[
https://issues.apache.org/jira/browse/MJAR-275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17221760#comment-17221760
]
Michael Osipov commented on MJAR-275:
-------------------------------------
I have even more bad news. The {{module-info.class}} is not even reproducible
within the same major JDK version. I have produced it with 11 and 14:
{noformat}
00000000: cafe babe 0000 0037 000f 0100 0b6d 6f64 .......7.....mod
│ 00000010: 756c 652d 696e 666f 0700 0101 0010 6d6f ule-info......mo
│ 00000020: 6475 6c65 2d69 6e66 6f2e 6a61 7661 0100 dule-info.java..
│ 00000030: 146d 652e 6132 3438 2e6d 636f 6d70 696c .me.a248.mcompil
│ 00000040: 6572 3433 3913 0004 0100 0e30 2e31 2e30 er439......0.1.0
│ -00000050: 2d53 4e41 5053 484f 5401 000e 4d6f 6475 -SNAPSHOT...Modu
│ -00000060: 6c65 5061 636b 6167 6573 0100 146d 652f lePackages...me/
│ -00000070: 6132 3438 2f6d 636f 6d70 696c 6572 3433 a248/mcompiler43
│ -00000080: 3914 0008 0100 096a 6176 612e 6261 7365 9......java.base
│ -00000090: 1300 0a01 0006 3131 2e30 2e38 0100 0a53 ......11.0.8...S
│ -000000a0: 6f75 7263 6546 696c 6501 0006 4d6f 6475 ourceFile...Modu
│ -000000b0: 6c65 8000 0002 0000 0000 0000 0000 0003 le..............
│ -000000c0: 000d 0000 0002 0003 000e 0000 001c 0005 ................
│ -000000d0: 0000 0006 0001 000b 8000 000c 0001 0009 ................
│ -000000e0: 0000 0000 0000 0000 0000 0007 0000 0004 ................
│ -000000f0: 0001 0009 ....
│ +00000050: 2d53 4e41 5053 484f 5401 0014 6d65 2f61 -SNAPSHOT...me/a
│ +00000060: 3234 382f 6d63 6f6d 7069 6c65 7234 3339 248/mcompiler439
│ +00000070: 1400 0701 0009 6a61 7661 2e62 6173 6513 ......java.base.
│ +00000080: 0009 0100 0631 342e 302e 3201 000a 536f .....14.0.2...So
│ +00000090: 7572 6365 4669 6c65 0100 064d 6f64 756c urceFile...Modul
│ +000000a0: 6501 000e 4d6f 6475 6c65 5061 636b 6167 e...ModulePackag
│ +000000b0: 6573 8000 0002 0000 0000 0000 0000 0003 es..............
│ +000000c0: 000c 0000 0002 0003 000d 0000 001c 0005 ................
│ +000000d0: 0000 0006 0001 000a 8000 000b 0001 0008 ................
│ +000000e0: 0000 0000 0000 0000 0000 000e 0000 0004 ................
│ +000000f0: 0001 0008 ....
{noformat}
As you can see {{java.version}} is embedded into the file meaning you cannot
reproduce with the next patch version.
> outputTimestamp not applied to module-info; breaks reproducible builds
> ----------------------------------------------------------------------
>
> Key: MJAR-275
> URL: https://issues.apache.org/jira/browse/MJAR-275
> Project: Maven JAR Plugin
> Issue Type: Bug
> Affects Versions: 3.2.0
> Environment: Mac OS X 10.14.6
> JDK 15 (build 15+36)
> JDK 11 (build 11.0.8+10)
> Reporter: Anand Beh
> Priority: Minor
> Attachments: MCOMPILER-439.zip, Screenshot 2020-10-25 at 2.35.59
> PM.png
>
>
> Setting {{project.build.outputTimestamp}} to a fixed value allows creating
> reproducible builds per this guide:
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> |https://maven.apache.org/guides/mini/guide-reproducible-builds.html]However,
> if one adds a module-info file to the project, reproducible builds break.
> This is caused by module-info.class using the latest timestamp and not
> {{project.build.outputTimestamp}}. I was able to identify the problem using
> diffoscope: [https://diffoscope.org/.|https://diffoscope.org/] With it I
> determined the timestamp across 2 builds was constant for all but the
> module-info.class:
>
> {code:java}
> -rw---- 2.0 fat 862 bl defN 20-Oct-17 00:40
> space/arim/libertybans/api/select/SelectionOrder.class
> │ -rw---- 2.0 fat 1113 bl defN 20-Oct-17 00:40
> space/arim/libertybans/api/select/SelectionOrderBuilder.class
> │ -rw---- 2.0 fat 2285 bl defN 20-Oct-17 00:40
> META-INF/maven/space.arim.libertybans/bans-api/pom.xml
> │ -rw---- 2.0 fat 74 bl defN 20-Oct-17 00:40
> META-INF/maven/space.arim.libertybans/bans-api/pom.properties
> │ --rw---- 2.0 fat 557 bl defN 20-Oct-25 12:39 module-info.class
> │ +-rw---- 2.0 fat 557 bl defN 20-Oct-25 12:41 module-info.class
> {code}
>
> Note the + and - which are diffoscope's way of indicating the difference
> between the .jar files. Here the {{project.build.outputTimestamp}} is on 17
> October. As shown, module-info has a "rebellious" timestamp.
>
> *EDIT:*
> Example project to reproduce the bug:
> [https://github.com/A248/MCOMPILER-439]
> (Source code is also provided as an attachment)
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
