[Pkg-javascript-devel] reproducible JavaScript?

[Holger Levsen]

Hi Tom,

thanks for reaching out!

On Wed, Aug 03, 2016 at 02:47:46PM -0500, Tom Marble wrote:
> I've been thinking about software freedom for web applications
> and wondering if anyone has thought about or done any tooling
> for "reproducible builds" for JavaScript libraries?
 
I guess so, because 96% (479 out of 499) of the packages on
https://tests.reproducible-builds.org/debian/unstable/amd64/pkg_set_maint_pkg-javascript-devel.html
are reproducible (in our current test framework)! :-)

5 (1.0%) packages failed to build reproducibly: twitter-bootstrap3 npm
jssip modernizr node-mocha

15 (3.0%) packages failed to build from souce: libv8-3.14
node-oauth# node-lodash node-contextify# node-postgres node-xmpp
node-zipfile

For modernizr there's an unapplied patch to make it build reproducible
too! "#817979 modernizr: input order is not deterministic" - the bug
also has not seen a maintainer reply yet.

> Is there a way to use one of tools linked from (or elsewhere)
>   https://wiki.debian.org/ReproducibleBuilds
> to check if a JavaScript library (libjs-*) is passing the
> reproducible tests?

there are reprotest and diffoscope available in stretch and sid,
reprotest is a new tool you might want to try, and diffoscope is also
available from jessie-backports.


-- 
cheers,
	Holger
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 811 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-javascript-devel/attachments/20160803/9b1a41ce/attachment.sig>