Dear maintainer:

This package currently fails to build from source in all supported distributions.

make[1]: Leaving directory '/<<PKGBUILDDIR>>'
    dh_clean
  debian/rules binary
dh binary
    dh_update_autotools_config
    dh_autoreconf
    debian/rules execute_before_dh_auto_configure
make[1]: Entering directory '/<<PKGBUILDDIR>>'
# Fail the build if the tzdata package does not match TZVER.
grep -q '^# version 2023d$' /usr/share/zoneinfo/tzdata.zi
make[1]: *** [debian/rules:28: execute_before_dh_auto_configure] Error 1
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
make: *** [debian/rules:24: binary] Error 2
dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2

See also:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/moment-timezone.js.html

I'm curious: Does this package embed the information from tzdata into javascript code,
in such a way that a change in tzdata requires a rebuild?

I think it would be highly desirable to find a way for this package to do what
it's supposed to do without having to fix it in oldstable and stable every year.

(In fact, I asked Paul Gevers about this, he says that a package which we know
for sure that it will fail to build during the support time of the release is RC).

Thanks.

Hi Santiago,

Yes, this is expected after each update to tzdata.

Yes. It is the only way I found to keep the package aligned with tzdata
while ensuring it is fully built from source: upstream ships the
pre-compiled tzdata information, so I regenerate those files using the
tzdata package.

Without a new upload, I cannot imagine how.. :-/

It fails to build if tzdata is updated, but it never stops working. It
just needs to be updated as often as tzdata is. But if you have a
suggestion to make this more automatic, I would love to hear it.. I have
been doing this very repetitive maintenance for years!

Hello,

Bug #1068750 in moment-timezone.js reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/moment-timezone.js/-/commit/a1ccd03c583206a83c580a1c90d52486f6254416

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1068750

We believe that the bug you reported is fixed in the latest version of
moment-timezone.js, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1068750@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martina Ferrari <tina@debian.org> (supplier of updated moment-timezone.js package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 22 Apr 2024 19:16:15 +0000
Source: moment-timezone.js
Architecture: source
Version: 0.5.45+dfsg-1+2024a
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Martina Ferrari <tina@debian.org>
Closes: 1068750
Changes:
 moment-timezone.js (0.5.45+dfsg-1+2024a) unstable; urgency=medium
 .
   * New upstream version 0.5.45+dfsg.
   * debian/copyright: Update years.
   * Support tzdata 2024a. Closes: #1068750.
Checksums-Sha1:
 f9663e5bcc9b707788d9415eff453f917706c2f9 2356 moment-timezone.js_0.5.45+dfsg-1+2024a.dsc
 9e582ede7a292da78a80ef33661e443ec2d82b36 1991404 moment-timezone.js_0.5.45+dfsg.orig.tar.xz
 ebf98a19a9ed0a7e4d6b5fe6c38b31b6de0d690c 6364 moment-timezone.js_0.5.45+dfsg-1+2024a.debian.tar.xz
 e79690da0b1e3aa8897293034688090fd684c10c 20437 moment-timezone.js_0.5.45+dfsg-1+2024a_amd64.buildinfo
Checksums-Sha256:
 8ea4fb10516e980fdf541b50ff5b4bd79376ab9d1cf13b41c4a96f58bfc2de69 2356 moment-timezone.js_0.5.45+dfsg-1+2024a.dsc
 605638ef0f6235292fbf571510b2d1751899afd50af4cfed63f024c679b979ee 1991404 moment-timezone.js_0.5.45+dfsg.orig.tar.xz
 f25dae861ebedc15dd0fd0398ea3aeb374fbddc5625f4f9753b08281d8656136 6364 moment-timezone.js_0.5.45+dfsg-1+2024a.debian.tar.xz
 9202e1ed43c137b4b980c9a3382c3644546297185e0ca7d6758be1c0b6a65f33 20437 moment-timezone.js_0.5.45+dfsg-1+2024a_amd64.buildinfo
Files:
 1ef00920ba182620d1634f268e839198 2356 javascript optional moment-timezone.js_0.5.45+dfsg-1+2024a.dsc
 48a03ce04ec6e1e05da7b8aca6734726 1991404 javascript optional moment-timezone.js_0.5.45+dfsg.orig.tar.xz
 1d9aeb8a59f30675dc0c65b5c9909181 6364 javascript optional moment-timezone.js_0.5.45+dfsg-1+2024a.debian.tar.xz
 67b43d90b9c168ba14bcff56c549ab35 20437 javascript optional moment-timezone.js_0.5.45+dfsg-1+2024a_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE2qbv8cYn6hwmsaaSqiMPxF+MJ7EFAmYmvPYACgkQqiMPxF+M
J7HYyQ//cJ4fcptvMEXyAE3WiF8aS1A7AM6sfmjV1b3R7YgNogAL4u/4dk8eqgvu
4T1iBixPwFtZlYl5cPCuEV4MkHytjPcJ+FVeLBxlnW8Jjq74tE/F7lcWV9we6eA3
+e7fVX61t95kQdt+9ubKzwqQwBmCokZOfkr0xd+HxUSZeAdr+p8SUNKNbwsbOJR8
fzsvQ2GMrSvYDHXaSUhgpqs8LGEDxIKI/kd0aH7TNRn2Di47dqEpTIY09LGqKs1j
ITRi3KxBsAUxe7mPUAI8noa4WDqSYSUZ1Nmw1HnX0DEWkE9lXgObaZ5tjxYGTLJz
uedbE1+0kr6+pssSH6ot9pQ0kGClY3COZGC8n5vPRcie8k7mLczDymg2DnJhjwiZ
MDNLw8uNJR8UtE99knPosbdRp8NPOPcoh4gfkmWpe7X5LMBZQWyn5Aq/VYBV6vCH
5dS8uCxOJYTpVqp4BzI0okgJB6GtCHcFrNr8Q7mrh6WddOVuXNNFdPKXIw73yQS1
BzjdYtb3hIARBEmY/9i+z/4rtVpZv/sCkmf5Y/9HLJ4E9Qe664rtI6biOFmNJ2BO
k1DJ1ov/OTlLtDFnGgb2/JJbBxb/m4K0j6rKMCzByQOWUpSa/axmA5lOCeBBTd9Q
FLBamdSrsXFnvXDhSKzl3XtYHpCtl4zaV5EheoPXZ6YYgTpksWo=
=DveR
-----END PGP SIGNATURE-----

