[PATCH] maintainer-makefile: Improve gnulib-version derivation.

[Simon Josefsson]

Hi

I got this error message when doing 'make release':

make release-prep RELEASE_TYPE=alpha
make[2]: Entering directory '/builds/debdistutils/packages/b'
make --no-print-directory -s announcement \
  > ~/announce-libidn-17.42.23
/bin/bash: line 2: cd: ../libidn/gnulib: No such file or directory
announce-gen: option --gnulib-version requires an argument
Try 'announce-gen --help' for more information.
make[3]: *** [../libidn/maint.mk:1560: announcement] Error 1

The cause was this gnulib-version definition in maint.mk

gnulib-version = $$(cd $(gnulib_dir)                            \
                    && { git describe 2> /dev/null || git rev-parse --short=10 
HEAD; } )

in combination with using a gnulib_dir that was not a git checkout,
which otherwise work fine because of this:

gnulib_dir ?= $(shell if test -n "$(GNULIB_SRCDIR)" && test -f 
"$(GNULIB_SRCDIR)/gnulib-tool"; then \
                        echo "$(GNULIB_SRCDIR)"; \
                else \
                        echo $(srcdir)/gnulib; \
                fi)

It isn't clear what version information to use in this situation, but
giving an error isn't that helpful either, so I made it look for a
bootstrap.conf GNULIB_REVISION value (compare bootstrap.conf perl
snippet from the 'refresh-gnulib-patches' rule which I borrowed).  If
that also fails, I suppose using the ChangeLog date is better than
failing.  New code is:

gnulib-version ?= \
  $$(if test -e $(gnulib_dir)/.git; then                                \
       git -C $(gnulib_dir) rev-parse HEAD;                             \
     elif test -f $(srcdir)/bootstrap.conf; then                        \
       perl -lne '/^\s*GNULIB_REVISION=(\S+)/ and $$d=$$1;'             \
         -e 'END{defined $$d and print $$d}' $(srcdir)/bootstrap.conf;  \
     else                                                               \
       head -1 $(gnulib_dir)/ChangeLog | sed -e 's/ .*//;q ';           \
     fi)

This also change from using 'git describe || git rev-parse --short=10'
to using 'git rev-parse', which results in announcement to look like
this:

        This release was bootstrapped with the following tools:
          Gnulib 552c0b06355a6720c8ce87ce305f42ed15a32d20

instead of

        This release was bootstrapped with the following tools:
          Gnulib v1.0-1286-g552c0b0635

and while I would agree that the full SHA1 isn't the prettiest, I
believe the second line has some problems:

  1) gnulib doesn't do releases so the v1.0 identifier looks strange,

  2) as far as I can tell, the full SHA1 is the most correct form of
     identifier we have for a particular gnulib "version",

  3) the identifier isn't easy to use for users to find the particular
     gnulib git commit that was used to prepare the release, but using
     the full SHA1 identifier is a common pattern, just go to
     
https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=552c0b06355a6720c8ce87ce305f42ed15a32d20
     replacing the commit with whatever you see in the announcement, and

  4) using abbreviated short identifiers makes it possible for someone
     to create a malicious git commit that matches the hash prefix, and
     then it would be unclear which commit the announcement really
     referred to.  Not directly comparable, but illustrative on the
     problems with truncating hashes is the recent OpenWRT incident
     https://openwrt.org/advisory/2024-12-06 and there are now tools to
     generate arbitrary short git commit identifers:
     https://github.com/not-an-aardvark/lucky-commit

so to me this is an improvement, but I'm happy to rework this if there
are other preferences.

/Simon

From 552c0b06355a6720c8ce87ce305f42ed15a32d20 Mon Sep 17 00:00:00 2001
From: Simon Josefsson <simon@josefsson.org>
Date: Sat, 28 Dec 2024 19:46:30 +0100
Subject: [PATCH] maintainer-makefile: Improve gnulib-version derivation.

* top/maint.mk (gnulib-version): Use git only when possible,
falling back to GNULIB_REVISION or ChangeLog date otherwise.  Use
consistent full identifier.
---
 ChangeLog    |  7 +++++++
 top/maint.mk | 11 +++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 2eed147ec8..0de411cb2f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2024-12-28  Simon Josefsson  <simon@josefsson.org>
+
+       maintainer-makefile: Improve gnulib-version derivation.
+       * top/maint.mk (gnulib-version): Use git only when possible,
+       falling back to GNULIB_REVISION or ChangeLog date otherwise.  Use
+       consistent full identifier.
+
 2024-12-28  Simon Josefsson  <simon@josefsson.org>
 
        announce-gen: Support VPATH builds better.
diff --git a/top/maint.mk b/top/maint.mk
index b2baa02edf..0115d30f10 100644
--- a/top/maint.mk
+++ b/top/maint.mk
@@ -1515,8 +1515,15 @@ vc-diff-check:
 
 rel-files = $(DIST_ARCHIVES)
 
-gnulib-version = $$(cd $(gnulib_dir)                           \
-                    && { git describe 2> /dev/null || git rev-parse --short=10 
HEAD; } )
+gnulib-version ?= \
+  $$(if test -e $(gnulib_dir)/.git; then                               \
+       git -C $(gnulib_dir) rev-parse HEAD;                            \
+     elif test -f $(srcdir)/bootstrap.conf; then                       \
+       perl -lne '/^\s*GNULIB_REVISION=(\S+)/ and $$d=$$1;'            \
+         -e 'END{defined $$d and print $$d}' $(srcdir)/bootstrap.conf; \
+     else                                                              \
+       head -1 $(gnulib_dir)/ChangeLog | sed -e 's/ .*//;q ';          \
+     fi)
 bootstrap-tools ?= autoconf,automake,gnulib
 
 gpgv = $$(gpgv2 --version >/dev/null && echo gpgv2 || echo gpgv)
-- 
2.47.1

signature.asc
Description: PGP signature