Package: gcc-15 Version: 15.2.0-16 Severity: normal Tags: reproducible
GCC 15.2.0-16 produces non-deterministic DWARF debug information when building the same source twice with identical flags, parallelism, and build environment on amd64. The generated machine code is byte-for-byte identical across builds, but .debug_info and .debug_loclists differ in size and content. All other debug sections (.debug_abbrev, .debug_line, .debug_str, .debug_line_str, .debug_aranges, .debug_rnglists) are identical. Because the build-id is computed over the unstripped binary, the differing debug sections cause the build-id to change, which then propagates into the stripped binary via .gnu_debuglink. The end result is that the final .deb is not reproducible even though the actual executable code has not changed. I confirmed this is not caused by dwz by repeating the test with dh_dwz disabled. The result is the same. I was unable to reproduce this with a small standalone test case; it may require a large codebase to trigger. If this turns out to be a linker issue, please reassign to binutils. I noticed this while investigating reproducibility failures for the quickshell package (src:quickshell, 0.2.1-1). The Salsa CI debrebuild job passed with gcc-15 15.2.0-14 and began failing after the update to 15.2.0-16. Both builds in my local test used sbuild with ninja -j2, the same build path, the same SOURCE_DATE_EPOCH, and the same package versions. In a local two-build comparison (dwz disabled), the debug section sizes were: .debug_info: 0x34eaf8c vs 0x34eb0aa (+286 bytes) .debug_loclists: 0x30c72c vs 0x30c729 (-3 bytes) The stripped binary differed in only 61 bytes, all within .note.gnu.build-id and .gnu_debuglink. The reproducible-builds.org results for this package can be seen at: https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/quickshell.htmlhttps://tests.reproducible-builds.org/debian/rb-pkg/forky/amd64/quickshell.html
OpenPGP_signature.asc
Description: OpenPGP digital signature
