From 4c57ee4ee42c490b9f4a7a2c3bd9a6696e4d7c39 Mon Sep 17 00:00:00 2001 From: JF Date: Sat, 22 Aug 2026 14:39:49 -0400 Subject: [PATCH] fix(build): drop wall-clock timestamps from shipped vendor outputs Two identical clean builds from the same commit did not produce byte-identical vendored outputs because the vendor scripts stamped wall-clock time into files that ship: - build-js-debug.js wrote `fetchedAt` into vendor/js-debug/manifest.json (ships in @debugmcp/adapter-javascript) - vendor-codelldb.js wrote `downloadedAt` into each platform version.json (ships in @debugmcp/codelldb-common and the five codelldb platform packages) Neither field had a consumer: integrity lives in the committed vendor-manifest.json digest pins, and the resolver/staging only read `version`/`platform` from version.json. With the fields removed, no timestamps remain in shipped outputs, so no SOURCE_DATE_EPOCH plumbing is needed. The cache-only `cachedAt` stamp is kept - it lands in the user cache dir and never ships. Verified the issue's acceptance criterion on win32: two consecutive `pnpm run vendor:force && npm run build` runs produce byte-identical vendor trees (recursive sha256) and identical packed tarballs for adapter-javascript, codelldb-common, and codelldb-win32-x64. Fixes #421 Co-Authored-By: Claude Fable 5 --- packages/adapter-javascript/docs/README.md | 2 +- packages/adapter-javascript/scripts/build-js-debug.js | 3 +-- packages/codelldb-common/scripts/vendor-codelldb.js | 3 +-- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/packages/adapter-javascript/docs/README.md b/packages/adapter-javascript/docs/README.md index 8821e573..622ddedf 100644 --- a/packages/adapter-javascript/docs/README.md +++ b/packages/adapter-javascript/docs/README.md @@ -86,7 +86,7 @@ Expected outputs - vendor/js-debug/watchdog.js (optional sidecar — copied if present) - vendor/js-debug/package.json (forces `type: 'commonjs'`) - vendor/js-debug/vsDebugServer.js.sha256 -- vendor/js-debug/manifest.json (metadata: source, repo, version, asset, sha256, fetchedAt) +- vendor/js-debug/manifest.json (metadata: source, repo, version, asset, sha256) - vendor/ subdirectory (contains the js-debug vendored files) Determinism and safety diff --git a/packages/adapter-javascript/scripts/build-js-debug.js b/packages/adapter-javascript/scripts/build-js-debug.js index 85373321..c83e47b4 100644 --- a/packages/adapter-javascript/scripts/build-js-debug.js +++ b/packages/adapter-javascript/scripts/build-js-debug.js @@ -350,8 +350,7 @@ async function writeManifest({ source, repo, version, asset, sha256, original }) version, asset, sha256, - ...(original ? { original } : {}), - fetchedAt: new Date().toISOString() + ...(original ? { original } : {}) }; await fsp.writeFile(MANIFEST_FILE, JSON.stringify(manifest, null, 2) + '\n', 'utf8'); } diff --git a/packages/codelldb-common/scripts/vendor-codelldb.js b/packages/codelldb-common/scripts/vendor-codelldb.js index d08c33e1..cf4354c5 100644 --- a/packages/codelldb-common/scripts/vendor-codelldb.js +++ b/packages/codelldb-common/scripts/vendor-codelldb.js @@ -533,8 +533,7 @@ async function extractAndCopyFiles(vsixPath, platform, platformInfo, vsixName) { const versionFile = path.join(VENDOR_DIR, platformInfo.targetDir, 'version.json'); await fs.writeFile(versionFile, JSON.stringify({ version: CODELLDB_VERSION, - platform: platform, - downloadedAt: new Date().toISOString() + platform: platform }, null, 2)); log(`Success: ${platform} vendored successfully`);