Sorry, I still don't get it.

Why does the package build needs to fail if tzdata is updated?

What happens if we allow the package to be built anyway?
(as in the attached patch).

Would the resulting package be broken in any way?

Well, I get that you have to make a new upload so that the package is current.
What I don't get is that the package fails to build. At most, it would result
in an improved package, not worse. Or maybe I'm missing anything.

Thanks.

Hi Santiago,

It works, but then there is no way to embed the (effective) tzdata
version into the moment-timezone.js version, so you could have identical
source packages producing binaries with the same version and different
contents, and no way to depend on it. Plus, it almost always fails to
build anyway, because many of the tests need to be adjusted when tzdata
changes.

The (better) alternative would be to make it always use a fixed tzdata
version, but then tzdata migrations will be blocked each time until I
upload a new version.

What I described above, but I am really open to suggestions on how to
better handle this.

So it's actually possible to rebuild this package without manual
intervention of its maintainer,
whenever tzdata is updated.
That's what I pushed in the salsa repository.

I think it's a use case for adding
Static-Built-Using: tzdata-legacy

to debian/control ???

I skipped the generated tests for autopkgtests, and kept them only during
build time to avoid the previous solution, which was to embed the tests/*
in the binary package, taking way too much space for that matter.
If running the generated tests during autopkgtests is important, it should
be run in the built source package instead.

