[Pkg-javascript-devel] Bug#1003809: node-postcss: reproducible-builds: build path embedded in pkgjs-lock.json

[Vagrant Cascadian]

Source: node-postcss
Severity: normal
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: buildpath
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org

The build path of is embedded in a pkgjs-lock.json file:

  https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/node-postcss.html

  /usr/share/nodejs/nanoid/pkgjs-lock.json

  "/build/1st/node-postcss-8.4.5+~cs7.1.51":·{
  vs.
  "/build/2/node-postcss-8.4.5+~cs7.1.51/2nd":·{

The attached patch to debian/rules works around this by replacing the
build path with a package and version string in a dh_compress override.


The pkgjs-lock.json files appear to be generated from pkg-js-tools and
might be possible to fix there instead; I'm not sure why the other
pkgjs-lock.json files in node-postcss do not have embedded build paths.


With this patch applied, node-postcss should build reproducibly on
tests.reproducible-builds.org!


Thanks for maintaining node-postcss!


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-debian-rules-Remove-the-build-path-from-pkgjs-lock.j.patch
Type: text/x-diff
Size: 969 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20220115/87bd64f8/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20220115/87bd64f8/attachment.sig>