Bug#836940: [buildd-tools-devel] Bug#836940: cowbuilder, sbuild: should behave identically in regard to default gnupg installation

[Lucas Nussbaum]

On 08/09/16 at 11:31 +0200, Santiago Vila wrote:
> On Thu, 8 Sep 2016, Johannes Schauer wrote:
> 
> > as we are talking about testing packages in the most minimal environment
> > possible it must be noted that debootstrap --variant=minbase or
> > --variant=buildd does not only install Essential:yes or Essential:yes with
> > build-essential, respectively, (and their transitive dependencies of course)
> > but also Priority:required packages like lsb-base or tzdata which are not
> > depended upon by any Essential:yes package.
> 
> This is indeed the case in stretch and sid.
> 
> (In jessie, util-linux had a Depends on both lsb-base and tzdata).
> 
> > Thus, with the current situation, there could exist many source packages that
> > should explicitly build-depend on Priority:required packages but don't and were
> > never found so far because all build chroots created by debootstrap include
> > these packages already.
> 
> In theory, yes, there could exist many source packages with hidden
> missing build-dependencies on packages installed by default.
> 
> In practice, I don't think there are so many. In the gnupg case, for
> example, I only found 3 or 4 packages among the set of 15000 packages
> generating "Arch: all" binary packages.
> 
> But in either case I'm going to remove lsb-base and tzdata from my
> stretch chroots and see what happens. Are there more required packages
> in stretch that should be removed after using the buildd variant?
> 
> (I don't really care about minbase, as I think it is more oriented
> towards using it in debian-installer and similar scenarios to create
> actually bootable and usable systems).
> 
> > Maybe a bug against debootstrap is in order that adds a new variant allowing it
> > to create a more minimal chroot?
> 
> Yes, please, but we don't really need a new variant, we just need a
> buildd variant that honors the build-essential definition in policy
> (which does not include required packages as such, only essential and
> build essential packages).
> 
> Thanks.

Dear Release Team,

Could you please advice on what to do about the severity of those two
classes of bugs.

1) packages failing to build when gnupg is not installed in the chroot.
gnupg is priority: important, and is not installed by debootstrap
--variant=buildd.

2) packages failing to build when tzdata is not installed in the chroot.
tzdata is priority: required, and it is installed by debootstrap
--variant=buildd. But since it is not essential, not build-essential,
and not a dependency of essential or build-essential packages, it can
safely be removed (e.g. with debfoster -o MaxPriority=required).  I
count about 150 packages failing in that case.

Both classes of bugs are valid bugs. However, I'm wondering if it's OK
to consider both classes as release critical.

Thanks,

Lucas