#1144052 libnode137 regressed in reproducibility

Package:
src:nodejs
Source:
src:nodejs
Submitter:
Jochen Sprickerhof
Date:
2026-08-15 08:45:02 UTC
Severity:
normal
#1144052#5
Date:
2026-08-10 11:09:19 UTC
From:
To:
Hi,

src:nodejs in unstable can't migrate to testing because the QA
infrastructure couldn't reproduce the libnode137 binary package in
unstable while it could reproduce the version in testing [1, 2].

From the diff it looks like some randomness is compiled in, maybe due to
some auto generated source code?

Feel free to reach out if you need help debugging the problem but I
assume it will not be easy. Alternatively you can ask the release team
for an exception [3].

Cheers Jochen


[1] https://qa.debian.org/excuses.php?package=nodejs
[2] https://lists.debian.org/debian-devel-announce/2026/05/msg00001.html
[3] https://lists.debian.org/debian-devel/2026/05/msg00383.html
#1144052#10
Date:
2026-08-10 13:42:04 UTC
From:
To:
Le lun. 10 août 2026 à 13:11, Jochen Sprickerhof <jspricke@debian.org> a
écrit :

Unfortunately I have absolutely no idea why this happens.
https://reproduce.debian.net/amd64/api/v1/builds/278499/artifacts/742190/diffoscope
shows a few bytes have changed.
But why ?!?
#1144052#15
Date:
2026-08-10 14:02:39 UTC
From:
To:
Le lun. 10 août 2026 à 15:45, Jérémy Lal <kapouer@melix.org> a écrit :
https://github.com/nodejs/node/pull/63626

Now I need to find out why the snapshot changes. There is probably
something time-dependent in its checksum.
#1144052#20
Date:
2026-08-11 08:37:47 UTC
From:
To:
Hi Jochen,

did it actually regress, or was the previous version failure ignored ?

I'm about to open an upstream bug report, because they want to make
their builds reproducible.

The source of variation is likely to come from mksnapshot.
Anyone willing to look into this will want to search for
"predictable", "random_seed".
#1144052#25
Date:
2026-08-13 06:36:20 UTC
From:
To:
Hi Jérémy,

* Jérémy Lal <kapouer@melix.org> [2026-08-11 10:37]:

It regressed as the one in forky is reproducible:

https://reproduce.debian.net/amd64/forky.html#libnode137
compute resources for such a big package.

Cheers Jochen

P.S.: Please note that bug authors are not automatically subscribed so
please remember to Cc me.
#1144052#32
Date:
2026-08-14 19:07:30 UTC
From:
To:
I asked for an exception and it was granted,
so I reduced severity to important.

I'm keen on fixing this. The simplest approach will be to revert the change
that caused this.

Le jeu. 13 août 2026 à 08:36, Jochen Sprickerhof <jspricke@debian.org> a
écrit :

Fair enough... I often abuse porterboxes that have low activity to debug
builds.

That's something I find very weird. If you send a bug report, you're
supposed to get the replies ?
Otherwise, what's the point ?
Anyway, cc-ing you as requested ;)
#1144052#37
Date:
2026-08-15 08:42:42 UTC
From:
To:
Hi Jérémy,

* Jérémy Lal <kapouer@melix.org> [2026-08-14 21:07]:

This has been discussed in Debian for a long time already but it is the
current default and documented here:

https://www.debian.org/Bugs/Developer#followup

Cheers Jochen