-im (U)

Teemu Ikonen <[email protected]>
meshlab (U)

The Ayatana Packagers <[email protected]>
libqtdbusmock
libqtdbustest

Thomas Dreibholz <[email protected]>
hipercontracer

Thorsten Alteholz <[email protected]>
hoel (U)
nuspell
orcania (U)
ulfius (U)
yder (U)

Tidy HTML5 <[email protected]>
tidy-html5

Timo Aaltonen <[email protected]>
uid-wrapper (U)
vulkan-loader (U)

Timo Röhling <[email protected]>
fastcdr (U)
foonathan-memory (U)
tinyexr
tinyobjloader

Tino Didriksen <[email protected]>
cg3 (U)

Tobias Frost <[email protected]>
log4cplus (U)

Tobias Hansen <[email protected]>
allegro5 (U)

Tomasz Buchert <[email protected]>
brotli

Vasudev Kamath <[email protected]>
editorconfig-core (U)

Vasudev Kamath <[email protected]>
fontforge (U)

Vasyl Gello <[email protected]>
kissfft (U)
libwebm (U)

Victor Seva <[email protected]>
intel-processor-trace

Vincent Cheng <[email protected]>
supertux (U)

Vincent Danjean <[email protected]>
pocl (U)

William Blough <[email protected]>
xalan

Yangfl <[email protected]>
yaramod

Yaroslav Halchenko <[email protected]>
libfreenect (U)

YunQiang Su <[email protected]>
fcitx (U)

YunQiang Su <[email protected]>
libgooglepinyin (U)


--=-=-=--

--==-=-Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYfx2MgAKCRDcUY/If5cW qknBAPsFlUcLzKdXxLMl9s3ZeqO6AAYkdhez4AHQ6QJF4HNmjwEArtB036c1Z2MK lTbeAS9o9hfD7aeW9Mk3eZIz+EvvuwI=WaO5
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Thu, Feb 03, 2022 at 04:41:21PM -0800, Vagrant Cascadian wrote:

Over the last several months, I and others have found quite a few
packages that embed build paths via rpath when building with cmake. I
found myself slowly edging into a mass bug filing, one bug report at a time...

Hello Vagrant, does this represent a security problem?

I tried to give this a look myself but didn't know what to look for; I
grabbed a few recent versions of packages:

http://ftp.debian.org/debian/pool/main/n/nfs-ganesha/nfs-ganesha_3.4-1_amd64.deb
http://ftp.debian.org/debian/pool/main/v/vmemcache/libvmemcache0_0.8.1-4_amd64.deb
http://ftp.debian.org/debian/pool/main/f/fontforge/fontforge_20201107~dfsg-4_amd64.deb

$ find . -type f -exec eu-readelf -d {} \; 2>/dev/null | grep RUNPATH
RUNPATH Library runpath: [/usr/lib/ganesha]
RUNPATH Library runpath: [/usr/lib/ganesha]
RUNPATH Library runpath: [/usr/lib/ganesha]
RUNPATH Library runpath: [/usr/lib/ganesha]

Am I on the wrong track?

Thanks

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEQVAQ8bojyMcg37H18yFyWZ2NLpcFAmH8jjUACgkQ8yFyWZ2N LpcSDwf/cfIU7q/thxNiITQud8pU6fqtjD0LHkBxhpKi1OHrHdGcvxAHvs++ovFF KAKO//DOhGeu7mVuhm45ZiFy4d56OCe0wQp6djoCfQ+qqMApAnMIXvxhTQlhSnYg zfFhD5r8pgZjMBBEtDGkhneebdJFArNoSKTo2fSYwzwv6yTdjGqOsSR1LM8Tgpty 27k6kleEOaKovge/SUBVbjRHGu3F8EW2z+TGQkX4PSqyYzg2owcOzF2yBFfaVRLW vBOmrtIjH8G5Bend8yRwraYmvbZCDYEEH1DOQ8jYxUahHTzKQFkSrwKxiCoRqozj bxQjdnBndw4SdsOQfx3Xy8qyiVhiFw==
=qzow
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Vagrant Cascadian wrote:

Over the last several months, I and others have found quite a few
packages that embed build paths via rpath when building with cmake.

This seems like the sort of thing that will be an ongoing problem, so
if it is detectable statically then a lintian warning might be good.

--
bye,
pabs

https://wiki.debian.org/PaulWise

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEYQsotVz8/kXqG1Y7MRa6Xp/6aaMFAmH8tKYACgkQMRa6Xp/6 aaMhYg/8CAg++vJhYNKP8FRY9x/P5PVY0DwXsUjEq/lVOpwxQjh/uV4cLrcy5hCD hFm7PRaCD0AXcCDRTTys6s2hs625+pLBZ1pf4StvUqAXAOGq8edO562bX2cpiqfH tTFilxDu+WcRpmMLSUgtOQtbP8fvsKxOO7vPJ+zeICWEnbWXkF9mNrPrnZWMz+9z L+9L+b0G1QcmMmI1QvZWRFeKmPAQMEdy1BZVCroqOFXAqZRurKBxP/4vkW0CJYeT Bb2Bhh5V0gtoUW/tlM5j3PH2SbcfHcvdmnZOpdoH1ODnM11bPcssHrc35ZMsLfzz RGf6hcra3YRr1q7DiduPlQ9TQVILiXHfyuqysjhr6anidiQVoSvcnW1v4hMyK7oS hdTq7IYel8dTNjSCb6PAqA2tvFmfTijS8K3LN/uoiQkEda74g0EQMYQGRwoqSKoC di3+DNP0lySEdpjtUS8sGC8cWQ6TpguywEM13TtzNKbnBYMDtED8dL2MIhWoWfG2 Syg9iVgxH5v02T3uXrsFh2+IM7/gGREx88+63IoBUlysXAFX9OSX1wekMPvZW488 lQuSf9kSqW9FustM4A78ExTdukjOjJa5bWkRCtPnCrmO5NAsieEmeXxl00v1hGVw bZ0OflZShlLV4u2x1HJLt+c64kbbuWO3lUZe9yfw7oE3egRgUWc=
=x5R1
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Fri, 04 Feb 2022 at 02:23:54 +0000, Seth Arnold wrote:

does this represent a security problem?

"It depends". (This answer is not specific to CMake, it's equally valid
for any build system.)

If the RPATH or RUNPATH points to a trusted directory where write access
would require root-equivalent privileges, such as somewhere below /usr,
then it's not a problem.

Some packages have to do this in order to access private shared libraries, which sounds like a contradiction, but isn't really. Some libraries
are not sufficiently API- or ABI-stable to be suitable to place them
in the global search path for the OS as a whole, but do need to be
shared between a closely cooperating group of programs, either within a
single package or in several tightly-coupled packages.

For example, lots of small programs in the systemd package are linked to /lib/systemd/libsystemd-shared-250.so, which contains code that is shared between those programs but is not a stable public API. Statically linking
that shared code would have resulted in a separate partial copy in every program, which would have made the package much larger, so instead it
is a private shared library; and to make that work, the programs have
a RUNPATH pointing to /lib/systemd.

This RUNPATH is not a security problem with systemd, because to be
able to exploit it to make these programs execute arbitrary code, an
attacker would need to be able to write to /lib/systemd - but if the
attacker can write to /lib/systemd (or, more generally, /usr or /lib),
then system integrity has already failed.

Having a RUNPATH set to /usr/lib/ganesha looks like it is similar to
the systemd case. If it's intentional, then it's almost certainly fine.

The situation where a RPATH or RUNPATH *does* represent a security problem
is when the RPATH or RUNPATH points to a directory that might become attacker-controlled. For example, if the RUNPATH of a program "foobar" is
set to its build directory in /tmp, perhaps /tmp/foobar_1.0_59PnHH,
then an attacker could create that directory, put their malicious code
into it, and wait for the victim to run foobar.

Similarly, if the RUNPATH is /home/fred/builds/foobar-1.0, then
that isn't a practical problem for most people, but if you happen to
have an untrusted local user whose home directory is /home/fred, it
becomes a security vulnerability on that particular system.

