Bug 1216452 - selinux-policy: non-determinism in index.html
Summary: selinux-policy: non-determinism in index.html
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Other (show other bugs)
Version: Current
Hardware: Other All
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Cathy Hu
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-20 15:28 UTC by Bernhard Wiedemann
Modified: 2023-11-20 08:41 UTC (History)
1 user (show)

See Also:
Found By: Development
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
diff from build-compare (30.10 KB, text/plain)
2023-10-23 07:24 UTC, Bernhard Wiedemann 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Bernhard Wiedemann 2023-10-20 15:28:10 UTC 
While working on reproducible builds for openSUSE, I found that
our selinux-policy package varied in
/usr/share/selinux/devel/html/index.html
even when keeping the environment very similar.

This is probably generated during build by
cd ~/rpmbuild/BUILD/selinux-policy* && python3 -E support/sedoctool.py -d doc/html -T doc/templates -x doc/policy.xml

but that call itself seems to be deterministic,
so maybe there are other inputs that vary during a build.
Comment 1 Bernhard Wiedemann 2023-10-20 15:31:52 UTC 
index.html has order issues.
These can occur when a hash map with a random hash-seed is used to produce the output. If that is the issue, the fix would be to sort the entries during output.
Comment 2 Cathy Hu 2023-10-20 16:02:08 UTC 
thanks, will take a look next week
Comment 3 Bernhard Wiedemann 2023-10-23 07:24:27 UTC 
Created attachment 870378 [details]
diff from build-compare
Comment 4 Cathy Hu 2023-10-24 15:50:54 UTC 
Hmm okay, i found the issue, it is caused by:
> 418: %{_bindir}/sepolicy manpage -a -p %{buildroot}%{_datadir}/man/man8/ -w -r %{buildroot}

(Test with:
> /usr/bin/sepolicy manpage -a -p foo -w -r /home/abuild/rpmbuild/BUILDROOT/selinux-policy-*/
)

The issue is caused here:
https://github.com/SELinuxProject/selinux/blob/main/python/sepolicy/sepolicy/manpage.py#L159

> alphabet_manpages[i] = temp

should be 

> alphabet_manpages[i] = sorted(temp)

sepolicy is packaged in policycoreutils, not selinux-policy, I will try to bring this upstream and prepare a fix for our packages later this week
Comment 6 Cathy Hu 2023-10-27 13:42:07 UTC 
- Fix is now in factory: https://build.opensuse.org/request/show/1120220
- Patch for upstream was sent to list and got acked.
- ALP is still in review, but I think it should be okay

Closing