bazelbuild / rules_pkg

Bazel rules for creating packages of many types (zip, tar, deb, rpm, ...)
Apache License 2.0
216 stars 174 forks source link

[pkg_deb] Fix multiline fields in changes file #691

Closed Homulvas closed 1 year ago

Homulvas commented 1 year ago

Fix broken .changes file reported in https://github.com/bazelbuild/rules_pkg/issues/632 As per documentation https://www.debian.org/doc/debian-policy/ch-controlfields.html#debian-changes-files-changes Files and checksum fields always start with an empty line. Fix this by marking the fields as is_multiline=True. Also remove the trailing whitespace after a single line includes just the field key. Added a test that checks for an exact match to generated .changes file.

fixes https://github.com/bazelbuild/rules_pkg/issues/632 fixes https://github.com/bazelbuild/rules_pkg/issues/659

google-cla[bot] commented 1 year ago

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Homulvas commented 1 year ago

Since I hardcoded the checksums in the test case the tests now show that on macos the resulting deb has a different checksum and the date is off by one hour in the changes file. I think ideally this rule should produce an identical package across different environments.

aiuto commented 1 year ago

So then the question is if that is correct or not. IRRC, there were another set of bugs about the control file fields being wrong. I don't recall if they were on github or internal. Do you have pointers to the definitive specs. I'm going to be tied up for a while and won't have time to look deeply into that before end of April.

Homulvas commented 1 year ago

https://www.debian.org/doc/debian-policy/ch-controlfields.html#description describes how Description is handled differently between control and changes files. If you grep is always empty in the doc you'll find that it mentions Files, Changes, and Checksums-x these are the fields that were changed to be multiline in this PR (these fields are not part of the control file anyway).

phlax commented 1 year ago

i would suggest using dscverify to validate the package files

Homulvas commented 1 year ago

i would suggest using dscverify to validate the package files

before

$ dscverify fizzbuzz_4.5.6_all.changes --no-sig-check
fizzbuzz_4.5.6_all.changes:
dscverify: no file spec lines in fizzbuzz_4.5.6_all.changes
Validation FAILED!!
$ changestool fizzbuzz_4.5.6_all.changes verify
Checking Source packages...
Checking Binary consistency...
ERROR: 'fizzbuzz_4.5.6_all.changes' has binary 'fizzbuzz' in 'Binary:' and 'Description:' header, but no files for it found!
Checking checksums...

after

$ dscverify fizzbuzz_4.5.6_all.changes --no-sig-check
fizzbuzz_4.5.6_all.changes:
   validating fizzbuzz_4.5.6_all.deb
All files validated successfully.
$ changestool fizzbuzz_4.5.6_all.changes verify
Checking Source packages...
Checking Binary consistency...
Checking checksums...
Homulvas commented 1 year ago

@aiuto can you land this as I don't have access to that?