deno: Inline NPM registry metadata for reproducibility

deno/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@flatpak-contrib/flatpak-deno-generator",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "exports": "./src/main.ts",
   "license": "MIT"
 }

deno/src/main.ts

@@ -29,7 +29,12 @@ export interface FlatpakData {
   /** The type of the source, e.g., "file", "archive". */
   type: string;
   /** The URL from which to download the source. */
-  url: string;
+  url?: string;
+  /**
+   * Optional inline contents for the source.
+   * Used when the source is provided directly rather than downloaded from a URL.
+   */
+  contents?: string;
   /** The destination directory within the build environment where the source will be placed. */
   dest: string;
   /** Optional name for the downloaded file. If not provided, the name is derived from the URL. */
@@ -159,15 +164,20 @@ export async function npmPkgToFlatpakData(pkg: Pkg): Promise<FlatpakData[]> {
   //url: https://registry.npmjs.org/@napi-rs/cli/-/cli-2.18.4.tgz
   //npmPkgs;
   const metaUrl = `https://registry.npmjs.org/${pkg.module}`;
-  const metaText = await fetch(metaUrl).then(
-    (r) => r.text(),
+  const meta = await fetch(metaUrl).then(
+    (r) => r.json(),
   );
-  const meta = JSON.parse(metaText);
 
+  // "registry.json" file is a stateful file, its always updated so it will never have the same hash for ever
+  // the workaround is to snapshot it by inlining its content as a string, though we do some optimization here to reduce its size
+  // by only taking the necessary fields
   const metaData = {
-    type: "file",
-    url: metaUrl,
-    sha256: await sha256(metaText),
+    type: "inline",
+    contents: JSON.stringify({
+      name: meta.name,
+      "dist-tags": {},
+      versions: { [pkg.version]: meta.versions[pkg.version] },
+    }),
     dest: `deno_dir/npm/registry.npmjs.org/${pkg.module}`,
     "dest-filename": "registry.json",
   };

deno/tests/main.test.ts

@@ -1,6 +1,6 @@
 // LICENSE = MIT
 // deno-lint-ignore-file require-await
-import { assertEquals, assertMatch } from "jsr:@std/[email protected]";
+import { assert, assertEquals, assertMatch } from "jsr:@std/[email protected]";
 import { jsrPkgToFlatpakData, npmPkgToFlatpakData } from "../src/main.ts";
 
 Deno.test("jsrPkgToFlatpakData returns correct flatpak data", async () => {
@@ -90,7 +90,7 @@ Deno.test("jsrPkgToFlatpakData returns correct flatpak data", async () => {
 
 Deno.test("npmPkgToFlatpakData returns correct flatpak data", async () => {
   // Mock fetch for npm meta
-  const metaJson = JSON.stringify({
+  const metaJson = {
     versions: {
       "2.18.4": {
         dist: {
@@ -99,7 +99,7 @@ Deno.test("npmPkgToFlatpakData returns correct flatpak data", async () => {
         },
       },
     },
-  });
+  };
 
   const origFetch = globalThis.fetch;
   Object.defineProperty(globalThis, "fetch", {
@@ -113,7 +113,7 @@ Deno.test("npmPkgToFlatpakData returns correct flatpak data", async () => {
         : (input as Request).url;
       if (url === "https://registry.npmjs.org/@napi-rs/cli") {
         return {
-          text: async () => metaJson,
+          json: async () => metaJson,
         } as Response;
       }
       throw new Error("Unexpected fetch url: " + url);
@@ -139,7 +139,9 @@ Deno.test("npmPkgToFlatpakData returns correct flatpak data", async () => {
   assertEquals(data.length, 2);
 
   // registry.json
-  assertEquals(data[0].url, "https://registry.npmjs.org/@napi-rs/cli");
+  const registryContents = data.at(0)?.contents;
+  assert(registryContents !== undefined);
+  assert("2.18.4" in JSON.parse(registryContents).versions);
   assertEquals(data[0]["dest-filename"], "registry.json");
 
   // archive