mbox series

[RESEND,0/8] fix runtime versions

Message ID 20250624104155.559827-1-yi.zhao@windriver.com
Headers show
Series fix runtime versions | expand

Message

Yi Zhao June 24, 2025, 10:41 a.m. UTC
This series of patches was sent in April. Ross suggested discussing this
with upstream to see if they could update the scripts to address the
issue. I talked to upstream and they declined because they believed that
"autoreconf may result in different built source code than what has been
distributed"[1].
I found that Debian maintains a similar patch in their own repo[2], as
it was also rejected upstream[3].


[1] https://lists.gnupg.org/pipermail/gnupg-devel/2025-May/035913.html
[2] https://salsa.debian.org/debian/gnupg2/-/blob/debian/unstable/debian/patches/debian-packaging/avoid-beta-warning.patch
[3] https://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029068.html

Yi Zhao (8):
  libgpg-error: drop -unknown suffix from version number
  pinentry: drop -unknown suffix from version number
  libgcrypt: drop -unknown suffix from version number
  gnupg: drop -unknown suffix from version number
  libassuan: drop -unknown suffix from version number
  libksba: drop -unknown suffix from version number
  procps: fix runtime version when using git shallow tarball
  psmisc: fix runtime version when using git shallow tarball

 meta/recipes-extended/procps/procps_4.0.5.bb  |  4 +++
 meta/recipes-extended/psmisc/psmisc_23.7.bb   |  1 +
 ...h-fix-find-version-for-beta-checking.patch | 22 ++++++++----
 ...p-unknown-suffix-from-version-number.patch | 35 +++++++++++++++++++
 .../libassuan/libassuan_3.0.2.bb              |  1 +
 ...p-unknown-suffix-from-version-number.patch | 35 +++++++++++++++++++
 .../libgcrypt/libgcrypt_1.11.1.bb             |  1 +
 ...p-unknown-suffix-from-version-number.patch | 35 +++++++++++++++++++
 .../libgpg-error/libgpg-error_1.55.bb         |  1 +
 ...p-unknown-suffix-from-version-number.patch | 35 +++++++++++++++++++
 meta/recipes-support/libksba/libksba_1.6.7.bb |  3 +-
 ...p-unknown-suffix-from-version-number.patch | 35 +++++++++++++++++++
 .../pinentry/pinentry_1.3.1.bb                |  1 +
 13 files changed, 201 insertions(+), 8 deletions(-)
 create mode 100644 meta/recipes-support/libassuan/libassuan/0001-autogen.sh-drop-unknown-suffix-from-version-number.patch
 create mode 100644 meta/recipes-support/libgcrypt/files/0001-autogen.sh-drop-unknown-suffix-from-version-number.patch
 create mode 100644 meta/recipes-support/libgpg-error/libgpg-error/0001-autogen.sh-drop-unknown-suffix-from-version-number.patch
 create mode 100644 meta/recipes-support/libksba/libksba/0001-autogen.sh-drop-unknown-suffix-from-version-number.patch
 create mode 100644 meta/recipes-support/pinentry/pinentry-1.3.1/0001-autogen.sh-drop-unknown-suffix-from-version-number.patch

Comments

Alexander Kanavin June 24, 2025, 10:50 a.m. UTC | #1
On Tue, 24 Jun 2025 at 12:42, Yi Zhao via lists.openembedded.org
<yi.zhao=eng.windriver.com@lists.openembedded.org> wrote:
> This series of patches was sent in April. Ross suggested discussing this
> with upstream to see if they could update the scripts to address the
> issue. I talked to upstream and they declined because they believed that
> "autoreconf may result in different built source code than what has been
> distributed"[1].

Is there a benefit of carrying these patches in core to the broader
community? I don't think anyone's particularly confused or misled by
'unknown' reported by executables at runtime, we have procedures to
verify that what we build is exactly what upstream has released, and
various built time reporting mechanisms to see the versions.

Wind River obviously has invested a lot of time and effort into this,
presumably because it has a paying customer that is obsessed about
what executables on target say, but I do struggle to justify carrying
and maintaining these fixes.

Alex
Richard Purdie June 24, 2025, 11:04 a.m. UTC | #2
On Tue, 2025-06-24 at 12:50 +0200, Alexander Kanavin via lists.openembedded.org wrote:
> On Tue, 24 Jun 2025 at 12:42, Yi Zhao via lists.openembedded.org
> <yi.zhao=eng.windriver.com@lists.openembedded.org> wrote:
> > This series of patches was sent in April. Ross suggested discussing this
> > with upstream to see if they could update the scripts to address the
> > issue. I talked to upstream and they declined because they believed that
> > "autoreconf may result in different built source code than what has been
> > distributed"[1].
> 
> Is there a benefit of carrying these patches in core to the broader
> community? I don't think anyone's particularly confused or misled by
> 'unknown' reported by executables at runtime, we have procedures to
> verify that what we build is exactly what upstream has released, and
> various built time reporting mechanisms to see the versions.
> 
> Wind River obviously has invested a lot of time and effort into this,
> presumably because it has a paying customer that is obsessed about
> what executables on target say, but I do struggle to justify carrying
> and maintaining these fixes.

I guess it raises the question of patch vs sed too.

Would this be more maintainable if we just had a common sed like
function to take these out of autogen.sh? If it breaks, it isn't the
end of the world...

There is the advantage that it is relatively standardised.

Cheers,

Richard
Yi Zhao June 25, 2025, 7:38 a.m. UTC | #3
On 6/24/25 18:50, Alexander Kanavin wrote:
> On Tue, 24 Jun 2025 at 12:42, Yi Zhao via lists.openembedded.org
> <yi.zhao=eng.windriver.com@lists.openembedded.org> wrote:
>> This series of patches was sent in April. Ross suggested discussing this
>> with upstream to see if they could update the scripts to address the
>> issue. I talked to upstream and they declined because they believed that
>> "autoreconf may result in different built source code than what has been
>> distributed"[1].
> Is there a benefit of carrying these patches in core to the broader
> community? I don't think anyone's particularly confused or misled by
> 'unknown' reported by executables at runtime, we have procedures to
> verify that what we build is exactly what upstream has released, and
> various built time reporting mechanisms to see the versions.
>
> Wind River obviously has invested a lot of time and effort into this,
> presumably because it has a paying customer that is obsessed about
> what executables on target say, but I do struggle to justify carrying
> and maintaining these fixes.


This is exposed by version check using check-version-mismatch.bbclass.
In some cases, a mismatch between the runtime version and the build-time 
version can cause confusion for users.
On the other hand, this suffix does not exist in other distributions.
I will follow Richard's suggestion. Use a more standardized approach.


Thanks,

Yi


>
> Alex