Bug#950151: transition: pkg-js-tools

[Xavier <yadd@debian.org>]

Le 29/01/2020 à 15:43, Xavier Guimard a écrit :
> Package: release.debian.org
> Severity: normal
> User: release.debian.org@packages.debian.org
> Usertags: transition
> 
> Hi all,
> 
> pkg-js-tools provides a Node.js auto installer (debhelper plugin) used
> by JS Team.
> 
> Prior to 0.9.26, pkg-js-tools used DEB_HOST_GNU_TYPE instead of
> DEB_HOST_MULTIARCH to install arch dependent Node.js files. This affects
> i386 build since these files are not installed in the good directory.
> This causes reproducible build failures (see [1] for an example) and
> render these packages unusable with i386.
> 
> I didn't find in doc how to discriminate afected packages. The only way to
> see if a package is OK is to look at
> `debc|grep usr/lib/i686-linux-gnu/nodejs`: files have to be installed in
> usr/lib/i386-linux-gnu instead.
> 
> Note that buster packages are not affected: files where previously
> installed in /usr/lib/nodejs (all arch and indep files). That's why affected
> packages are those which:
>  *     are arch-dependent
>  * and depends on pkg-js-tools
>  * and were rebuilt after pkg-js-tools 0.9.0 release (0.8 in experimental)
> 
> Cheers,
> Xavier
> 
> [1]: https://tests.reproducible-builds.org/debian/rb-pkg/bullseye/i386/node-request-promise.html
> 
> Ben file (try):
> 
> title = "pkg-js-tools";
> is_affected = .depends ~ "libnode64" & .build-depends ~ "pkg-js-tools";
> is_good = <Fill out>;
> is_bad = <Fill out>;

More safe: .build-depends ~ "pkg-js-tools (> 0.5)"

Package that don't use recent pkg-js-tools have a "debian/install", so
should not be affected