fix(build): drop wall-clock timestamps from shipped vendor outputs - #428
Merged
Conversation
Two identical clean builds from the same commit did not produce byte-identical vendored outputs because the vendor scripts stamped wall-clock time into files that ship: - build-js-debug.js wrote `fetchedAt` into vendor/js-debug/manifest.json (ships in @debugmcp/adapter-javascript) - vendor-codelldb.js wrote `downloadedAt` into each platform version.json (ships in @debugmcp/codelldb-common and the five codelldb platform packages) Neither field had a consumer: integrity lives in the committed vendor-manifest.json digest pins, and the resolver/staging only read `version`/`platform` from version.json. With the fields removed, no timestamps remain in shipped outputs, so no SOURCE_DATE_EPOCH plumbing is needed. The cache-only `cachedAt` stamp is kept - it lands in the user cache dir and never ships. Verified the issue's acceptance criterion on win32: two consecutive `pnpm run vendor:force && npm run build` runs produce byte-identical vendor trees (recursive sha256) and identical packed tarballs for adapter-javascript, codelldb-common, and codelldb-win32-x64. Fixes #421 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #421
What
Two identical clean builds from the same commit did not produce byte-identical vendored outputs, because the vendor scripts stamped wall-clock time into files that ship:
packages/adapter-javascript/scripts/build-js-debug.js—fetchedAt: new Date().toISOString()in the js-debug vendor manifest, which ships in@debugmcp/adapter-javascript(filesincludesvendor/js-debug).packages/codelldb-common/scripts/vendor-codelldb.js—downloadedAt: new Date().toISOString()in each platformversion.json, which ships in six packages:@debugmcp/codelldb-commonand the five@debugmcp/codelldb-*platform packages (staged byscripts/stage-codelldb-packages.mjs).This blocked the OpenSSF Best Practices
build_repeatablecriterion (independent verification that a rebuild matches what was published).Approach: remove, don't derive
The issue offered
SOURCE_DATE_EPOCH-derived stamps as one option. Removal is simpler and strictly better here:vendor-manifest.jsondigest pins; the CodeLLDB resolver and the staging script read onlyversion/platformfromversion.json; nothing reads the js-debug manifest at runtime. No test asserts on either field.SOURCE_DATE_EPOCHto control.cachedAtstamp is left alone — it lands in cache metadata under the user cache dir and never ships.Also updated the manifest field list in
packages/adapter-javascript/docs/README.md. The "Deterministic output" claim in the build-js-debug.js header is now actually true.Verification (the issue's acceptance criterion)
Ran
pnpm run vendor:force && npm run buildtwice on win32 from this commit:packages/adapter-javascript/vendor/js-debug/andpackages/codelldb-common/vendor/codelldb/(all five platforms): byte-identical across runs.pnpm packof@debugmcp/adapter-javascript,@debugmcp/codelldb-common, and the staged@debugmcp/codelldb-win32-x64: identical tarball sha256s across runs.vitest run packages/codelldb-common/tests(81 tests) and adapter-javascript package tests (146 tests): all pass.🤖 Generated with Claude Code