Re: Built-Using for NodeJS/Javascript packages

[Julian Gilbey <jdg@debian.org>]

On Thu, Jul 31, 2025 at 11:45:28PM +0200, Bastien Roucaries wrote:
> Le jeudi 31 juillet 2025, 23:25:40 heure d’été d’Europe centrale Julian Gilbey 
> a écrit :
> > [Starting a separate thread for this discussion; this was originally
> > in a thread about nbdime]
> > 
> > On Thu, Jul 31, 2025 at 02:41:56PM +0200, Jérémy Lal wrote:
> > > Le jeu. 31 juil. 2025 à 14:31, Julian Gilbey <jdg@debian.org> a écrit :
> > > [...]
> > > 
> > >   Since NodeJS often packs sources together into the resulting
> > >   dist/index.js (or similar), we should probably make much more use of
> > >   Built-Using in the NodeJS packages, so that the builds are
> > >   reproducible, at least at each Debian release time.
> > > 
> > > Such bundles are built by their respective packages, which are
> > > Build-Depended upon.
> > > Builds are reproducible.
> > [...]
> > 
> > >   Further down the
> > >   line, it would be good if every time a NodeJS or similar package is
> > >   updated, all of its reverse dependencies are also automatically
> > >   rebuilt.
> > > 
> > > That would be awesome, however, that would cost a lot of VM.
> > > Jérémy
> > 
> > This is a good point.  We already do regular complete archive
> > rebuilding, so this would not be that onerous if it were not done for
> > every upload.  In testing, there are currently about 1760 JS/NodeJS
> > source packages, of which only a tiny handful (16) are not
> > Achitecture: all.  Rebuilding that many packages is not that bad, I
> > would guess, especially as it would only be needed on one buildd arch,
> > and most updates only have a small number of reverse dependencies.
> > [...]
> 
> Following debconf it is static-build-using field BTW lintian patch welcome

That's so cool - I didn't know about this; thanks for the pointer.
For those reading this thread, there is more info in deb-control(5)
and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069256

(BTW, there is a typo in your message; the field is called
Static-Built-Using)

There is also a dh-builtusing package that might be useful, though for
NodeJS packages, the ${nodejs:BuiltUsing} may be adequate in most
cases.  (It's worth noting that libjs-* packages do not appear to be
included in this substvar.)

It seems that this would be a good thing to look to implement widely
in the NodeJS/Javascript ecosystem.

> BTW i tigger rebuild of rdeps weekly for acorn and some package
> bastien

Interesting.  If this field is getting more use, though, and similar
issues apply to Go and Rust packages, the process for rebuilding
packages should presumably be decided at a whole-project level rather
than at an individual team level.  Was this also discussed at DebConf?

   Julian