There is a third situation referenced by https://tests.reproducible-builds.org/debian/issues/unstable/cmake_rpath_contains_build_path_issue.html,
which is not a security problem, but is a reproducibility problem. It's
common for executables and libraries to be given a temporary RUNPATH
pointing to the location of shared libraries in the build directory, so
that unit tests can be run before the package is installed without needing
to set the LD_LIBRARY_PATH (in Autotools, this is the --disable-fast-install option; in CMake, it seems to be the default). CMake removes the RUNPATH
just before installation, so it doesn't become a security problem,
but that's too late to stop it from affecting the build-ID - and the
*length* of the build directory can also affect the contents of the
binary, because when RUNPATHs are removed, it is done by overwriting
them with zeroes in-place, leaving a run of zeroes with the same length
as the removed RUNPATH.

smcv

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Fri, 04 Feb 2022 at 13:07:53 +0800, Paul Wise wrote:

Vagrant Cascadian wrote:

Over the last several months, I and others have found quite a few
packages that embed build paths via rpath when building with cmake.

This seems like the sort of thing that will be an ongoing problem, so
if it is detectable statically then a lintian warning might be good.

For packages that (intentionally or unintentionally) still have a RPATH
or RUNPATH in their installed files, https://lintian.debian.org/tags/custom-library-search-path detects it.
You'll see that many of them are overridden as being necessary and
intentional.

For packages where the RPATH or RUNPATH is temporarily set during build
(to be able to run unit tests without setting LD_LIBRARY_PATH) but then
removed before installation with `chrpath -d` or equivalent code in CMake,
I don't think this is going to be detectable statically, because the
only traces left in the final binary are:

- the build-ID will be different, because the RPATH/RUNPATH was part of
the data that gets hashed to create the build-ID
- if the length of the build directory changes, then the block of zero
bytes that previously contained the RPATH/RUNPATH (before it was
overwritten) will have a different length

This is the sort of thing that can probably only be detected by literally
doing two builds (in different directories) and comparing them with
diffoscope, or possibly by screen-scraping build logs like blhc does.

smcv

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------003H7Rp2LVFQcg0MpERzz9O8
Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64

T24gMDQvMDIvMjAyMiAxMTo1OCwgU2ltb24gTWNWaXR0aWUgd3JvdGU6DQo+IEZvciBwYWNr YWdlcyB3aGVyZSB0aGUgUlBBVEggb3IgUlVOUEFUSCBpcyB0ZW1wb3JhcmlseSBzZXQgZHVy aW5nIGJ1aWxkDQo+ICh0byBiZSBhYmxlIHRvIHJ1biB1bml0IHRlc3RzIHdpdGhvdXQgc2V0 dGluZyBMRF9MSUJSQVJZX1BBVEgpIGJ1dCB0aGVuDQo+IHJlbW92ZWQgYmVmb3JlIGluc3Rh bGxhdGlvbiB3aXRoIGBjaHJwYXRoIC1kYCBvciBlcXVpdmFsZW50IGNvZGUgaW4gQ01ha2Us DQo+IEkgZG9uJ3QgdGhpbmsgdGhpcyBpcyBnb2luZyB0byBiZSBkZXRlY3RhYmxlIHN0YXRp Y2FsbHksIGJlY2F1c2UgdGhlDQo+IG9ubHkgdHJhY2VzIGxlZnQgaW4gdGhlIGZpbmFsIGJp bmFyeSBhcmU6DQo+IA0KPiAtIHRoZSBidWlsZC1JRCB3aWxsIGJlIGRpZmZlcmVudCwgYmVj YXVzZSB0aGUgUlBBVEgvUlVOUEFUSCB3YXMgcGFydCBvZg0KPiAgICB0aGUgZGF0YSB0aGF0 IGdldHMgaGFzaGVkIHRvIGNyZWF0ZSB0aGUgYnVpbGQtSUQNCj4gLSBpZiB0aGUgbGVuZ3Ro IG9mIHRoZSBidWlsZCBkaXJlY3RvcnkgY2hhbmdlcywgdGhlbiB0aGUgYmxvY2sgb2YgemVy bw0KPiAgICBieXRlcyB0aGF0IHByZXZpb3VzbHkgY29udGFpbmVkIHRoZSBSUEFUSC9SVU5Q QVRIIChiZWZvcmUgaXQgd2FzDQo+ICAgIG92ZXJ3cml0dGVuKSB3aWxsIGhhdmUgYSBkaWZm ZXJlbnQgbGVuZ3RoDQoNCkkndmUgd3JpdHRlbiBhIGRldGVjdGlvbiBmb3IgdGhpcyBidWls ZC1JRCBtaXNtYXRjaCBpbiBkaWZmb3Njb3BlIHNvbWUgDQp0aW1lIGFnby4gWzFdDQoNCkl0 IGRvZXMgbm90IHJlcXVpcmUgdHdvIGJ1aWxkcyB0byBkZXRlY3QgYSBtaXNtYXRjaGVkIE5U X0dOVV9CVUlMRF9JRCwgDQpzbyBwZXJoYXBzIGl0IG1ha2Ugc2Vuc2UgdG8gbWlncmF0ZSB0 aGlzIGNvZGUgdG8gbGludGlhbiAoaW4gYWRkaXRpb24gdG8gDQp0aGUgYWxyZWFkeSBtZW50 aW9uZWQgJ2N1c3RvbS1saWJyYXJ5LXNlYXJjaC1wYXRoJy4gWzJdDQoNCldpdGgga2luZCBy ZWdhcmRzLA0KUm9sYW5kIENsb2J1cw0KDQpbMV0gDQpodHRwczovL3NvdXJjZXMuZGViaWFu Lm9yZy9zcmMvZGlmZm9zY29wZS8yMDIvZGlmZm9zY29wZS9jb21wYXJhdG9ycy9lbGYucHkv P2hsPTY0NiNMNjQ2DQpbMl0gaHR0cHM6Ly9saW50aWFuLmRlYmlhbi5vcmcvdGFncy9jdXN0 b20tbGlicmFyeS1zZWFyY2gtcGF0aA0K

--------------003H7Rp2LVFQcg0MpERzz9O8--

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUFVLM5Bdj7GSJEb+YsV8aqYUlb0FAmH9Dk0ACgkQYsV8aqYU lb0mXw//XkdEhFRS4snzFtPZfnpUftDd8DvjYpFXeh0XMJWEjDzLlpNaOczqxEKt Rfwu7+r2k9zSZ91pc7ziXWZ+0MExEH2sBPx9P4BNH4tpU9dr+4PtrWx22C4EOZ85 s4JVkOkcKZ0+GTuth+wuMaRb51E7nRMJB+R8N7tx3yDtiKbapLAOylGlTMgu0jzf sM0dMuEiQXTkS1KuBqh/keg58v36Fzg26kOJmYNUz4PoLxPpsPO0/lwOJN2Ji5HB 49JDUU+nizCH5JQjEuJJuCJsLQQ8YdPV0bMaCx4WXBaMJn6apntNXXyidjo+nikE QegzTfidhuddHiMQKQxiqhmOgOZ9d1HYg4CGSaxGTb7ukAn7hLHDxy0tDS5qhwVT ICRBByWvISeGEWQalrnbcgVfqPIiwIDno+wxbcxTjaDnhALRA1BT2+J7cBX2wMJs bQ9HRcI4PWxdm8g3zFj6g4nsQsl72zxiqqSnEwoOBtHUWpnpRG+giIIIjTFnlVC8 196VCMN1aLmVoHohJz6O18n+d7x4ToWZ6F8dayXqpxKJaonfta5TYurmsEauEWeN 24fKQ5g8FgcECRLIYDhERBq1R2DAUFvRfegzMVp24UYYhfRS9DzPXFPPaLYvMLUH oe6KdQ6i7AizCTDacOqS5z0biQEx0aBjC4iFp0aLYfPNlzTl88A=
=Y7wc
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Thu, 03 Feb 2022 16:41:21 -0800,
Vagrant Cascadian<[email protected]> wrote:

I've attached a list of the maintainers of affected packages produced
with dd-list, getting the list of packages from the above-mentioned >reproducible builds issue and diff.dcsr.txt from archive rebuild.

