Yes, I assume that it's because they didn't use option-with-swf, but they're comparing to a version that did.
I don't really know why sources JARs are uploaded, or whether they're supposed to be reproducible or not. -- Josh Tynjala Bowler Hat LLC <https://bowlerhat.dev> On Sun, Jun 18, 2023 at 1:25 AM Yishay Weiss <yishayj...@hotmail.com> wrote: > >1) It looks like they built without playerglobal.swc, but they are > comparing to a build that used playerglobal.swc > > Is that because they didn't use the option-with-swf option? > > >2) The emitHeader() method in JBurgGenerator adds the current date to a > comment: > > I looked at the validation script in compiler/releasesteps.xml and it > looks like there is no comparison of sources.jar, which is what they tested > for (namely compiler-0.9.10-sources.jar). Only binary jars get validated. > > Are *sources jars uploaded solely for debugging convenience? If so, can we > say that those should not be tested for reproducibility? > > > ________________________________ > From: Josh Tynjala <joshtynj...@bowlerhat.dev> > Sent: Thursday, June 15, 2023 7:13 PM > To: dev@royale.apache.org <dev@royale.apache.org> > Subject: Re: Adding Royale Compiler to reproducible-central > > A couple of obvious things that I see right away: > > 1) It looks like they built without playerglobal.swc, but they are > comparing to a build that used playerglobal.swc. > > 2) The emitHeader() method in JBurgGenerator adds the current date to a > comment: > > > https://github.com/apache/royale-compiler/blob/apache-royale-0.9.10/compiler-jburg-types/src/main/java/jburg/burg/JBurgGenerator.java#L1048-L1053 > > To make it reproducible, this should either use a fixed date passed in as > part of the build, or the generated comment shouldn't include the date at > all. > > -- > Josh Tynjala > Bowler Hat LLC <https://bowlerhat.dev> > > > On Thu, Jun 15, 2023 at 12:31 AM Yishay Weiss <yishayj...@hotmail.com> > wrote: > > > Hi, > > > > There's been a lot of talk recently on ASF's members channel regarding > > reproducible builds, which has brought me to this repo [1] which lists > > known reproducible artifacts. I've opened a ticket [2] requesting our > > compiler be added and have received a report of some differences in > > binaries. > > > > Does anyone want to take a look? > > > > Thanks, > > Yishay > > > > [1] jvm-repo-rebuild/reproducible-central: Reproducible Central: rebuild > > instructions for artifacts published to (Maven) Central Repository ( > > github.com)<https://github.com/jvm-repo-rebuild/reproducible-central> > > [2] Add org.apache.royale · Issue #117 · > > jvm-repo-rebuild/reproducible-central (github.com)< > > https://github.com/jvm-repo-rebuild/reproducible-central/issues/117> > > >
