[From nobody Wed Jun 17 13:09:07 2026 Received: (at submit) by bugs.debian.org; 15 Jun 2026 17:23:10 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-117.4 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FOURLA,FROMDEVELOPER,HAS_PACKAGE,SPF_HELO_NONE,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 70; hammy, 150; neutral, 168; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <lamby@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:35270) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <lamby@debian.org>) id 1wZB1i-00Cu7D-1O for submit@bugs.debian.org; Mon, 15 Jun 2026 17:23:10 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:Subject:Message-Id:To: From:Date:MIME-Version:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=8P7mb8qfR2zep0NqNJnOQvXTrNhfcoW+2TiyJ3Q4aoY=; b=UG82IRky13varDCWmsRkuAMIdC 0LuMoz4m5XsKEN8Zd1hpnpr0I8uAFZPqKmUtjAtJX1stTdgpxsnldxjLO02KrgxyFAmGncf09canO n247aJFAu1LrAoE73XPo9Hn+lYnv4mtjnpTEPXEVRd/drwClAUfwB1jsgE2MG7eGLzcHzv+FSVUDD z/XPhV3HE3Pekriw+MHBjmmF83JnasoI6xSKs2b111QlXMr/BsvepDY9QAWg8S1Kc/5PgWnu/pcTI Kopu2aZKIsi5FeC/bv1EjsIOqtjZEVQnggDhDnkSCYF9gsnPKtkpcUBRpdxenBCvvRLfqL/RaX//O bFF2DSEA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <lamby@debian.org>) id 1wZB1g-00DEOt-2e for submit@bugs.debian.org; Mon, 15 Jun 2026 17:23:09 +0000 Received: from phl-compute-08.internal (phl-compute-08.internal [10.202.2.48]) by mailfauth.phl.internal (Postfix) with ESMTP id C91C1F40068 for <submit@bugs.debian.org>; Mon, 15 Jun 2026 13:23:05 -0400 (EDT) Received: from phl-imap-18 ([10.202.2.89]) by phl-compute-08.internal (MEProxy); Mon, 15 Jun 2026 13:23:05 -0400 X-ME-Sender: <xms:-TQwajVSAYqSqPnI3c8uMXeyw9tF60_UtRrEICfrIiC4Izazgn3iLA> <xme:-TQwamZy1owiu5-pEyCWdyC9N6QmRE_GzDAa2JBbqs05QtMPMm56q9icqYQ1zpvXp SWN2cPUdDlRiYqxIy0tO5ZkZjI_oQWAeSxxfo9zv0zdTdw6_g> X-ME-Proxy-Cause: dmFkZTE0hANbX2Vjoih0A4EJizOeYRAgfZzq2d37gOr3pA9WZxVG53s4sKga+lf+bH4Pht AaQg8Moq66FmRqa0FOakS5tLb4H5ErjPqMEwS5zN/ezfh/JDyq32ZWcOc6aMCFrpj2Ki8c yVFX9oJM4vF79cfo2noaHNtj3oxxwlvebCvXmkl+pEpKnYVQ3xeoKgMmV1sne+irCjaxT0 L6XRS3IVFfUVgMBNaXw/8UNPhqr1kmPR17bhGc6ftqZxnq6s6UVf+tF0PIAHhZDUHDiIlD tWd3Dgcj07e1B+cxREZaC9AdVzJDZ6BtkCGOd1qDOEBR9Kd7XkxWnEWXPSw3yzViFlPgFt KOxLaYP7JN0MWSYvMccD/NZmWl++tQ8gjWxigLS6teWir6u6jVLGmoO+ejHwUHN9gCjQs7 UcpOoL5O4blav9TadG+cIQIaujcoSErvYEbvJ18J6rDVLW8giGQBUSRKw0DWtwxvBKMOcD PYNZFnChajHpP9VxRXphyGqfTc/fZrXl5KB6WzwWOIoMsSY2BgSHCzX3KfU6OWIhR9GRZP rsgd2ZDsz+Dg7ztnGyYnXI3lJtcY9GzlgG4WgPqtu4JkBQoyU836iAwRl19Rgvr4Saa5D9 70xWNoZvqc2rLnKYEzinhGrl1LqRc1VRebnA/k1mh4d1kw/y7OBnWB3GIUfQ X-ME-Proxy: <xmx:-TQwajGFHaQCzBBpgyoRBSxtVUdDQlDVNPBxzKAKjN5UVfcg2yiH2g> <xmx:-TQwagQ93RVUpwzCDZeDHlBsQGeVfkngpxBAHT1N-vp9n6kd95Jw-Q> <xmx:-TQwaiCI2WxmwAl_c3nEqbzBy2cspaj5MfBp6dLbk5lj3q0lMEx23Q> <xmx:-TQwao2iFsjQCf5GvS5tWPYtauZz_P1_UFScZCzLJBxnjsw_myZ4TQ> <xmx:-TQwaoXtqLYtH3pvSu5BHDfyWvtKWVc9FZqKb1Gu3pxIy2FLiuKz0KnU> Feedback-ID: i61d64b6b:Fastmail Received: by mailuser.phl.internal (Postfix, from userid 501) id A229215C008C; Mon, 15 Jun 2026 13:23:05 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface MIME-Version: 1.0 X-ThreadId: A5oJ71bAMTWZ Date: Mon, 15 Jun 2026 10:22:45 -0700 From: "Chris Lamb" <lamby@debian.org> To: submit@bugs.debian.org Message-Id: <178154205408.1438793.4405291462192247551@bigcat> Subject: dh-nodejs: Generates unreproducible pkgjs-lock.json files if nocheck specified Content-Type: multipart/mixed; boundary=64597f712af5db674348e5c522ec63e953420385 X-Debian-User: lamby Delivered-To: submit@bugs.debian.org --64597f712af5db674348e5c522ec63e953420385 Content-Type: text/plain Content-Transfer-Encoding: 7bit Package: dh-nodejs Version: 0.17.4 Severity: important Tags: patch Dear Maintainer, Many packages using dh-nodejs are unreproducible right now because dh-nodejs can generate unreproducible pkgjs-lock.json files depending on whether nocheck is specified or not. The potential "pissue" is that link_external_modules() / _extLinks() in Debian::PkgJs::Utils will skip generating node_modules/foo symlinks for test-only modules, and so when Debian::PkgJs::PackageLock goes to generate the pkgjs-lock.json, nodepath will return different paths that are used in the JSON. For example, node-tsx's debian/nodes/extlinks has: esbuild chalk @ampproject/remapping chokidar es-module-lexer get-tsconfig magic-string slash execa test <-------------------- memfs test strip-ansi test strip-indent test ... which results in, for instance, the links for "execa" to not be generated if nocheck is specified. The pkgjs-lock.json file then contains (in the nocheck case): "/usr/share/nodejs/execa": { "name": "execa", "version": "8.0.1" }, ... and in the normal case (ie. when the tests are run), the pkgjs-lock.json contains: "node_modules/execa": { "name": "execa", "version": "8.0.1" } One fix *could* be to generate the links regardless whether nocheck is specified. I've attached this patch, although it's a very ugly diff due to the dedenting. However, I lack the understanding about how nodejs paths work to know whether this the right solution. Specifically, if a Build-Depends is listed as <!nocheck> and the package is *not* installed as a result, I don't know whether that will result in nodepath returning different/ broken results, or even cause a failure. (In the above example, the node-execa package was installed in both cases which cannot be guaranteed due to it being