If you're on the list, would love if you could check if your package
still builds correctly when passing only
-DCMAKE_BUILD_RPATH_USE_ORIGIN=ON. For a few of the packages, there
are already patches in the Debian bug tracking system waiting for you!

allegro5 builds fine here when adding -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON.

-- Andreas Rönnquist
[email protected]
[email protected]

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE2zBuSxD/2Y7021XXGUtjGrLaKIgFAmH9IwIACgkQGUtjGrLa KIgqTw/+IFdFQoCuXRaq3COibOgX6eGC/VSf5FVhn3i5OpDlJA1r6hsLmzrVFRCH K29eiYA7SAkQWEhXmNnSRkGltucvbaNmdKsDTOUvFz/pCi2VeuHW1evz2CHXbv6a 4GKFF/g7T4hsZz+BZkLxMy7LVxWQst6m4I5rKNUE1mYlPUfsMj9CtDzmL8sIsASY eC4+T04qC2DaEWNtUqKhNUu0jLrxUJGsLjM3kLgeKr+0sK+0c5f+O8R+bDGDMcT1 8pxx0/wmCS6Mo6W+6m8DSCEiTrqdlGfjkSv2CTEN2uA4Dq04cX4tGPCLhdnCGbgc PJKvyH4cDvM29/GjF2B/Bh54aNt2CPkD/hvEgKLF7buyT/Ud3/bQcVsWZzSDxS7l XXSBRpTsxOdHnuCdso5xFAox3YIYh0fxpD1Sr5nj7OWvMonrPLaNIqkY6KutfQcj QhIlAMCW658KDwvjadmsBAGdKh79ohNqOvgCKLQfWWIi+83AkyeCun9Z7Ps1nGog V530ICrsQNJNqRGinmCbXLSjr1z3jRJZIABDyMRYndHff+10iS4kmvrSpsTiEZG5 ujc91WzObP8movknHfQTfe/RueXmNWGevJik0MG+6ZZmnklQQPKi5xj4BXGJGU0k y7vgW0Dn9ourcsVJleSRk4vyVAT/ct/NjtBpSvxygFOb1oPXtsg=
=USKZ
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi,

Le 04/02/2022 à 08:58, Andreas Ronnquist a écrit :

On Thu, 03 Feb 2022 16:41:21 -0800,
Vagrant Cascadian<[email protected]> wrote:

If you're on the list, would love if you could check if your package
still builds correctly when passing only
-DCMAKE_BUILD_RPATH_USE_ORIGIN=ON. For a few of the packages, there
are already patches in the Debian bug tracking system waiting for you!

allegro5 builds fine here when adding -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON.

Ditto for cmocka.

Is there a better place than this debian-devel thread to document what
works or not?

Regards

David

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2022-02-04, Paul Wise wrote:

Vagrant Cascadian wrote:

Over the last several months, I and others have found quite a few
packages that embed build paths via rpath when building with cmake.

This seems like the sort of thing that will be an ongoing problem, so
if it is detectable statically then a lintian warning might be good.

So far I have only figured out how to detect it by building packages and checking if they're reproducible, but if someone can figure out how to
make it work from lintian, so much the better!

I believe there is a lintian check for build paths embedded in binaries,
at least, which will catch this and other issues, but maybe it could be extended to check for this more explicitly...


live well,
vagrant

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYf1jmQAKCRDcUY/If5cW qiFqAPwJd31SdbdOJtc+tCcEI08dCcbCiC+Aw+mM50sMMUus4QEA6HRH6LmIVv+f snmach8quy0V58jaENxslE9dbiw5YA4=
=ib3f
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2022-02-04, Seth Arnold wrote:

On Thu, Feb 03, 2022 at 04:41:21PM -0800, Vagrant Cascadian wrote:

Over the last several months, I and others have found quite a few
packages that embed build paths via rpath when building with cmake. I
found myself slowly edging into a mass bug filing, one bug report at a
time...

Hello Vagrant, does this represent a security problem?

Other than reproducible builds in general providing some security
properties, I would say not really.

I tried to give this a look myself but didn't know what to look for; I grabbed a few recent versions of packages:

http://ftp.debian.org/debian/pool/main/n/nfs-ganesha/nfs-ganesha_3.4-1_amd64.deb

One thing is checking the reproducible builds results:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/nfs-ganesha.html

Which appear to have reproducibility issues in the unstable tests, where
build paths are varied, but not in bookworm, where build paths are not
varied.

Unfortunately, the diffoscope output linked above does not obviously
show the build path embedded in the binaries (other than some .py files,
which may be a separate issue).

There are a few lines which are non-obvious, but are in my experience a
sign of different build paths:

0x000000000000000a·(STRSZ)··············2327·(bytes)
vs.
0x000000000000000a·(STRSZ)··············2329·(bytes)

My going theory is that the length of the build path is embedded in a
padded value, even though the build path itself is actually stripped,
perhaps via -ffile-prefix-map=BUILDPATH=. or similar.

http://ftp.debian.org/debian/pool/main/v/vmemcache/libvmemcache0_0.8.1-4_amd64.deb
http://ftp.debian.org/debian/pool/main/f/fontforge/fontforge_20201107~dfsg-4_amd64.deb

$ find . -type f -exec eu-readelf -d {} \; 2>/dev/null | grep RUNPATH
RUNPATH Library runpath: [/usr/lib/ganesha]
RUNPATH Library runpath: [/usr/lib/ganesha]
RUNPATH Library runpath: [/usr/lib/ganesha]
RUNPATH Library runpath: [/usr/lib/ganesha]

Am I on the wrong track?

Because it doesn't often leave obvious traces of the build path in the binaries, it is a bit tricky to test simply by examining the binaries directly... Instead, experimentation seems to be the best way.

I use reprotest for this, first running a build with reprotest without
the patch, confirming that it builds at all, and does not build
reproducibly. Then running reprotest with the patch applied to add -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON in debian/rules, and seeing if it
builds reproducibly.

From the source directory, with the build dependencies installed:

reprotest --verbose --store-dir=$(mktemp -d $HOME/buildresults-XXXXXX) --vary=-all,+build_path -- null


This should normalize the build as much as possible so that the only
thing different between the two builds is the build path.

Then compare the resulting buildresults-*/*.out to see if the second
build produces significantly less diffoscope output...


live well,
vagrant

--=-=-Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYf1qTQAKCRDcUY/If5cW qsWDAQCahpr4bOHFmLfNcUxoUKnrKFXxJ/HPYZpi6abpjUgWsgEAhP/o29E83MO2 EwvtjVhtowXVI1qqVTaoZn/HwlGtWwE=Pr4/
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Fri, Feb 04, 2022 at 10:49:43AM +0000, Simon McVittie wrote:

CMake removes the RUNPATH
just before installation, so it doesn't become a security problem,
but that's too late to stop it from affecting the build-ID - and the
*length* of the build directory can also affect the contents of the
binary, because when RUNPATHs are removed, it is done by overwriting
them with zeroes in-place, leaving a run of zeroes with the same length
as the removed RUNPATH.

Aha! This was the piece I was missing. I hadn't figured out that cmake
was resetting the RUNPATHs along the way, which explains why I didn't
spot any /nonexistant/whatever/... strings in any of my checks.

Excellent explanation as usual.

