[Pkg-javascript-devel] Bug#1016584: node-canvas-confetti: please make the build reproducible

[Chris Lamb]

Source: node-canvas-confetti
Version: 1.5.1+~1.4.3-1
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0] we noticed that
node-canvas-confetti could not be built reproducibly.

This is because embedded the build time into the file. Whilst I could
have patched this to use SOURCE_DATE_EPOCH, it seems more sensible to
simply drop the timestamp; it's in a comment anyway and "built on" using
the value of SOURCE_DATE_EPOCH may even be misleading.

 [0] https://reproducible-builds.org/


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby at debian.org / chris-lamb.co.uk
       `-
-------------- next part --------------
--- a/debian/patches/reproducible-build.patch	1969-12-31 16:00:00.000000000 -0800
--- b/debian/patches/reproducible-build.patch	2022-08-03 08:00:30.310187371 -0700
@@ -0,0 +1,24 @@
+Description: Make the build reproducible
+Author: Chris Lamb <lamby at debian.org>
+Last-Update: 2022-08-03
+
+--- node-canvas-confetti-1.5.1+~1.4.3.orig/build/build.js
++++ node-canvas-confetti-1.5.1+~1.4.3/build/build.js
+@@ -26,7 +26,7 @@ function writeFile(file, content) {
+ }
+ 
+ function buildCommonJs(content) {
+-  return `// ${name} v${version} built on ${buildDate}
++  return `// ${name} v${version}
+ !(function (window, module) {
+ // source content
+ ${content}
+@@ -38,7 +38,7 @@ ${content}
+ }
+ 
+ function buildModule(content) {
+-  return `// ${name} v${version} built on ${buildDate}
++  return `// ${name} v${version}
+ var module = {};
+ 
+ // source content
--- a/debian/patches/series	2022-08-03 07:57:12.233950517 -0700
--- b/debian/patches/series	2022-08-03 08:00:27.686184206 -0700
@@ -1 +1,2 @@
 replace-old-ava-by-jest.patch
+reproducible-build.patch