Jérémy

We believe that the bug you reported is fixed in the latest version of
moment-timezone.js, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1068750@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martina Ferrari <tina@debian.org> (supplier of updated moment-timezone.js package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 04 Nov 2024 10:27:39 +0000
Source: moment-timezone.js
Binary: libjs-moment-timezone node-moment-timezone
Architecture: source all
Version: 0.5.46+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Martina Ferrari <tina@debian.org>
Description:
 libjs-moment-timezone - Parse and display dates in any timezone
 node-moment-timezone - Parse and display dates in any timezone (node.js library)
Closes: 1068750 1084301
Changes:
 moment-timezone.js (0.5.46+dfsg-1) unstable; urgency=medium
 .
   [ Jérémy Lal ]
   * Rebuild all artifacts from system tzdata. Closes: #1068750.
     This package just needs to be rebuilt against new
     versions of tzdata-legacy, as expected of a build-dependency.
   * Loosen tzdata-legacy dependency
   * Extend excluded files to all generated artifacts.
   * Drop +$(TZVER) suffix.
   * autopkgtest: run only core tests and not build tests.
   * No need to install tests files. Save space.
   * Use a symlink for latest.json
   * Drop autopkgtest-pkg-perl.conf
 .
   [ Martina Ferrari ]
   * Remove lintian overrides for removed files.
   * Add Built-Using information; cannot use Static-Built-Using at this point
     because dh-nodejs (via Debian::Control) does not support it yet.
   * New upstream version 0.5.46+dfsg. Closes: #1084301.
Checksums-Sha1:
 41f2cde5993f833134c489f41dba53ee1da8ce66 2315 moment-timezone.js_0.5.46+dfsg-1.dsc
 754983216bd9f771011cb3cee31ecc37adf797a6 81124 moment-timezone.js_0.5.46+dfsg.orig.tar.xz
 cd9a473f26cb5c74cdf02ebe21305e13d90f5c5a 6668 moment-timezone.js_0.5.46+dfsg-1.debian.tar.xz
 e74f42209603a3bc95e468f21709ca5c7aa43e15 206160 libjs-moment-timezone_0.5.46+dfsg-1_all.deb
 89be6669269092ec3d04a960e99c8a7a4405eb4f 20292 moment-timezone.js_0.5.46+dfsg-1_amd64.buildinfo
 4cd7031c22c44188293da89de37011a22ccbb547 17804 node-moment-timezone_0.5.46+dfsg-1_all.deb
Checksums-Sha256:
 299a653b841db8ae5e41af21b73aa2e414583f4ea658ef8ad45ec818b90fbdf5 2315 moment-timezone.js_0.5.46+dfsg-1.dsc
 f0938be40f03cdf8ec5fd8766f6375baafdc64c52fa84b06aa89d339aab17463 81124 moment-timezone.js_0.5.46+dfsg.orig.tar.xz
 e7f112abad06ef9547fa2724002019296bbec2b56ccb64966203934f1a2cc075 6668 moment-timezone.js_0.5.46+dfsg-1.debian.tar.xz
 fce76488c264a84d10218a3c6e1b0f659519cbd55c2098d4be51831914f0bd90 206160 libjs-moment-timezone_0.5.46+dfsg-1_all.deb
 263096cda6c9dd7802003b48fdfc4fce82ec8b824539505ce94a94fb39f063a0 20292 moment-timezone.js_0.5.46+dfsg-1_amd64.buildinfo
 160f09223f090f63d16345974c4e362d9e8bef358b09dbfde47b111c5884d7fe 17804 node-moment-timezone_0.5.46+dfsg-1_all.deb
Files:
 6fdbe4c8a3c3ae88cbc96bb06bd268c7 2315 javascript optional moment-timezone.js_0.5.46+dfsg-1.dsc
 90b67871d42cda80cf1aff2491744b6d 81124 javascript optional moment-timezone.js_0.5.46+dfsg.orig.tar.xz
 3c97de64e542ba320303ca71e84bc742 6668 javascript optional moment-timezone.js_0.5.46+dfsg-1.debian.tar.xz
 fd52ba0dac7560963f90e78592a5a412 206160 javascript optional libjs-moment-timezone_0.5.46+dfsg-1_all.deb
 7fcf5ee4a8236e1f1a9d8a0a1cf7c29e 20292 javascript optional moment-timezone.js_0.5.46+dfsg-1_amd64.buildinfo
 f577fd8a58d43d392f45d6859289d4e4 17804 javascript optional node-moment-timezone_0.5.46+dfsg-1_all.deb
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE2qbv8cYn6hwmsaaSqiMPxF+MJ7EFAmcoo+0ACgkQqiMPxF+M
J7EaEw//eIu04W59EWoqsR62ijkeWM29KSwv6VVrxM9ft02iLqjR3PgCx1Fxj6mB
YvBANgkWzGu1f1+rPKbghsOPfLZynBjtctazRlHFJGpGlATB7fuEFr5G4g1Zxlqd
xVB2q+UVazuw/ILxObdu7NrRwE2S0wCuT4DcZjFsuRHA7jecCiLcL4SkSbxGVtAS
L7i1rngMFwf53dDBSSiDkp6Ekgmzxz8MtyZfWBVj7TSKsOAiwWOjG3Qnu+x80I9j
7eMj4lGO0jgcahqHcAHGZ+Fq2uwiRHfoVAd7DEJjYDUGl8zcucu+cXTg33NZMLkd
5Nps7BZN1xpM6ey4OElxU2Sb1gMvgb0bAPrAZ5E8ik9AVS1Um4sWJb7N+9mmWBoP
PHLNy+VEaEthjnvnq7y0+VNnpCRQY9FV9tZfRKUi1URV/QUBfsAczNw1vWWw+7ok
noRKtPTfqTQyetxSQvXdRUVvJ3kI96pNiDRhh0BcoMSZzjPmdYf7AvzpW8tANBmp
Qvlc5j5/Fa7u2kVZbvo6FaDdO+FQfPuFXb8cUpVK/gVbpAwNDmQpzQkuldFj3uRg
PCGq5086l9UQWKndi6FDPxlFWl4oqM5ESY9739a6HQox1ejyn9FsuHa43Gjk1yF8
dbBcQq3S6mMHec6QzXxzxgEYLVZbYYe/3XswW9c93sdqggz1Ib4=
=bCRF
-----END PGP SIGNATURE-----