Thanks

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEQVAQ8bojyMcg37H18yFyWZ2NLpcFAmH92QwACgkQ8yFyWZ2N LpeD1wf+P8B6w8ad+RgS6pEA7L1+7BODzRR5ZkkL79bHcNfFjQEnf3ApwlWIwXiL +KrzgY6ECitQGUmoC6fZRrJq8Pl5X0OGl788mmx/iRTZp7YJRASq3YQPDKQ0saCa x8EnUC10avHBtF6dn169KjyLJ/unykEs/bxUJ0rDnt2pglBRCCZ7j4HPJ2d47nGx Vre2ok3hN1UkfVDeq2ucySVXbxjHBDpb+RIUkXKZVcusz7rN90XcwDd5/aUd1YZq SEezoc3CqIhbywuYK/nG0AKe75HwrTM0WsCLZaM0BsunWdWVPj1HxSAs/rD2Xo7P Qa2Y/VGK9OML4ZZpLLkcRWub/ZFaag==
=Xc4B
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2022-02-04, Simon McVittie wrote:

On Fri, 04 Feb 2022 at 13:07:53 +0800, Paul Wise wrote:

Vagrant Cascadian wrote:

Over the last several months, I and others have found quite a few
packages that embed build paths via rpath when building with cmake.

This seems like the sort of thing that will be an ongoing problem, so
if it is detectable statically then a lintian warning might be good.

For packages that (intentionally or unintentionally) still have a RPATH
or RUNPATH in their installed files, https://lintian.debian.org/tags/custom-library-search-path detects it.
You'll see that many of them are overridden as being necessary and intentional.

I was hoping to find a few of the cmake packages on there
(e.g. /build/PACKAGE-*/PACKAGE-VERSION), but it appears the only ones on
that list do not use cmake to build...

For packages where the RPATH or RUNPATH is temporarily set during build
(to be able to run unit tests without setting LD_LIBRARY_PATH) but then removed before installation with `chrpath -d` or equivalent code in CMake,
I don't think this is going to be detectable statically, because the
only traces left in the final binary are:

- the build-ID will be different, because the RPATH/RUNPATH was part of
the data that gets hashed to create the build-ID
- if the length of the build directory changes, then the block of zero
bytes that previously contained the RPATH/RUNPATH (before it was
overwritten) will have a different length

But clearly some of the above is happening...

This is the sort of thing that can probably only be detected by literally doing two builds (in different directories) and comparing them with diffoscope

Yeah, that's pretty much the conclusion I came to.

or possibly by screen-scraping build logs like blhc does.

That could be an interesting approach, though relies on fairly verbose
build logs.


Thanks!


live well,
vagrant

p.s. please CC me and/or [email protected],
I'm not subscribed to debian-devel.

--=-=-Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYf8eVQAKCRDcUY/If5cW quzpAP9GNEk1WIYfF9w2mf/k+Gjj8GeZ/iwyuVDDQqYtKGhWEwEAlM0Ix3XKhu4/ +8bVKAqSIcebbjTYynzI91XnL2bInA4=gKVv
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2022-02-04, David Prévot wrote:

Le 04/02/2022 à 08:58, Andreas Ronnquist a écrit :

On Thu, 03 Feb 2022 16:41:21 -0800,
Vagrant Cascadian<[email protected]> wrote:

If you're on the list, would love if you could check if your package
still builds correctly when passing only
-DCMAKE_BUILD_RPATH_USE_ORIGIN=ON. For a few of the packages, there
are already patches in the Debian bug tracking system waiting for you!

allegro5 builds fine here when adding -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON.

Ditto for cmocka.

Thanks for testing!

Is there a better place than this debian-devel thread to document what
works or not?

The developer's reference suggests mailing debian-devel with a list of
affected packages/maintainers instead of mass filing bugs, so that's
what I did (well, after filing lots of bugs/patches already)... :)

If we want to track the issues, to me it seems like the best way to
track these issues are bugs with usertags...

So I guess I'm a bit confused as to the goal of not mass filing
bugs!

Maybe the goal is to have as many maintainers address the issue before
getting bugs.debian.org involved, and only once some time passes,
proceed to filing actual bugs?


Another option is to add a comment to the package in:

https://salsa.debian.org/reproducible-builds/reproducible-notes

I'll do this for the two mentioned so far.


live well,
vagrant

p.s. Please Cc me and/or [email protected] on
this thread, as I'm not subscribed to debian-devel.

--=-=-Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYf8XYgAKCRDcUY/If5cW qhfvAP4gggVfAZMrW672DYtb+qyCH+MAMRJQBEX7P6ZjeAhkegD/XwxVyAVDB97l YGzv03rLverT+OsfgHfRqehC/+JVaA0�qx
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

I don't know really where to add this bit of information in the discussion,
so I am taking the latest leaf.
The rpath trend, with or without cmake, is likely to continue as it is being reborn by spack, nix and guix. The points made by smcv about arbitrary
code execution and reproducibility are interesting: could these be added
to the "rpath issue" wiki entry? The arguments currently in there hold in
my opinion little value.
I am reaching out on spack's slack to try and discuss the former arguments.

BR, Maxime

[1] https://wiki.debian.org/RpathIssue

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On 2022-02-03, Vagrant Cascadian wrote:

Over the last several months, I and others have found quite a few
packages that embed build paths via rpath when building with cmake. I
found myself slowly edging into a mass bug filing, one bug report at a time...

I ended up submitting a few patches and noting some affected packages:

https://tests.reproducible-builds.org/debian/issues/unstable/cmake_rpath_contains_build_path_issue.html

There are almost certainly packages missing from that list, as it is generated by human confirmation...

So in the last couple months I kept finding more packages affected by
this; the above URL now has confirmed 380+ packages affected by this
issue, a few of which are are now fixed, thanks!

On those I've tested and confirmed, I've either submitted a patch and/or mentioned in comments for the package in the reproducible builds notes,
which you can see by clicking on the referenced package in the above
URL, or searching for the relevent package in:

https://salsa.debian.org/reproducible-builds/reproducible-notes/-/blob/master/packages.yml


I don't know for sure that this is a comprehensive list of affected
packages; I've mostly identified packages that fail to build with build
path variations and had otherwise no known cause, or used other
identified issues that apparently had a direct correlation to this
issue.

Doing a systematic search for all packages that use cmake to build and
fail to build reproducibly in unstable or experimental would probably be
the next step to identify any remaining packages...

In many cases I've tested so far, passing an argument via a
dh_auto_configure override in debian/rules fixes the issue:

override_dh_auto_configure:
dh_auto_configure -- -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON

Alternately, the experimental debhelper compat level v14 does include a
fix for these embedded rpaths, though in the current state, passing both -DCMAKE_SKIP_RPATH=ON and -DCMAKE_RPATH_USE_ORIGIN=ON, it triggers build failures 263 packages, according to a test run by Lucas Nussbaum in
October:

http://qa-logs.debian.net/2021/10/25/diff.dcsr.txt

Since debhelper v14 is not finalized yet, I just sent a request to
debhelper to only pass one of the arguments,
-DCMAKE_RPATH_USE_ORIGIN=ON, which should significantly reduce the
number of build failures while still making many packages reproducible
with debhelper compat v14:

https://bugs.debian.org/1004939

Haven't gotten any comment on this from the debhelper maintainers yet...

There are a few where -DCMAKE_RPATH_USE_ORIGIN=ON does trigger test
failures or otherwise causes build failures (some had test suite
failures without changes), but my off the cuff guess is ~2% of the ~380
noted packges; less than I could count on both hands using very simple
methods. This should be significantly less that -DCMAKE_SKIP_RPATH=ON...


It seems like it is not possible to actually create something like a
lintian warning for this, as the actual build path is stripped out
before creating the .deb package; the only result is for the most part a different build id and a few small changes in the binaries. Would, of
course, be happy to be proven wrong!


I've added a new list of affected maintainers produced with dd-list with
the packages marked with the "cmake_rpath_contains_build_path" issue
that haven't yet been fixed in some way according to tests.reproducible-builds.org.


