Bug 1216452

Summary: selinux-policy: non-determinism in index.html
Product: [openSUSE] openSUSE Tumbleweed Reporter: Bernhard Wiedemann <bwiedemann>
Component: OtherAssignee: Cathy Hu <cathy.hu>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P5 - None CC: jsegitz
Version: Current   
Target Milestone: ---   
Hardware: Other   
OS: All   
Whiteboard:
Found By: Development Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: diff from build-compare

Description Bernhard Wiedemann 2023-10-20 15:28:10 UTC 
While working on reproducible builds for openSUSE, I found that
our selinux-policy package varied in
/usr/share/selinux/devel/html/index.html
even when keeping the environment very similar.

This is probably generated during build by
cd ~/rpmbuild/BUILD/selinux-policy* && python3 -E support/sedoctool.py -d doc/html -T doc/templates -x doc/policy.xml

but that call itself seems to be deterministic,
so maybe there are other inputs that vary during a build.
Comment 1 Bernhard Wiedemann 2023-10-20 15:31:52 UTC 
index.html has order issues.
These can occur when a hash map with a random hash-seed is used to produce the output. If that is the issue, the fix would be to sort the entries during output.
Comment 2 Cathy Hu 2023-10-20 16:02:08 UTC 
thanks, will take a look next week
Comment 3 Bernhard Wiedemann 2023-10-23 07:24:27 UTC 
Created attachment 870378 [details]
diff from build-compare
Comment 4 Cathy Hu 2023-10-24 15:50:54 UTC 
Hmm okay, i found the issue, it is caused by:
> 418: %{_bindir}/sepolicy manpage -a -p %{buildroot}%{_datadir}/man/man8/ -w -r %{buildroot}

(Test with:
> /usr/bin/sepolicy manpage -a -p foo -w -r /home/abuild/rpmbuild/BUILDROOT/selinux-policy-*/
)

The issue is caused here:
https://github.com/SELinuxProject/selinux/blob/main/python/sepolicy/sepolicy/manpage.py#L159

> alphabet_manpages[i] = temp

should be 

> alphabet_manpages[i] = sorted(temp)

sepolicy is packaged in policycoreutils, not selinux-policy, I will try to bring this upstream and prepare a fix for our packages later this week
Comment 6 Cathy Hu 2023-10-27 13:42:07 UTC 
- Fix is now in factory: https://build.opensuse.org/request/show/1120220
- Patch for upstream was sent to list and got acked.
- ALP is still in review, but I think it should be okay

Closing