jamesfredley commented on PR #15624:
URL: https://github.com/apache/grails-core/pull/15624#issuecomment-4364411681
### Clarification: relationship to PR #15614
To preempt a likely review question: **PR #15614's
`projectPath`-into-UUID-seed fix was already merged and active when v8.0.0-M1
was tagged**, yet the 9 jars still failed reproducibility. Verified by checking
the `SbomPlugin.groovy` content at the `v8.0.0-M1` tag (commit `6b7c015`):
```groovy
def uuidSeed = "${projectPath}\n${withoutSerial}"
def uuid = UUID.nameUUIDFromBytes(uuidSeed.getBytes(StandardCharsets.UTF_8))
```
**The two fixes address different problems:**
| | What it fixes |
|---|---|
| #15614 | `serialNumber` *collisions* between distinct modules whose
post-processed BOM content happens to be identical |
| This PR | The *same module* having different BOM content between CI and
local rebuilds, because `cyclonedx-gradle-plugin` v3.0.0 auto-injects an
`externalReferences[type=build-system]` entry only when CI env vars are set |
Concretely, for v8.0.0-M1's `grails-async-8.0.0-M1.jar`:
- CI build: BOM had 5 externalRefs including `build-system:
https://github.com/apache/grails-core/actions/runs/25254902009` → UUID
`c4fdb31...`
- Local rebuild: BOM had 4 externalRefs (no `build-system`) → UUID
`2ce9328...`
`projectPath` was the same in both. The deterministic hash worked correctly.
The inputs were genuinely different, so the outputs were correctly different.
Stripping `build-system` from the BOM *before* the hash recompute (this PR) is
what makes the inputs match.
I've kept #15614's `projectPath`-mixing intact in the new shared
`rewriteSbomFile` helper so both improvements are active.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