Thanks everyone!


live well,
vagrant


--=-=-Content-Type: text/plain; charset=utf-8
Content-Disposition: inline; filename�-list-cmake-rpath.txt Content-Transfer-Encoding: quoted-printable

"Adam C. Powell, IV" <[email protected]>
oce (U)

A. Maitland Bottoms <[email protected]>
airspyone-host
codec2
gr-fosphor
gr-funcube (U)
gr-hpsdr (U)
gr-iqbal
gr-osmosdr
gr-radar
gr-rds
hackrf
libfreesrp
rtl-sdr
volk

Adam Borowski <[email protected]>
pmdk-convert
pmemkv

Adrian Knoth <[email protected]>
libdrumstick (U)

Alastair McKinstry <[email protected]>
ecflow
mathgl (U)

Alberto Garcia <[email protected]>
cog

Alberto Luaces Fernández <[email protected]>
openscenegraph

Alessio Treglia <[email protected]>
fluidsynth (U)
libdrumstick (U)

Alf Gaida <[email protected]>
libqtxdg (U)
lxqt-config (U)
lxqt-globalkeys (U)
nomacs (U)
screengrab (U)

Andrea Capriotti <[email protected]>
userbindmount (U)
vdeplug4 (U)

Andreas Bombe <[email protected]>
soapyosmo (U)
soapysdr (U)

Andreas Cord-Landwehr <[email protected]>
kdevelop-python (U)

Andreas Metzler <[email protected]>
hugin (U)
libpano13 (U)

Andreas Rönnquist <[email protected]>
allegro5 (U)

Andreas Tille <[email protected]>
bamtools (U)
civetweb (U)
libminc (U)
openmm (U)
prime-phylo (U)
spoa (U)

Andrew Lee (李健秋) <[email protected]>
libqtxdg (U)
lxqt-config (U)
lxqt-globalkeys (U)
nomacs (U)
screengrab (U)

Andrey Rahmatullin <[email protected]>
librsync

Andrius Merkys <[email protected]>
libemf2svg (U)
macromoleculebuilder (U)
openmm (U)

Antoine Beaupré <[email protected]>
slop

Anton Gladky <[email protected]>
libopenshot (U)
liggghts (U)
metis (U)
tetgen (U)

Antonio Ospite <[email protected]>
libam7xxx

Apollon Oikonomopoulos <[email protected]>
leatherman (U)

APT Development Team <[email protected]>
apt

Arne Bernin <[email protected]>
libfreenect (U)

Arne Morten Kvarving <[email protected]>
opm-simulators (U)

Arnout Engelen <[email protected]>
libdrumstick (U)

Aron Xu <[email protected]>
fcitx-qt5 (U)
opencc (U)

Asias He <[email protected]>
opencc (U)

Aurelien Jarno <[email protected]>
libftdi
libftdi1

Aurélien COUDERC <[email protected]>
analitza (U)
ark (U)
artikulate (U)
audiocd-kio (U)
baloo-kf5 (U)
baloo-widgets (U)
bluez-qt (U)
breeze (U)
cervisia (U)
dolphin (U)
gwenview (U)
kaccounts-integration (U)
kactivities-kf5 (U)
kauth (U)
kconfig (U)
kdebugsettings (U)
kdeclarative (U)
kdeconnect (U)
kdecoration (U)
kdegraphics-mobipocket (U)
kdeplasma-addons (U)
kdesu (U)
kdf (U)
kemoticons (U)
kfilemetadata-kf5 (U)
kget (U)
kglobalaccel (U)
kholidays (U)
khotkeys (U)
khtml (U)
kiconthemes (U)
kidletime (U)
kinfocenter (U)
kinit (U)
kio (U)
kipi-plugins (U)
kjs (U)
kjsembed (U)
kmix (U)
kolourpaint (U)
kompare (U)
konsole (U)
kpackage (U)
kpeople (U)
krdc (U)
krfb (U)
kservice (U)
ksyntax-highlighting (U)
ktexteditor (U)
ktorrent (U)
kwallet-kf5 (U)
kwave (U)
kwayland (U)
kwin (U)
kwindowsystem (U)
layer-shell-qt (U)
libkscreen (U)
libksysguard (U)
milou (U)
okteta (U)
okular (U)
plasma-discover (U)
plasma-firewall (U)
plasma-nm (U)
plasma-thunderbolt (U)
plasma-workspace (U)
powerdevil (U)
print-manager (U)
purpose (U)
solid (U)
systemsettings (U)

Ayatana Packagers <[email protected]>
qmenumodel

Barak A. Pearlmutter <[email protected]>
cppad (U)
webcamoid

Barry deFreese <[email protected]>
libclaw (U)
plee-the-bear (U)

Bas Couwenberg <[email protected]>
libkml (U)
pktools (U)
spatialindex (U)

Bastien Roucariès <[email protected]>
kbibtex (U)

Ben Burton <[email protected]>
regina-normal

Bjoern Ricks <[email protected]>
grantlee5 (U)

Boris Pek <[email protected]>
eiskaltdcpp
q4wine
qtcurve (U)

Boyuan Yang <[email protected]>
fcitx5 (U)
fcitx5-gtk (U)
fcitx5-qt (U)
ffmpegthumbnailer (U)
go-for-it
libavif (U)
libime (U)
opencc (U)
taglib (U)
tidy-html5 (U)

Bret Curtis <[email protected]>
mygui
openal-soft (U)
recastnavigation (U)
wildmidi

Bruno "Fuddl" Kleinert <[email protected]>
openal-soft (U)

Carlos Donizete Froes <[email protected]>
surgescript (U)

CESNET <[email protected]>
libyang (U)

ChangZhuo Chen (陳昌倬) <[email protected]>
libqtxdg (U)
lxqt-config (U)
lxqt-globalkeys (U)
nomacs (U)
screengrab (U)

Christoph Berg <[email protected]>
dsdcc (U)
libarcus (U)
libsavitar (U)

Connor Imes <[email protected]>
powercap

CrossWire Packaging Team <[email protected]>
sword

Daniel Glassey <[email protected]>
clucene-core (U)
sword (U)

Daniel Kahn Gillmor <[email protected]>
rnp

Daniel Schepler <[email protected]>
kpat (U)
ksirk (U)
libkdegames (U)
palapeli (U)

Daniele E. Domenichelli <[email protected]>
robot-testing-framework (U)

David Bremner <[email protected]>
ledger

David Henningsson <[email protected]>
fluidsynth (U)

David Kalnischkies <[email protected]>
apt (U)

David Lamparter <[email protected]>
libyang

Debian 3-D Printing Packages <[email protected]>
libarcus
libsavitar

Debian Astro Team <[email protected]>
aoflagger

Debian Astronomy Team <[email protected]>
openvlbi

Debian Bridges Team <[email protected]>
libcorkipset

Debian Chinese Team <[email protected]>
opencc (U)

Debian Deep Learning Team <[email protected]>
onnx

Debian Fonts Task Force <[email protected]>
woff2

Debian freedesktop.org maintainers <[email protected]>
poppler

Debian Games Team <[email protected]>
allegro5
alure
bullet
colobot
darkradiant
libclaw
libsfml
ogre-1.9
openal-soft
plee-the-bear
recastnavigation
surgescript

Debian GIS Project <[email protected]>
libcitygml
libkml
pktools
spatialindex

Debian GNOME Maintainers <[email protected]>
evolution-ews

Debian Hamradio Maintainers <[email protected]>
dsdcc
gr-funcube
gr-hpsdr
soapyosmo
soapysdr
svxlink

Debian Input Method Team <[email protected]>
fcitx-qt5
fcitx5
fcitx5-gtk
fcitx5-qt
libime
opencc

Debian KDE Extras Team <[email protected]>
basket

Debian KDE Extras Team <[email protected]>
debconf-kde
kphotoalbum
qcoro
qtcurve
skrooge
soundkonverter
telepathy-qt

Debian Krap Maintainers <[email protected]>
grantlee5
indi

Debian Math Team <[email protected]>
primecount
stopt

Debian Med Packaging Team <[email protected]>
axe-demultiplexer
bamtools
cassiopee
civetweb
dcmtk
gifticlib
ismrmrd
libgdf
libminc
libqes
prime-phylo
shasta
spoa
vtk-dicom

Debian Mobcom Maintainers <[email protected]>
freediameter
osmo-fl2k

Debian Multimedia Maintainers <[email protected]>
chromaprint
ffmpegthumbnailer
fluidsynth
inkscape
kissfft
libavif
libcoverart
libdrumstick
libemf2svg
libgav1
libmysofa
libopenshot
libwebm
nordlicht
swami
taglib
x265

