Help with libsoup reproducibility

[Vagrant Cascadian]

On 2026-10-25, Jochen Sprickerhof wrote:
> * Jeremy Bícha <jbicha at debian.org> [2026-10-23 18:57]:
>>Could I have some help with libsoup not being reproducible with debrebuild?
>>
>>The initial bug is https://bugs.debian.org/1126440
>>
>>The issue can be reproduced on Salsa CI, on reproduce.debian.net and locally
>>https://reproduce.debian.net/excuses.html?source_name=libsoup
>>
>>There is a complex check for Apache and its configuration at
>>https://gitlab.gnome.org/GNOME/libsoup/-/blob/master/meson.build#L236
>>
>>The check fails in the debrebuild environment but passes in more
>>typical build environments.
>
> The problem is that apache2 depends on /run/apache2 being present. You 
> can get the same result with:
>
> sbuild -d unstable libsoup --starting-build-commands='rm -r /run/apache2'

So, I don't have a soluation, but figured I would share what I found...

I was able to reproduce the error message from the build log with this:

  ./get_apache_modules_dirs.py /usr/sbin/apache2
  [Mon Oct 26 21:54:09.862824 2026] [core:warn] [pid 57:tid 57] AH00111: Config variable ${APACHE_RUN_DIR} is not defined
  apache2: Syntax error on line 80 of /etc/apache2/apache2.conf: DefaultRuntimeDir must be a valid directory, absolute or relative to ServerRoot
  Something went wrong when calling /usr/sbin/apache2!

I suspect it detects that apachectl is present, but it cannot be run:

  ./get_apache_modules_dirs.py /usr/sbin/apachectl
  mkdir: cannot create directory ‘/run/apache2’: Permission denied
  Something went wrong when calling /usr/sbin/apachectl!

So meson.build follows the codepath that leads to the original error in
the build log, by first trying apachectl and then falling back to
calling apache2 directly:

  if have_apache
    apache_modules_dirs_out = run_command('get_apache_modules_dirs.py', apachectl.full_path(), check: false)
    have_apache = (apache_modules_dirs_out.returncode() == 0)
    # Same as above, using apachectl might fail, try apache directly.
    if not have_apache
      apache_modules_dirs_out = run_command('get_apache_modules_dirs.py', apache_httpd2.full_path(), check: false)
      have_apache = (apache_modules_dirs_out.returncode() == 0)
    endif

/usr/sbin/apachectl contains these calls:

  [ ! -d ${APACHE_RUN_DIR:-/run/apache2}/socks ] && mkdir_chown ${APACHE_RUN_USER:-www-data} ${APACHE_RUN_DIR:-/run/apache2}/socks
  [ ! -d ${APACHE_LOCK_DIR:-/run/lock/apache2} ] && mkdir_chown ${APACHE_RUN_USER:-www-data} ${APACHE_LOCK_DIR:-/run/lock/apache2}

Which would fail for a non-root user... so the attempt to call apachectl
is always going to fail if /run/apache2 is not already set up and
owned by www-data.

And calling apache2 (a.k.a. httpd) directly without setting up the
environment variables is also going to fail...


>>There clearly are some differences or limitations in debrebuild's
>>environment but I haven't seen a list of these posted in the usual
>>places I would expect. For instance: https://reproduce.debian.net/
>
> The list is here:
>
> https://release.debian.org/reproducible-builds-host-requirements.html
>
> And it states that builds should not rely on the content of /run.

I vaguely was aware of some quirks with /run, but nice to have that
specific list, thanks!


> There is already a similar bug for gnome-settings-daemon with more 
> discussion:
>
> https://bugs.debian.org/1150166

I do not see any more discussion there, just the initial report.


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20261026/feae482d/attachment.sig>