Le 31/08/2026 à 13:15, Xavier a écrit :
Le 31/08/2026 à 13:10, Jochen Sprickerhof a écrit :
Hi Yadd,
* Yadd <[email protected]> [2026-08-31 11:06]:
Control: tag -1 pending
Hello,
Bug #1146092 in pkg-js-tools reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:
https://salsa.debian.org/js-team/pkg-js-tools/-/
commit/7268e775137aace7ff17ed514009702607603f8b
------------------------------------------------------------------------
Make pkgjs-lock.json reproducible
Modules flagged "test" in extlinks/extcopies are linked only when
tests run, so
the lock recorded node_modules/<dep> or /usr/share/nodejs/<dep>
depending on the
build options (Closes: #1146092). Always resolve them through
nodepath, ie. keep
the result a nocheck build gives.
------------------------------------------------------------------------
Thanks for working on this, though note that this happened in a
regular build not using nocheck. Let's see if this fixes it.
Cheers Jochen
Thank you for your work on reproducibility!
You're right but I think the build should also be independent of the use
of nocheck profile. The bug is really closed by node-buble 0.20.0...-6
(https://salsa.debian.org/js-team/node-buble/-/commit/998fa3)
A reproducible test based on check/nocheck would have detect the xz
attack (https://en.wikipedia.org/wiki/XZ_Utils_backdoor)
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
