I am confused. The package-lock.json is generated by the packager and follows the procedure outlined in https://github.com/openSUSE/obs-service-node_modules How can it differ between reproducible builds of the same package version?