[
https://issues.apache.org/jira/browse/FELIX-6203?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17092019#comment-17092019
]
Herve Boutemy commented on FELIX-6203:
--------------------------------------
as a real world case to check bundle output jar reproducibility, one can build
Maven Indexer: https://github.com/apache/maven-indexer that has indexer-reader
with packaging=bundle
you'll see in
[pom.xml|https://github.com/apache/maven-indexer/blob/master/indexer-reader/pom.xml#L53]
that I configured {{<_removeheaders>Bnd-LastModified</_removeheaders>}} to
avoid one source of non-reproducibility
using [Maven Reproducibility
guide|https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-to-test-and-fix-my-maven-build-reproducibility]
to rebuild 2 times and compare using buildinfo plugin, you'll see that the
current result has 2 sources of non-reproducibility:
- this timestamp in MANIFEST.MF
- jar entries timestamp
And there is some hidden source of non-reproducibility: generated
META-INF/MANIFEST.MF contains
- Build-Jdk: 1.8.0_202
- Built-By: herve
there are multiple issues that will require to be fixed
> Make bundleplugin pom.proterties reproducible
> ---------------------------------------------
>
> Key: FELIX-6203
> URL: https://issues.apache.org/jira/browse/FELIX-6203
> Project: Felix
> Issue Type: Improvement
> Components: Maven Bundle Plugin
> Reporter: Bernhard M. Wiedemann
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> For reproducible builds, we want to be able to produce the same results from
> the same inputs.
> However the pom.properties file generted by maven-plugin-bundle varied across
> builds, because it contains a timestamp.
> [https://github.com/apache/felix/pull/209] fixes this for us.
> The alternative approach would be to drop the timestamp, if it is not needed.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
