toolchain/57466: Reproducible builds probably not as reproducible as we thought

[jbglaw%lug-owl.de@localhost]

>Number:         57466
>Category:       toolchain
>Synopsis:       Reproducible builds probably not as reproducible as we thought
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    toolchain-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 12 22:30:00 +0000 2023
>Originator:     Jan-Benedict Glaw
>Release:        current
>Organization:
>Environment:
Linux lili 5.16.0-4-amd64 #1 SMP PREEMPT Debian 5.16.12-1 (2022-03-08) x86_64 GNU/Linux
>Description:
I'm doing CI builds and right now in an attempt to make VAX builds reproducible. Usually, I'm cross-compiling from Linux.

While doing so, I noticed that two builds from different source directories won't produce the same result. While working myself through the individual issues (in tight contact with Christos), my impression is that you can only get reproducible builds right now when the sources are in the same directory. This is due to -fdebug-prefix-map (will only remap DWARF infos, but not __FILE__ names) being used instead of -ffile-prefix-map.
>How-To-Repeat:
Cross-build from different directories.

Unfortunately, the script to check reproducible builds (https://salsa.debian.org/qa/jenkins.debian.net/-/blob/master/bin/reproducible_netbsd.sh) seems to start all builds from the same directory, so it won't catch these issue.
>Fix:
This patch (WIP --- do not apply yet!) solves most of the issue:

diff --git a/share/mk/bsd.sys.mk b/share/mk/bsd.sys.mk
index bc20ff87b096..0803f83ca0a9 100644
--- a/share/mk/bsd.sys.mk
+++ b/share/mk/bsd.sys.mk
@@ -20,22 +20,22 @@ error2:
 
 .if !empty(DESTDIR)
 CPPFLAGS+=     -Wp,-iremap,${DESTDIR}:
-REPROFLAGS+=   -fdebug-prefix-map=\$$DESTDIR=
+REPROFLAGS+=   -ffile-prefix-map=\$$DESTDIR=
 .endif
 
 CPPFLAGS+=     -Wp,-fno-canonical-system-headers
 CPPFLAGS+=     -Wp,-iremap,${NETBSDSRCDIR}:/usr/src
 CPPFLAGS+=     -Wp,-iremap,${X11SRCDIR}:/usr/xsrc
 
-REPROFLAGS+=   -fdebug-prefix-map=\$$NETBSDSRCDIR=/usr/src
-REPROFLAGS+=   -fdebug-prefix-map=\$$X11SRCDIR=/usr/xsrc
+REPROFLAGS+=   -ffile-prefix-map=\$$NETBSDSRCDIR=/usr/src
+REPROFLAGS+=   -ffile-prefix-map=\$$X11SRCDIR=/usr/xsrc
 .if defined(MAKEOBJDIRPREFIX)
 NETBSDOBJDIR=  ${MAKEOBJDIRPREFIX}${NETBSDSRCDIR}
 .endif
 
 .if defined(NETBSDOBJDIR)
 .export NETBSDOBJDIR
-REPROFLAGS+=   -fdebug-prefix-map=\$$NETBSDOBJDIR=/usr/obj
+REPROFLAGS+=   -ffile-prefix-map=\$$NETBSDOBJDIR=/usr/obj
 .endif
 
 LINTFLAGS+=    -R${NETBSDSRCDIR}=/usr/src -R${X11SRCDIR}=/usr/xsrc



Additional to that, (at least for VAX) I see unmapped DW_AT_comp_dir data when `-g` is in CFLAGS. Still have to check why it's not mapped (looking at the code in gcc.old, it should be mapped), but blocklistctl/blocklistd and netpgpverify are probably affected. (Currently building locally to test a workaround by just dropping `-g` from these programs.)