[From nobody Mon Aug 31 23:35:08 2026
Received: (at submit) by bugs.debian.org; 10 Aug 2026 11:09:23 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-111.9 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,
 FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST,
 XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 15; hammy, 150; neutral, 32; spammy,
 0. spammytokens:
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <jspricke@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:45314)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <jspricke@debian.org>) id 1wtNsh-007WmB-0O
 for submit@bugs.debian.org; Mon, 10 Aug 2026 11:09:23 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Date:Message-ID:Subject:To:From:
 Content-Transfer-Encoding:MIME-Version:Content-Type:Reply-To:Cc:Content-ID:
 Content-Description:In-Reply-To:References;
 bh=O1kzrwmuyz7YQ5bTa2J8MMNgtMPNGGyx+P8MFSEbOvo=; b=fYIx5BBmdHNTzER1WyV5n8xo5J
 tnngngwRW8hlMhHfVWQ5+JuAUsYbEGmxegsTpUSNX7M9dVwIDlx9ra8mRkwpnw5fX28v52PgvQOz1
 Q52NH3fXCM8kPu57Pus/t0nVq/QDzecB3k4cAsXBwRLYgXdl7ShAYqHz+jEXI9B1E2w02+OpK2yWL
 Jol31ikCL30e3nYbITcpka+JqscfWNI12EMbdNOO4LgyIB0qEvRGO4r9/88F7EIE/PlVeC1kMJHzd
 ZCrHHB14eKkkTbmi7ZH3ov5GIEExkMVJ9RHFzvJ5242BUHhK0CxgvPZrpqSZukGZI2MW3GJnAD6I1
 +Y3N2hCA==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <jspricke@debian.org>)
 id 1wtNsf-002hyu-1A; Mon, 10 Aug 2026 11:09:21 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Jochen Sprickerhof <jspricke@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: libnode137 regressed in reproducibility
Message-ID: <178636015964.13624.3871458483113639327.reportbug@fenchel>
X-Mailer: reportbug 13.2.0+nmu1
Date: Mon, 10 Aug 2026 13:09:19 +0200
X-Debian-User: jspricke
Delivered-To: submit@bugs.debian.org

Source: nodejs
Version: 24.19.0+dfsg+~cs24.13.3-1
Severity: serious
X-Debbugs-Cc: reproducible-bugs@lists.alioth.debian.org
User: reproducible-builds@lists.alioth.debian.org
Usertags: randomness

Hi,

src:nodejs in unstable can't migrate to testing because the QA
infrastructure couldn't reproduce the libnode137 binary package in
unstable while it could reproduce the version in testing [1, 2].

>From the diff it looks like some randomness is compiled in, maybe due to
some auto generated source code?

Feel free to reach out if you need help debugging the problem but I
assume it will not be easy. Alternatively you can ask the release team
for an exception [3].

Cheers Jochen


[1] https://qa.debian.org/excuses.php?package=nodejs
[2] https://lists.debian.org/debian-devel-announce/2026/05/msg00001.html
[3] https://lists.debian.org/debian-devel/2026/05/msg00383.html
]