Source: node-d3-fetch
Version: 1.1.2+dfsg-1
Severity: wishlist
Tags: patch
User: reproducible-bui...@lists.alioth.debian.org
Usertags: timestamps
X-Debbugs-Cc: reproducible-b...@lists.alioth.debian.org

Hi,

Whilst working on the Reproducible Builds effort [0], we noticed
that node-d3-fetch could not be built reproducibly.

This is because it was embedding the build date in a "banner"
comment:

│ │ │ │ │ -// https://d3js.org/d3-fetch/ v1.3.2 Copyright 2020 Mike Bostock
│ │ │ │ │ +// https://d3js.org/d3-fetch/ v1.3.2 Copyright 2019 Mike Bostock

Patch attached that uses SOURCE_DATE_EPOCH.

 [0] https://reproducible-builds.org/
 [1] https://reproducible-builds.org/specs/source-date-epoch/


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      la...@debian.org / chris-lamb.co.uk
       `-
--- a/debian/patches/reproducible_build.diff    1970-01-01 01:00:00.000000000 
+0100
--- b/debian/patches/reproducible_build.diff    2019-06-20 09:17:35.582525562 
+0100
@@ -0,0 +1,15 @@
+Description: Make the build reproducible
+Author: Chris Lamb <la...@debian.org>
+Last-Update: 2019-06-20
+
+--- node-d3-fetch-1.1.2+dfsg.orig/rollup.config.js
++++ node-d3-fetch-1.1.2+dfsg/rollup.config.js
+@@ -10,7 +10,7 @@ const config = {
+     format: "umd",
+     indent: false,
+     extend: true,
+-    banner: `// ${meta.homepage} v${meta.version} Copyright ${(new 
Date).getFullYear()} ${meta.author.name}`,
++    banner: `// ${meta.homepage} v${meta.version} Copyright ${(new 
Date(process.env.SOURCE_DATE_EPOCH ? (process.env.SOURCE_DATE_EPOCH * 1000) : 
new Date().getTime())).getFullYear()} ${meta.author.name}`,
+     globals: Object.assign({}, ...Object.keys(meta.dependencies || 
{}).filter(key => /^d3-/.test(key)).map(key => ({[key]: "d3"})))
+   },
+   plugins: [
--- a/debian/patches/series     2019-06-20 09:15:18.936740112 +0100
--- b/debian/patches/series     2019-06-20 09:17:34.426511052 +0100
@@ -1 +1,2 @@
 remove_terser_add_commonjs.diff
+reproducible_build.diff

Reply via email to