specified with <!nocheck>; it is hard to test what happens if node-execa is not installed as some other packages have transitive dependencies on it.) Best wishes, -- ,''`. : :' : Chris Lamb `. `'` lamby@debian.org / chris-lamb.co.uk `- --64597f712af5db674348e5c522ec63e953420385 Content-Disposition: attachment; filename="pkg-js-tools.diff.txt" Content-Type: text/plain; name="pkg-js-tools.diff.txt" Content-Transfer-Encoding: base64 ZGlmZiAtLWdpdCBsaWIvRGViaWFuL1BrZ0pzL1V0aWxzLnBtIGxpYi9EZWJpYW4vUGtnSnMv VXRpbHMucG0KaW5kZXggYzRkMmU2Ny4uZjc0NGMxOSAxMDA2NDQKLS0tIGxpYi9EZWJpYW4v UGtnSnMvVXRpbHMucG0KKysrIGxpYi9EZWJpYW4vUGtnSnMvVXRpbHMucG0KQEAgLTQ2OSw2 OCArNDY5LDUwIEBAIHN1YiBfZXh0TGlua3MgewogICAgICAgICAgICAgICAgICAgICAjIERy b3AgIiAgdGVzdCIgaWYgZXhpc3RzCiAgICAgICAgICAgICAgICAgICAgICRfID1+IHMvXHMr KFxTKikuKj8kLy87CiAKLSAgICAgICAgICAgICAgICAgICAgIyBJZiAiICB0ZXN0IiBleGlz dHMsIGxpbmsvY29weSBtb2R1bGUgb25seSBpZiAhbm9jaGVjawotICAgICAgICAgICAgICAg ICAgICBpZiAoCi0gICAgICAgICAgICAgICAgICAgICAgICAgICAgJDEKLSAgICAgICAgICAg ICAgICAgICAgICAgIGFuZCAkMSBlcSAndGVzdCcKLSAgICAgICAgICAgICAgICAgICAgICAg IGFuZCAoCi0gICAgICAgICAgICAgICAgICAgICAgICAgICAgKAotICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgJEVOVntERUJfQlVJTERfT1BUSU9OU30KLSAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgYW5kICRFTlZ7REVCX0JVSUxEX09QVElPTlN9ID1+ IC9cYm5vY2hlY2tcYi8KLSAgICAgICAgICAgICAgICAgICAgICAgICAgICApCi0gICAgICAg ICAgICAgICAgICAgICAgICAgICAgb3IgKCAgICAkRU5We0RFQl9CVUlMRF9QUk9GSUxFU30K LSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYW5kICRFTlZ7REVCX0JVSUxEX1BS T0ZJTEVTfSA9fiAvXGJub2NoZWNrXGIvICkKLSAgICAgICAgICAgICAgICAgICAgICAgICkK LSAgICAgICAgICAgICAgICAgICAgICApCi0gICAgICAgICAgICAgICAgICAgIHsKLSAgICAg ICAgICAgICAgICAgICAgICAgIHByaW50IFNUREVSUiAiU2tpcHBpbmcgJF8gbGlua1xuIjsK LSAgICAgICAgICAgICAgICAgICAgfQotICAgICAgICAgICAgICAgICAgICBlbHNlIHsKLSAg ICAgICAgICAgICAgICAgICAgICAgICMgU2VhcmNoIG1vZHVsZSB1c2luZyBub2RlcGF0aAot ICAgICAgICAgICAgICAgICAgICAgICAgbXkgKCRzcmMpOwotICAgICAgICAgICAgICAgICAg ICAgICAgc3Bhd24oCi0gICAgICAgICAgICAgICAgICAgICAgICAgICAgZXhlYyAgICAgICA9 PiBbICdub2RlcGF0aCcsICctQicsICRfIF0sCi0gICAgICAgICAgICAgICAgICAgICAgICAg ICAgd2FpdF9jaGlsZCA9PiAxLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRvX3N0 cmluZyAgPT4gXCRzcmMsCi0gICAgICAgICAgICAgICAgICAgICAgICAgICAgbm9fY2hlY2sg ICA9PiAxLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgWFhYOiBCYWNrd2FyZHMg Y29tcGF0aWJpbGl0eSwgcmVtb3ZlIGFmdGVyIGRwa2cgMS4yNC4wLgotICAgICAgICAgICAg ICAgICAgICAgICAgICAgIG5vY2hlY2sgICAgPT4gMSwKLSAgICAgICAgICAgICAgICAgICAg ICAgICk7Ci0KLSAgICAgICAgICAgICAgICAgICAgICAgICMgRmFpbCBpZiBub3QgZm91bmQK LSAgICAgICAgICAgICAgICAgICAgICAgIGlmICggJD8gb3Igbm90ICRzcmMgKSB7Ci0gICAg ICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQgU1RERVJSICIjIyMgJF8gaXMgcmVxdWly ZWQgYnkgIgotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLiAiZGViaWFuL25vZGVq cy8kZGlyL2V4dCR0eXBlIgotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLiAiIGJ1 dCBub3QgYXZhaWxhYmxlXG4iOwotICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmICgg JF8gPX4gcyNeXEB0eXBlcy8jIyApIHsKLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgcHJpbnQgU1RERVJSICIjIFR5cGVzY3JpcHQgZGVmaW5pdGlvbiAiCi0gICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgLiAiZGV0ZWN0ZWQsIEZhbGxiYWNrIHRvIG1haW4g bW9kdWxlXG4iOwotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzcGF3bigKLSAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4ZWMgICAgICAgPT4gWyAnbm9k ZXBhdGgnLCAnLUInLCAkXyBdLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgd2FpdF9jaGlsZCA9PiAxLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgdG9fc3RyaW5nICA9PiBcJHNyYywKLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIG5vX2NoZWNrICAgPT4gMSwKLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICMgWFhYOiBCYWNrd2FyZHMgY29tcGF0aWJpbGl0eSwgcmVtb3ZlIGFmdGVyIGRw a2cgMS4yNC4wLgotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbm9jaGVj ayAgICA9PiAxLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICApOwotICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoICQ/IG9yIG5vdCAkc3JjICkgewotICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQgU1RERVJSICIjIyMgJF8g aXNuJ3QgYXZhaWxhYmxlIHRvb1xuIjsKLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICRleGl0Kys7Ci0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KLSAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQgU1RERVJSICIjIyMgWW91IFNI T1VMRCB1cGRhdGUgeW91ciAiCi0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg LiAiZGViaWFuL25vZGVqcy8kZGlyL2V4dCR0eXBlIGZpbGUhXG4iOwotICAgICAgICAgICAg ICAgICAgICAgICAgICAgIH0KLSAgICAgICAgICAgICAgICAgICAgICAgICAgICBlbHNlIHsK KyAgICAgICAgICAgICAgICAgICAgIyBTZWFyY2ggbW9kdWxlIHVzaW5nIG5vZGVwYXRoCisg ICAgICAgICAgICAgICAgICAgIG15ICgkc3JjKTsKKyAgICAgICAgICAgICAgICAgICAgc3Bh d24oCisgICAgICAgICAgICAgICAgICAgICAgICBleGVjICAgICAgID0+IFsgJ25vZGVwYXRo JywgJy1CJywgJF8gXSwKKyAgICAgICAgICAgICAgICAgICAgICAgIHdhaXRfY2hpbGQgPT4g MSwKKyAgICAgICAgICAgICAgICAgICAgICAgIHRvX3N0cmluZyAgPT4gXCRzcmMsCisgICAg ICAgICAgICAgICAgICAgICAgICBub19jaGVjayAgID0+IDEsCisgICAgICAgICAgICAgICAg ICAgICAgICAjIFhYWDogQmFja3dhcmRzIGNvbXBhdGliaWxpdHksIHJlbW92ZSBhZnRlciBk cGtnIDEuMjQuMC4KKyAgICAgICAgICAgICAgICAgICAgICAgIG5vY2hlY2sgICAgPT4gMSwK KyAgICAgICAgICAgICAgICAgICAgKTsKKworICAgICAgICAgICAgICAgICAgICAjIEZhaWwg aWYgbm90IGZvdW5kCisgICAgICAgICAgICAgICAgICAgIGlmICggJD8gb3Igbm90ICRzcmMg KSB7CisgICAgICAgICAgICAgICAgICAgICAgICBwcmludCBTVERFUlIgIiMjIyAkXyBpcyBy