[Pkg-javascript-devel] Bug#1146092: marked as pending in pkg-js-tools

[Xavier]

Le 31/08/2026 à 13:15, Xavier a écrit :
> Le 31/08/2026 à 13:10, Jochen Sprickerhof a écrit :
>> Hi Yadd,
>>
>> * Yadd <noreply at salsa.debian.org> [2026-08-31 11:06]:
>>> Control: tag -1 pending
>>>
>>> Hello,
>>>
>>> Bug #1146092 in pkg-js-tools reported by you has been fixed in the
>>> Git repository and is awaiting an upload. You can see the commit
>>> message below and you can check the diff of the fix at:
>>>
>>> https://salsa.debian.org/js-team/pkg-js-tools/-/ 
>>> commit/7268e775137aace7ff17ed514009702607603f8b
>>>
>>> ------------------------------------------------------------------------
>>> Make pkgjs-lock.json reproducible
>>>
>>> Modules flagged "test" in extlinks/extcopies are linked only when 
>>> tests run, so
>>> the lock recorded node_modules/<dep> or /usr/share/nodejs/<dep> 
>>> depending on the
>>> build options (Closes: #1146092). Always resolve them through 
>>> nodepath, ie. keep
>>> the result a nocheck build gives.
>>> ------------------------------------------------------------------------
>>
>> Thanks for working on this, though note that this happened in a 
>> regular build not using nocheck. Let's see if this fixes it.
>>
>> Cheers Jochen
> 
> Thank you for your work on reproducibility!
> 
> You're right but I think the build should also be independent of the use 
> of nocheck profile. The bug is really closed by node-buble 0.20.0...-6
> (https://salsa.debian.org/js-team/node-buble/-/commit/998fa3)

A reproducible test based on check/nocheck would have detect the xz 
attack (https://en.wikipedia.org/wiki/XZ_Utils_backdoor)