Debian Multimedia Maintainers <[email protected]>
glyr

Debian PhotoTools Maintainers <[email protected]>
field3d
highway
hugin
ilmbase
imath
jpeg-xl
jxrlib
libpano13
openimageio

Debian QA Group <[email protected]>
libdigidoc
libgroove
libjdns
liblastfm
obexftp
tcmu

Debian Qt/KDE Maintainers <[email protected]>
akonadi
akonadi-contacts
akonadi-import-wizard
akonadi-mime
akonadi-search
akregator
analitza
ark
artikulate
audiocd-kio
baloo-kf5
baloo-widgets
bluez-qt
breeze
calligraplan
cantor
cervisia
clazy
dolphin
gwenview
k3b
kaccounts-integration
kactivities-kf5
kauth
kcalutils
kconfig
kdb
kdebugsettings
kdeclarative
kdeconnect
kdecoration
kdegraphics-mobipocket
kdepim-addons
kdepim-runtime
kdeplasma-addons
kdesu
kdevelop-python
kdf
kemoticons
kf5-messagelib
kfilemetadata-kf5
kget
kglobalaccel
kholidays
khotkeys
khtml
kiconthemes
kidletime
kinfocenter
kinit
kio
kio-extras
kipi-plugins
kiten
kitinerary
kjs
kjsembed
kldap
kleopatra
kmailtransport
kmix
knotes
kolourpaint
kompare
konsole
kontact
korganizer
kpackage
kpat
kpeople
krdc
krfb
krita
kseexpr
kservice
ksirk
ksyntax-highlighting
ktexteditor
ktorrent
ktp-accounts-kcm
ktp-text-ui
kwallet-kf5
kwave
kwayland
kwin
kwindowsystem
layer-shell-qt
libkcddb
libkdegames
libkf5incidenceeditor
libkf5ksieve
libkf5mailimporter
libkgapi
libkscreen
libksysguard
md4c
milou
okular
palapeli
phonon
pim-data-exporter
pim-sieve-editor
plasma-discover
plasma-firewall
plasma-nm
plasma-thunderbolt
plasma-workspace
polkit-qt-1
powerdevil
print-manager
purpose
qca2
qt6-3d
qt6-charts
qt6-datavis3d
qt6-lottie
qt6-quicktimeline
qt6-scxml
qt6-sensors
qt6-serialbus
qt6-shadertools
qt6-svg
qt6-webview
qtwebkit-opensource-src
rocs
solid
systemsettings

Debian Robotics Team <[email protected]>
iceoryx

Debian Science Maintainers <[email protected]>
asl
clfft
fasttext
glbinding
graywolf
hepmc3
ignition-transport
ignition-transport8
kbibtex
liggghts
mathgl
metis
ncrystal
oce
opencascade
opm-simulators
plfit
robot-testing-framework
ros-collada-urdf
ros-geometry
ros-nodelet-core
ros-robot-state-publisher
ros-rosconsole
ros-rospack
segyio
sentencepiece
urdfdom
xeus-python

Debian Science Team <[email protected]>
cppad

Debian Science Team <[email protected]>
meshlab
nexus
tetgen

Debian SSSD Team <[email protected]>
pam-wrapper

Debian UBports Team <[email protected]>
content-hub
deviceinfo
libqtdbustest (U)
lomiri-app-launch
lomiri-thumbnailer
lomiri-url-dispatcher
qmenumodel (U)

Debian VirtualSquare Team <[email protected]>
userbindmount
vdeplug4

Debian Wine Team <[email protected]>
faudio

Debian X Strike Force <[email protected]>
vulkan-validationlayers

Debian Xilinx Package Maintainers <[email protected]>
xrt

Debian/Kubuntu KDE Extras Team <[email protected]>
libqapt

Debian/Kubuntu Qt/KDE Maintainers <[email protected]>
okteta

Debichem Team <[email protected]>
macromoleculebuilder
openmm

Denis Barbier <[email protected]>
oce (U)

Dennis Braun <[email protected]>
fluidsynth (U)
libdrumstick (U)
swami (U)

Diane Trout <[email protected]>
telepathy-qt (U)

Diane Trout <[email protected]>
kaccounts-integration (U)
kemoticons (U)
ktp-accounts-kcm (U)
ktp-text-ui (U)
phonon (U)

Dima Kogan <[email protected]>
bullet (U)

Dimitrios Eftaxiopoulos <[email protected]>
mathgl (U)

Dmitry Shachnev <[email protected]>
qtwebkit-opensource-src (U)

Dominique Belhachemi <[email protected]>
bamtools (U)

Dominique Corbex <[email protected]>
sword (U)

Dr. Tobias Quathamer <[email protected]>
libopenshot (U)

Emilio Pozuelo Monfort <[email protected]>
poppler (U)

Emmet Hikory <[email protected]>
wildmidi (U)

Erik Sjolund <[email protected]>
prime-phylo (U)

Etienne Millon <[email protected]>
glyr (U)

Fabian Wolff <[email protected]>
z3 (U)

Fathi Boudra <[email protected]>
clucene-core

Federico Ceratto <[email protected]>
dublin-traceroute

Felix Geyer <[email protected]>
qca2 (U)

Felix Lechner <[email protected]>
svxlink (U)

Floris-Andrei Stoica-Marcu <[email protected]>
libqapt (U)

Francesco Paolo Lovergine <[email protected]>
libkml (U)
pktools (U)
spatialindex (U)

Francis Murtagh <[email protected]>
armnn

Francois Mazen <[email protected]>
flightcrew

Gard Spreemann <[email protected]>
clblast

Gert Wollny <[email protected]>
dcmtk (U)
vtk-dicom (U)

Ghislain Antony Vaillant <[email protected]>
clfft (U)
field3d (U)
glbinding (U)
ismrmrd (U)

Gianfranco Costamagna <[email protected]>
lucene++ (U)

Gijs Molenaar <[email protected]>
aoflagger (U)

Gonéri Le Bouder <[email protected]>
libclaw (U)
openal-soft (U)
plee-the-bear (U)

Gordon Ball <[email protected]>
xeus-python (U)

Gregor Riepl <[email protected]>
libarcus (U)
libsavitar (U)

Gürkan Myczko <[email protected]>
meshlab (U)

Gürkan Myczko <[email protected]>
cloudcompare

Hannes Matuschek <[email protected]>
qdmr

Harlan Lieberman-Berg <[email protected]>
nanomsg

Henning Glawe <[email protected]>
libktoblzcheck (U)

HepMC developers <[email protected]>
hepmc3 (U)

Hilko Bengen <[email protected]>
broker

Iain Lane <[email protected]>
evolution-ews (U)

IOhannes m zmölnig (Debian/GNU) <[email protected]>
libmysofa (U)

James Cowgill <[email protected]>
libsfml (U)
uchardet

Jaromír Mikeš <[email protected]>
fluidsynth (U)
swami (U)

Jeremy Bicha <[email protected]>
woff2 (U)

Jeremy Bicha <[email protected]>
evolution-ews (U)

Jerome Benoit <[email protected]>
plfit (U)
primecount (U)

Jerome Kieffer <[email protected]>
clfft (U)

Joao Eriberto Mota Filho <[email protected]>
obs-advanced-scene-switcher

Jochen Sprickerhof <[email protected]>
ros-collada-urdf (U)
ros-geometry (U)
ros-nodelet-core (U)
ros-robot-state-publisher (U)
ros-rosconsole (U)
ros-rospack (U)

Johannes 'josch' Schauer <[email protected]>
ros-robot-state-publisher (U)

Johannes Schauer <[email protected]>
ros-collada-urdf (U)

John Stamp <[email protected]>
yajl

Jonas Smedegaard <[email protected]>
editorconfig-core

Jonathan Marsden <[email protected]>
sword (U)

Jose Luis Rivero <[email protected]>
ignition-transport (U)
ignition-transport8 (U)
urdfdom (U)