ZXF1aXJlZCBieSAiCisgICAgICAgICAgICAgICAgICAgICAgICAgIC4gImRlYmlhbi9ub2Rl anMvJGRpci9leHQkdHlwZSIKKyAgICAgICAgICAgICAgICAgICAgICAgICAgLiAiIGJ1dCBu b3QgYXZhaWxhYmxlXG4iOworICAgICAgICAgICAgICAgICAgICAgICAgaWYgKCAkXyA9fiBz I15cQHR5cGVzLyMjICkgeworICAgICAgICAgICAgICAgICAgICAgICAgICAgIHByaW50IFNU REVSUiAiIyBUeXBlc2NyaXB0IGRlZmluaXRpb24gIgorICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgLiAiZGV0ZWN0ZWQsIEZhbGxiYWNrIHRvIG1haW4gbW9kdWxlXG4iOworICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHNwYXduKAorICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBleGVjICAgICAgID0+IFsgJ25vZGVwYXRoJywgJy1CJywgJF8gXSwKKyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd2FpdF9jaGlsZCA9PiAxLAorICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB0b19zdHJpbmcgID0+IFwkc3JjLAorICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBub19jaGVjayAgID0+IDEsCisgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICMgWFhYOiBCYWNrd2FyZHMgY29tcGF0aWJpbGl0eSwg cmVtb3ZlIGFmdGVyIGRwa2cgMS4yNC4wLgorICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBub2NoZWNrICAgID0+IDEsCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgKTsK KyAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoICQ/IG9yIG5vdCAkc3JjICkgewor ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwcmludCBTVERFUlIgIiMjIyAkXyBp c24ndCBhdmFpbGFibGUgdG9vXG4iOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAkZXhpdCsrOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KKyAgICAgICAgICAg ICAgICAgICAgICAgICAgICBwcmludCBTVERFUlIgIiMjIyBZb3UgU0hPVUxEIHVwZGF0ZSB5 b3VyICIKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC4gImRlYmlhbi9ub2RlanMv JGRpci9leHQkdHlwZSBmaWxlIVxuIjsKICAgICAgICAgICAgICAgICAgICAgICAgIH0KICAg ICAgICAgICAgICAgICAgICAgICAgIGVsc2UgewotICAgICAgICAgICAgICAgICAgICAgICAg ICAgIGNob21wICRzcmM7Ci0gICAgICAgICAgICAgICAgICAgICAgICAgICAgbXkgJHRtcCA9 ICRzcmM7Ci0gICAgICAgICAgICAgICAgICAgICAgICAgICAgJHRtcCA9fiBzI14uKj9ub2Rl anMvIyM7Ci0gICAgICAgICAgICAgICAgICAgICAgICAgICAgJGNtZHN7JHR5cGV9LT4oICRz cmMsICR0bXAgKTsKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZXhpdCsrOwogICAg ICAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgICAgICB9CisgICAgICAg ICAgICAgICAgICAgIGVsc2UgeworICAgICAgICAgICAgICAgICAgICAgICAgY2hvbXAgJHNy YzsKKyAgICAgICAgICAgICAgICAgICAgICAgIG15ICR0bXAgPSAkc3JjOworICAgICAgICAg ICAgICAgICAgICAgICAgJHRtcCA9fiBzI14uKj9ub2RlanMvIyM7CisgICAgICAgICAgICAg ICAgICAgICAgICAkY21kc3skdHlwZX0tPiggJHNyYywgJHRtcCApOworICAgICAgICAgICAg ICAgICAgICB9CiAgICAgICAgICAgICAgICAgfSBvcGVuX2ZpbGUoImRlYmlhbi9ub2RlanMv JGRpci9leHQkdHlwZSIpOwogICAgICAgICAgICAgICAgIGV4aXQgJGV4aXQgaWYgJGV4aXQ7 CiAgICAgICAgICAgICB9Cg== --64597f712af5db674348e5c522ec63e953420385-- ]