rpmbuild should not store UIDs

[bmwiedemann]

While working on reproducible builds for openSUSE, I found that getting bit-wise reproduction fails for packages, if these use something like %attr(0755,wwwrun,www)%{_localstatedir}/lib/%{name}/
because users are created by useradd and that selects the next available UID and rpmbuild stores it as part of cpio headers in the payload.

Here is an example extract from our ganglia-web-3.7.5-3.1.noarch.rpm

-070701000001a7000041ed0000018e000001f30000000166f7aa3600000000000000000000000000000000000000000000001b00000000./var/lib/ganglia-web/dwoo
+070701000001a7000041ed000001f3000001f30000000166f7aa3600000000000000000000000000000000000000000000001b00000000./var/lib/ganglia-web/dwoo

Here 1f3 and 18e are the embedded UIDs.

I think, rpm only uses the user-names for installing, so we could probably just store a 0 there during rpmbuild. What do you think?

[pmatilai]

This might actually be fixed already by a0553eb

Also in any case, rpm v6 format does not use cpio payload so the issue doesn't exist there at all.

[bmwiedemann]

Thanks for that pointer.
We are on rpm-4.19.1.1 that does not have that change... It will probably be some months until we get 4.20 in there until I can fully re-test.

[pmatilai]

It should be in 4.19.1 actually, just not in 4.19.0.

I suppose it's possible there are other wrinkles there still. But to be clear, I totally agree saving garbage UID's in the payload is not good for anybody or anything.

[bmwiedemann]

You are correct. And we got 4.19.1.1 in 2024-02, so everything has been built with it already. That means there is something else remaining that needs fixing...