José Manuel Santamaría Lema <[email protected]>
libqapt (U)

Julian Andres Klode <[email protected]>
apt (U)

Julien Jorge <[email protected]>
libclaw (U)
plee-the-bear (U)

Jørgen Kvalsvik <[email protected]>
segyio (U)

Kai Wasserbäch <[email protected]>
libqapt (U)

Kamal Mostafa <[email protected]>
hershey-fonts

Kentaro Hayashi <[email protected]>
fasttext (U)
sentencepiece (U)

Kevin Albertson <[email protected]>
mongo-cxx-driver (U)

Kevin Murray <[email protected]>
axe-demultiplexer (U)
libqes (U)

Kevin Murray <[email protected]>
bamtools (U)

Koichi Akabe <[email protected]>
tercpp

Kurt Kremitzki <[email protected]>
opencascade (U)

Laszlo Boszormenyi (GCS) <[email protected]>
nng
upb

Leandro Ramos <[email protected]>
go-for-it (U)

Lennart Weller <[email protected]>
nvidia-texture-tools

Leopold Palomo-Avellaneda <[email protected]>
ros-collada-urdf (U)
ros-geometry (U)
ros-nodelet-core (U)
ros-robot-state-publisher (U)
ros-rosconsole (U)
ros-rospack (U)

Lisandro Damián Nicanor Pérez Meyer <[email protected]>
akonadi-contacts (U)
akonadi-mime (U)
kpat (U)
ksirk (U)
md4c (U)
palapeli (U)
phonon (U)
qtwebkit-opensource-src (U)

LLVM Packaging Team <[email protected]>
z3

Loic Minier <[email protected]>
poppler (U)

Lu YaNing <[email protected]>
qt6-3d (U)
qt6-charts (U)
qt6-datavis3d (U)
qt6-lottie (U)
qt6-scxml (U)
qt6-sensors (U)
qt6-serialbus (U)
qt6-svg (U)
qt6-webview (U)

Luca Boccassi <[email protected]>
stlink

Luigi Toscano <[email protected]>
basket (U)

Lukas Märdian <[email protected]>
zziplib (U)

LXQt Packaging Team <[email protected]>
libqtxdg
lxqt-config
lxqt-globalkeys
nomacs
screengrab

Manuel A. Fernandez Montecelo <[email protected]>
aqsis
ogre-1.9 (U)
openscenegraph (U)

Marcio de Souza Oliveira <[email protected]>
zulucrypt

Mark Purcell <[email protected]>
basket (U)
skrooge (U)
soundkonverter (U)

Mark Renouf <[email protected]>
libfreenect (U)

Markus Blatt <[email protected]>
opm-simulators (U)

Markus Koschany <[email protected]>
bullet (U)

Mathieu Malaterre <[email protected]>
dcmtk (U)
highway (U)
ilmbase (U)
jpeg-xl (U)
jxrlib (U)

Matt Palmer <[email protected]>
ledger (U)

Matteo F. Vescovi <[email protected]>
ilmbase (U)
imath (U)
openimageio (U)

Matthias Klumpp <[email protected]>
apper
debconf-kde (U)
plasma-discover (U)

Mattia Biondi <[email protected]>
userbindmount (U)
vdeplug4 (U)

Mattia Rizzolo <[email protected]>
flightcrew (U)
inkscape (U)
sigil

Mattias Ellert <[email protected]>
scitokens-cpp

Maximiliano Curia <[email protected]>
debconf-kde (U)
grantlee5 (U)
indi (U)
libqapt (U)
phonon (U)
polkit-qt-1 (U)
qca2 (U)

Micha Lenk <[email protected]>
libktoblzcheck

Michael Biebl <[email protected]>
evolution-ews (U)

Michael Gilbert <[email protected]>
faudio (U)

Michael Hanke <[email protected]>
gifticlib (U)
libgdf (U)

Michael Meskes <[email protected]>
akonadi-import-wizard (U)
akregator (U)
k3b (U)
knotes (U)
kontact (U)
korganizer (U)
pim-data-exporter (U)
pim-sieve-editor (U)
soundkonverter (U)

Michael R. Crusoe <[email protected]>
bamtools (U)

Michael Vogt <[email protected]>
apt (U)

Michał Zając <[email protected]>
ktp-accounts-kcm (U)
ktp-text-ui (U)
telepathy-qt (U)

Mike Gabriel <[email protected]>
content-hub (U)
deviceinfo (U)
libqtdbustest (U)
libsolv
lomiri-app-launch (U)
lomiri-thumbnailer (U)
lomiri-url-dispatcher (U)
qmenumodel (U)

Miles Lubin <[email protected]>
cppad (U)

Mo Zhou <[email protected]>
hepmc3 (U)

Mo Zhou <[email protected]>
jsonnet
onnx (U)

Modestas Vainius <[email protected]>
phonon (U)
polkit-qt-1 (U)

Mongo C++ Driver Team <[email protected]>
mongo-cxx-driver

Nathan Osman <[email protected]>
qhttpengine

Nick Black <[email protected]>
notcurses

Nicolas Bourdaud <[email protected]>
libfreenect

Nobuhiro Iwamatsu <[email protected]>
xrt (U)

Norbert Preining <[email protected]>
akonadi (U)
akonadi-contacts (U)
akonadi-import-wizard (U)
akonadi-mime (U)
akonadi-search (U)
akregator (U)
analitza (U)
ark (U)
artikulate (U)
audiocd-kio (U)
baloo-kf5 (U)
baloo-widgets (U)
bluez-qt (U)
breeze (U)
cantor (U)
cervisia (U)
dolphin (U)
gwenview (U)
k3b (U)
kaccounts-integration (U)
kactivities-kf5 (U)
kauth (U)
kcalutils (U)
kconfig (U)
kdebugsettings (U)
kdeclarative (U)
kdeconnect (U)
kdecoration (U)
kdegraphics-mobipocket (U)
kdepim-addons (U)
kdepim-runtime (U)
kdeplasma-addons (U)
kdesu (U)
kdf (U)
kemoticons (U)
kf5-messagelib (U)
kfilemetadata-kf5 (U)
kget (U)
kglobalaccel (U)
kholidays (U)
khotkeys (U)
khtml (U)
kiconthemes (U)
kidletime (U)
kinfocenter (U)
kinit (U)
kio (U)
kio-extras (U)
kipi-plugins (U)
kiten (U)
kitinerary (U)
kjs (U)
kjsembed (U)
kldap (U)
kleopatra (U)
kmailtransport (U)
kmix (U)
knotes (U)
kolourpaint (U)
kompare (U)
konsole (U)
kontact (U)
korganizer (U)
kpackage (U)
kpat (U)
kpeople (U)
kphotoalbum (U)
krdc (U)
krfb (U)
krita (U)
kservice (U)
ksirk (U)
ksyntax-highlighting (U)
ktexteditor (U)
ktp-accounts-kcm (U)
ktp-text-ui (U)
kwallet-kf5 (U)
kwave (U)
kwayland (U)
kwin (U)
kwindowsystem (U)
layer-shell-qt (U)
libkcddb (U)
libkdegames (U)
libkf5incidenceeditor (U)
libkf5ksieve (U)
libkf5mailimporter (U)
libkgapi (U)
libkscreen (U)
libksysguard (U)
milou (U)
okular (U)
palapeli (U)
pim-data-exporter (U)
pim-sieve-editor (U)
plasma-discover (U)
plasma-firewall (U)
plasma-nm (U)
plasma-thunderbolt (U)
plasma-workspace (U)
powerdevil (U)
print-manager (U)
purpose (U)
rocs (U)
solid (U)
systemsettings (U)

Ole Streicher <[email protected]>
aoflagger (U)

Olivier Sallou <[email protected]>
cassiopee (U)

Ondřej Surý <[email protected]>
brotli (U)
libyang (U)
libyang2
libzip (U)
sysrepo
tidy-html5 (U)

Osamu Aoki <[email protected]>
opencc (U)

