[
https://issues.apache.org/jira/browse/FLINK-40460?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18112156#comment-18112156
]
Xinyao Zhang commented on FLINK-40460:
--------------------------------------
Hi, I’d like to take this. I’ll first reproduce the build-plan check, then
update the archive-producing plugin pins to the reproducible-capable versions
described here and handle the four jar-plugin compatibility sites in the same
focused change. I’ll keep the broader byte-for-byte reproducibility blockers
out of scope.
> Upgrade archive-producing Maven plugins to reproducible-capable versions
> ------------------------------------------------------------------------
>
> Key: FLINK-40460
> URL: https://issues.apache.org/jira/browse/FLINK-40460
> Project: Flink
> Issue Type: Improvement
> Components: Build System
> Reporter: Martijn Visser
> Priority: Major
>
> Flink inherits {{project.build.outputTimestamp=2025-06-09T20:48:22Z}} from
> Apache
> Parent POM 35, which should put every archive-producing plugin into
> maven-archiver's reproducible mode. It has no effect today, because Flink pins
> several of those plugins to versions that predate that support.
> {{mvn org.apache.maven.plugins:maven-artifact-plugin:3.6.0:check-buildplan}}
> currently fails in 173 of 173 modules:
> ||Plugin||Pinned||Minimum required||Modules affected||
> |maven-remote-resources-plugin|3.2.0|3.3.0|173|
> |maven-jar-plugin|2.4|3.2.0|149|
> |maven-assembly-plugin|2.4|3.2.0|2|
> |maven-archetype-plugin|2.2|3.2.0|3|
> Every one of these pins carries a {{$NO-MVN-MAN-VER$}} marker (an Eclipse m2e
> warning suppressor), which is why the staleness has gone unnoticed.
> Proposal: drop the pins where Apache Parent 35 already manages a
> reproducible-capable version (jar 3.4.2, remote-resources 3.3.0, assembly
> 3.7.1), and bump maven-archetype-plugin together with the archetype-packaging
> extension to 3.4.1, which the parent does not manage.
> maven-jar-plugin 3.x additionally rejects a classifier-less {{jar}} execution
> that would replace the main artifact ("You have to use a classifier to attach
> supplemental artifacts to the project instead of replacing them"), which 2.4
> tolerated silently. Four modules depend on the old behaviour and have to be
> adjusted in the same change:
> * flink-s3-fs-hadoop, flink-s3-fs-presto, flink-dist: redundant id-less
> {{jar}}
> executions. The {{Multi-Release: true}} entry they appear to exist for comes
> from the plugin-level {{<configuration>}} and survives their removal.
> * flink-runtime-web: five executions building manifest-only test fixtures.
> Ported to maven-assembly-plugin with {{{}<attach>false</attach>{}}}, matching
> the
> existing convention in flink-clients and flink-tests. A classifier is not an
> option: jar-plugin 3.x has no {{attach}} parameter, and a classifier would
> change the filenames the tests resolve and publish five test artifacts.
> Note this changes the manifest of all published jars:
> {{{}Archiver-Version{}}},
> {{Built-By}} and {{Implementation-Vendor-Id}} are dropped, {{Created-By}}
> names
> the plugin rather than the building machine's Maven, {{Build-Jdk}} becomes
> {{{}Build-Jdk-Spec{}}}, and {{Specification-Version}} becomes {{2.4}} rather
> than
> {{{}2.4-SNAPSHOT{}}}. Nothing in the repository reads these attributes.
> Out of scope, as follow-ups:
> * maven-source-plugin 3.2.1 -> parent-managed 3.3.1, maven-deploy-plugin 2.4,
> maven-clean-plugin 2.5. None produce archives, so check-buildplan passes
> without them.
> * maven-release-plugin 2.1 -> 3.x, which is what maintains outputTimestamp
> per
> release.
> * Byte-for-byte reproducibility itself remains blocked by shade's
> ApacheNoticeResourceTransformer writing a build-time-stamped aggregated
> META-INF/NOTICE, cyclonedx SBOMs, the flink-runtime-web npm/webpack bundle,
> Scala compilation, and the {{tar czf}} in
> tools/releasing/create_binary_release.sh. This ticket only makes the build
> plan pass the static check.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
