+1 [INFO] Comparing against 7 reference files from staging (https://repository.apache.org/content/groups/staging/, default, releases+snapshots) [INFO] reference build java.version: 21 (from MANIFEST.MF Build-Jdk-Spec) [INFO] reference build os.name: Unix (from pom.properties newline) [ERROR] size mismatch maven-jar-plugin-4.0.0-beta-2-cyclonedx.xml: investigate with diffoscope target/reference/org.apache.maven.plugins/maven-jar-plugin-4.0.0-beta-2-cyclonedx.xml target/bom.xml [ERROR] size mismatch maven-jar-plugin-4.0.0-beta-2-cyclonedx.json: investigate with diffoscope target/reference/org.apache.maven.plugins/maven-jar-plugin-4.0.0-beta-2-cyclonedx.json target/bom.json [ERROR] [Reproducible Builds] rebuild comparison result: 5 files match, 2 differ
Build was done with 4.0.0-RC-7 (impacts published build/consumer poms) the small differences in the Cyclone are strange: it's the license and external references metadata for maven-archiver 4.0.0-beta-6 I'd love to understand how the rebuild got a different result than the initial build: I'll try to investigate but this issue is not worth rejecting the release Le mardi 13 octobre 2026, 21:31:29 heure d’été d’Europe centrale [email protected] a écrit : > To: [email protected] > Subject: [VOTE] Release Apache Maven JAR Plugin version 4.0.0-beta-2 > > Hello Maven, > > I'd like to call a vote on releasing the following artifacts as Apache Maven > JAR Plugin 4.0.0-beta-2. > > The release candidate page, including downloads, can be found at: > https://releases.apache.org/vote/maven-jar-plugin/4.0.0-beta-2 > > The release artifacts are signed with one or more OpenPGP keys from: > https://downloads.apache.org/maven/KEYS > > Release notes: > https://gist.github.com/gnodet/94b71521d8370a2e62aef0d100b2e0b9 > > Staging repo: > https://repository.apache.org/content/repositories/maven-2489/ > https://repository.apache.org/content/repositories/maven-2489/org/apache/mav > en/plugins/maven-jar-plugin/4.0.0-beta-2/maven-jar-plugin-4.0.0-beta-2-sourc > e-release.zip > > Source release checksum(s): > maven-jar-plugin-4.0.0-beta-2-source-release.zip sha512: > c9de315167bbb67461e93d77c148cee7f2e51aefe8d3163cb75a2a5bc4dcf2c22f24f41c908 > 4289ad43d785f2f5bd8fe3276737364e3525b8d9ad720104152e7 > > Staging site: > https://maven.apache.org/plugins-archives/maven-jar-plugin-4.0.0-beta-2/ > > Guide to testing staged releases: > https://maven.apache.org/guides/development/guide-testing-releases.html > > Please review the release candidate and vote accordingly. > > [ ] +1 Release this package > [ ] +0 Abstain > [ ] -1 Do not release this package (please provide specific comments) > > You can vote on ATR at the URL above, or manually by replying to this email. > > The vote is open for 72 hours. > > Thanks, > gnodet > > This email was sent by [email protected] on the Apache Trusted Releases > platform > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