Patrick Franz <[email protected]>
akonadi (U)
akonadi-contacts (U)
akonadi-import-wizard (U)
akonadi-mime (U)
akonadi-search (U)
akregator (U)
breeze (U)
kcalutils (U)
kdecoration (U)
kdepim-addons (U)
kdepim-runtime (U)
kdeplasma-addons (U)
kf5-messagelib (U)
khotkeys (U)
kinfocenter (U)
kitinerary (U)
kldap (U)
kleopatra (U)
kmailtransport (U)
knotes (U)
kontact (U)
korganizer (U)
kwin (U)
layer-shell-qt (U)
libkf5incidenceeditor (U)
libkf5ksieve (U)
libkf5mailimporter (U)
libkgapi (U)
libkscreen (U)
libksysguard (U)
md4c (U)
milou (U)
pim-data-exporter (U)
pim-sieve-editor (U)
plasma-discover (U)
plasma-firewall (U)
plasma-nm (U)
plasma-thunderbolt (U)
plasma-workspace (U)
powerdevil (U)
qt6-3d (U)
qt6-charts (U)
qt6-datavis3d (U)
qt6-lottie (U)
qt6-quicktimeline (U)
qt6-scxml (U)
qt6-sensors (U)
qt6-serialbus (U)
qt6-shadertools (U)
qt6-svg (U)
qt6-webview (U)
systemsettings (U)

Patrick Matthäi <[email protected]>
mlt

Paulo Henrique de Lima Santana (phls) <[email protected]>
kickpass

Peter Pentchev <[email protected]>
createrepo-c

Peter Spiess-Knafl <[email protected]>
libjson-rpc-cpp
nordlicht (U)

Pierre Gruet <[email protected]>
stopt (U)

Pino Toscano <[email protected]>
audiocd-kio (U)
calligraplan (U)
clazy (U)
ebook-tools
grantlee5 (U)
indi (U)
kbibtex (U)
kdb (U)
kdevelop-python (U)
kipi-plugins (U)
kiten (U)
krita (U)
kseexpr (U)
libkcddb (U)
plasma-firewall (U)
plasma-thunderbolt (U)
poppler (U)
rocs (U)

Punit Agrawal <[email protected]>
xrt (U)

Puppet Package Maintainers <[email protected]>
leatherman

qinxialei <[email protected]>
libgav1 (U)

Rafael Laboissière <[email protected]>
libgdf (U)
mathgl (U)

Reinhard Tartler <[email protected]>
chromaprint (U)
openal-soft (U)

Renzo Davoli <[email protected]>
userbindmount (U)
vdeplug4 (U)

Robert Edmonds <[email protected]>
avro-c

Robert McGibbon <[email protected]>
openmm (U)

Roberto C. Sanchez <[email protected]>
mongo-cxx-driver (U)

Roger A. Light <[email protected]>
mosquitto

Roger Shimizu <[email protected]>
libcorkipset (U)

Roland Mas <[email protected]>
mcpl
ncrystal (U)

Roman Ondrá�ek <[email protected]>
paho.mqtt.c

Ross Gammon <[email protected]>
libdrumstick (U)

Ruben Undheim <[email protected]>
freediameter (U)
graywolf (U)

Ruben Undheim <[email protected]>
mrtdreader

Ryan Pavlik <[email protected]>
meshlab (U)

Sandro Knauß <[email protected]>
akonadi (U)
akonadi-contacts (U)
akonadi-import-wizard (U)
akonadi-mime (U)
akonadi-search (U)
akregator (U)
kcalutils (U)
kdepim-addons (U)
kdepim-runtime (U)
kf5-messagelib (U)
kitinerary (U)
kldap (U)
kleopatra (U)
kmailtransport (U)
knotes (U)
kontact (U)
korganizer (U)
libkf5incidenceeditor (U)
libkf5ksieve (U)
libkf5mailimporter (U)
libkgapi (U)
pim-data-exporter (U)
pim-sieve-editor (U)
qcoro (U)

Scarlett Clark <[email protected]>
clazy (U)

Scarlett Moore <[email protected]>
breeze (U)
k3b (U)
kdecoration (U)
kdeplasma-addons (U)
khotkeys (U)
kinfocenter (U)
kwin (U)
libkscreen (U)
libksysguard (U)
milou (U)
plasma-discover (U)
plasma-firewall (U)
plasma-nm (U)
plasma-thunderbolt (U)
plasma-workspace (U)
powerdevil (U)
print-manager (U)
systemsettings (U)

Scott Howard <[email protected]>
mygui (U)
zziplib

Sebastian Dröge <[email protected]>
wildmidi (U)

Sebastian Ramacher <[email protected]>
chromaprint (U)
libcoverart (U)
x265 (U)

Sebastien Jodogne <[email protected]>
civetweb (U)

Sepi Gair <[email protected]>
libxtrx
libxtrxdsp
libxtrxll

Shayan Doust <[email protected]>
shasta (U)

Simon Quigley <[email protected]>
qtwebkit-opensource-src (U)

Simon Wunderlich <[email protected]>
s3d

Stefan Schörghofer <[email protected]>
libzip

Stephen Gelman <[email protected]>
opentracing-cpp

Stephen Kitt <[email protected]>
faudio (U)

Steve M. Robbins <[email protected]>
libminc (U)

Stuart Prescott <[email protected]>
nexus (U)

Sune Vuorela <[email protected]>
akonadi (U)
basket (U)
kdepim-runtime (U)

Sune Vuorela <[email protected]>
akonadi-contacts (U)
akonadi-import-wizard (U)
akonadi-mime (U)
akregator (U)
ark (U)
audiocd-kio (U)
cantor (U)
cervisia (U)
grantlee5 (U)
gwenview (U)
kdegraphics-mobipocket (U)
kget (U)
kiten (U)
knotes (U)
kolourpaint (U)
kompare (U)
konsole (U)
kontact (U)
korganizer (U)
kpat (U)
krdc (U)
krfb (U)
ksirk (U)
libkcddb (U)
libkdegames (U)
libqapt (U)
okteta (U)
palapeli (U)
pim-data-exporter (U)
pim-sieve-editor (U)
print-manager (U)

Sven Eckelmann <[email protected]>
s3d (U)

Sébastien Villemot <[email protected]>
grandorgue

Teemu Hukkanen <[email protected]>
hatari

Teemu Ikonen <[email protected]>
meshlab (U)

Teus Benschop <[email protected]>
sword (U)

The Ayatana Packagers <[email protected]>
libqtdbustest

Thomas Dreibholz <[email protected]>
rsplib

Thomas Pierson <[email protected]>
kdsoap
kup-backup

Thorsten Alteholz <[email protected]>
openvlbi (U)
osmo-fl2k (U)

Tidy HTML5 <[email protected]>
tidy-html5

Timo Aaltonen <[email protected]>
pam-wrapper (U)
vulkan-validationlayers (U)

Timo Jyrinki <[email protected]>
qtwebkit-opensource-src (U)

Timo Röhling <[email protected]>
iceoryx (U)
ros-robot-state-publisher (U)

Tobias Frost <[email protected]>
cppdb
darkradiant (U)
opencascade (U)

Tobias Hansen <[email protected]>
allegro5 (U)

Tobias Hansen <[email protected]>
alure (U)

Tomasz Buchert <[email protected]>
brotli

TSUCHIYA Masatoshi <[email protected]>
fasttext (U)

TSUCHIYA Masatoshi <[email protected]>
sentencepiece (U)

Vasudev Kamath <[email protected]>
editorconfig-core (U)

Vasyl Gello <[email protected]>
kissfft (U)
libwebm (U)

William Blough <[email protected]>
soci

Wookey <[email protected]>
armnn (U)

Xavier Warin <[email protected]>
stopt (U)

xiao sheng wen <[email protected]>
opencc (U)

Yaroslav Halchenko <[email protected]>
gifticlib (U)
libfreenect (U)
libgdf (U)

Yukiharu YABUKI <[email protected]>
lxqt-config (U)

YunQiang Su <[email protected]>
fcitx-qt5 (U)
opencc (U)

YunQiang Su <[email protected]>
libcitygml (U)


[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)