[
https://issues.apache.org/jira/browse/RATIS-2639?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101605#comment-18101605
]
Attila Doroszlai commented on RATIS-2639:
-----------------------------------------
reproducible-central's {{rebuild.sh}} uses an environment that matches the
release manager's environment in key aspects:
- OS: Linux
- JDK: 8, Zulu build
- umask: 022
- fresh local Maven repo
- no local Develocity build cache
To create such an environment without reproducible-central's help, I did the
following on Linux:
# install Zulu 8 JDK (see https://docs.azul.com/core/install/linux-ca-deb)
# set umask 022 and update permissions on existing files, only needed because
normally I have umask 077
{code}
umask 022
chmod -R a+rX ~/.m2/repository
{code}
# delete cached RC1 artifacts, only needed for RC2+
{code}
find ~/.m2/repository/org/apache/ratis -name 3.3.0 | xargs rm -fr
{code}
Then the command to verify the staging repo created by release manager with
local build from Git repo:
{code}
$ git clone https://github.com/apache/ratis.git git
$ cd git
$ export JAVA_HOME=/usr/lib/jvm/zulu8
$ ./mvnw -Prelease clean package -DskipTests -Dmaven.javadoc.skip -Dgpg.skip \
-Ddevelocity.cache.local.enabled=false \
artifact:compare
-Dreference.repo=https://repository.apache.org/content/repositories/staging/
...
[INFO] [Reproducible Builds] rebuild comparison result: 127 files match
...
[INFO] BUILD SUCCESS
{code}
Finally we can verify the release artifact tarballs I had downloaded to
{{3.3.0-rc2}}:
{code}
$ cd ..
$ diff --report-identical-files
git/ratis-assembly/target/ratis-assembly-3.3.0-bin.tar.gz
3.3.0-rc2/apache-ratis-3.3.0-bin.tar.gz
Files git/ratis-assembly/target/ratis-assembly-3.3.0-bin.tar.gz and
3.3.0-rc2/apache-ratis-3.3.0-bin.tar.gz are identical
$ diff --report-identical-files
git/ratis-assembly/target/ratis-assembly-3.3.0-src.tar.gz
3.3.0-rc2/apache-ratis-3.3.0-src.tar.gz
Files git/ratis-assembly/target/ratis-assembly-3.3.0-src.tar.gz and
3.3.0-rc2/apache-ratis-3.3.0-src.tar.gz are identical
{code}
----
With standard OpenJDK 8, cyclonedx files would have fewer checksums, which
would then also affect the binary tarball's content, e.g.:
{code}
--- target/reference/org.apache.ratis/ratis-3.3.0-cyclonedx.xml 2026-08-04
08:18:13.413753703 +0200
+++ target/bom.xml 2026-08-04 08:18:13.141141067 +0200
@@ -20,9 +20,6 @@
<hash
alg="SHA-256">d9e5a12bac3c1a91d85f3a1ad84307099f457ff24aa65b438ba7de9ca784a54e</hash>
<hash
alg="SHA-512">636f788518752c5a23d14bad41d68b0d549e4b3a3d720d66f2f6e2b8b956207942ee12abba968a1e9aac6cf1d78d9e738a4a75eeb8bc6fca2377030fbb482407</hash>
<hash
alg="SHA-384">72aad41633b92fadd4dbd1c6f5c1b956836b22d3b96afbdd7ca8b8eb0456eec00c2ed658e3c2d4e93d95048bcc23dac8</hash>
- <hash
alg="SHA3-384">9837cee0f9b7d575f8d88df3ad6f58a075032ad2635e0987abbc102240327f1cec87dc062b3034009f028ab5baf988f9</hash>
- <hash
alg="SHA3-256">4c654267cde6eb6d295dbc06b33e33528412bee57549dae89c85b8df8202dbcb</hash>
- <hash
alg="SHA3-512">f7da73632ef2fd1c2d85f0cf5eebc2b6a3ff1ae2ed0945442e679da71490562a2ff6b67422dbd5285f4042eda6637e6f3544f62825a625b38efacfdebc8df137</hash>
</hashes>
</component>
</components>
{code}
> Make release .tar.gz files reproducible.
> ----------------------------------------
>
> Key: RATIS-2639
> URL: https://issues.apache.org/jira/browse/RATIS-2639
> Project: Ratis
> Issue Type: Improvement
> Components: build
> Reporter: Tsz-wo Sze
> Priority: Major
> Attachments: image-2026-08-03-11-26-40-659.png
>
>
> Currently, the [src|bin].tar.gz files generated by ./dev-support/make_rc.sh
> are not reproducible. According to Google, it is due to file ordering and
> metadata such user id. These problem can be fixed; see below:
> !image-2026-08-03-11-26-40-659.png|width=600!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
