[Pkg-javascript-devel] Bug#918361: node-browserify-lite: unreproducible output order

[Rebecca N. Palmer]

Package: node-browserify-lite
Version: 0.5.0-1
Control: tags -1 upstream patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: toolchain randomness
X-Debbugs-Cc: reproducible-builds at alioth-lists.debian.net

browserify-lite produces its output in a (pseudo)random order: see e.g. 
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/theano.html

This is known to the reproducible builds team as 
randomness_in_browserify_lite_output (and I suspect 
nondeterminstic_output_from_uglifyjs is actually the same issue).

It appears to be trivially fixable:

--- a/index.js
+++ b/index.js
@@ -79,6 +79,7 @@ function renderBundle(options, cb) {

    function render(entrySourcePath, cb) {
      var modules = Object.keys(sources);
+    modules.sort();
      var aliases = {};
      modules.forEach(function(canonicalSourcePath, index) {
        aliases[canonicalSourcePath] = index;

This has had only limited testing: on graphlib-dot and dagre-d3 (in 
theano's debian/missing-sources), it's reproducible between 2 runs on 
the same source tree, and its output runs in Firefox without obvious error.

The bug appears to exist upstream (with the same fix), but I have not 
tested this.