[rpms/glib2] cve-2026-58016-f44: Produce bit-by-bit identical .pyc files across different architectures, to avoid multilib conflicts

[rpms/glib2] cve-2026-58016-f44: Produce bit-by-bit identical .pyc files across different architectures, to avoid multilib conflicts

[@ 2026-08-11 10:37 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/glib2
            Branch : cve-2026-58016-f44
            Commit : 947d874c70316632b3dfda93f464f8f8175306ef
            Author : Miro Hrončok <miro@hroncok.cz>
            Date   : 2021-10-05T22:50:09+02:00
            Stats  : +11/-4 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/glib2/c/947d874c70316632b3dfda93f464f8f8175306ef?branch=cve-2026-58016-f44

            Log:
            Produce bit-by-bit identical .pyc files across different architectures, to avoid multilib conflicts

Resolves rhbz#2008912

---
diff --git a/glib2.spec b/glib2.spec
index bb807aa..5eff3ec 100644
--- a/glib2.spec
+++ b/glib2.spec
@@ -37,6 +37,7 @@ BuildRequires: pkgconfig(mount)
 BuildRequires: pkgconfig(sysprof-capture-4)
 BuildRequires: pkgconfig(zlib)
 BuildRequires: python3-devel
+BuildRequires: /usr/bin/marshalparser
 
 # For gnutls-hmac.patch. We now dlopen libgnutls.so.30 so that we can build a
 # static glib2 without depending on a static build of GnuTLS as well. This will
@@ -116,19 +117,25 @@ rm -rf subprojects
 
 %install
 %meson_install
-# Since this is a generated .py file, set it to a known timestamp for
-# better reproducibility.
+
+# We need reproducible .pyc files across architectures to support multilib installations
+# https://bugzilla.redhat.com/show_bug.cgi?id=2008912
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/Python_Appendix/#_byte_compilation_reproducibility
+%global py_reproducible_pyc_path %{buildroot}%{_datadir}
+
+# Since this is a generated .py file, set it to a known timestamp
+# because the source timestamp is baked into the .pyc file
 # Also copy the timestamp for other .py files, because meson doesn't
 # do this, see https://github.com/mesonbuild/meson/issues/5027.
 touch -r gio/gdbus-2.0/codegen/config.py.in %{buildroot}%{_datadir}/glib-2.0/codegen/*.py
+
 chrpath --delete %{buildroot}%{_libdir}/*.so
 
 # Perform byte compilation manually to avoid issues with
 # irreproducibility of the default invalidation mode, see
 # https://www.python.org/dev/peps/pep-0552/ and
 # https://bugzilla.redhat.com/show_bug.cgi?id=1686078
-export PYTHONHASHSEED=0
-%py_byte_compile %{__python3} %{buildroot}%{_datadir}
+%py_byte_compile %{python3} %{buildroot}%{_datadir}
 
 mv %{buildroot}%{_bindir}/gio-querymodules %{buildroot}%{_bindir}/gio-querymodules-%{__isa_bits}
 sed -i -e "/^gio_querymodules=/s/gio-querymodules/gio-querymodules-%{__isa_bits}/" %{buildroot}%{_libdir}/pkgconfig/gio-2.0.pc