matrei commented on PR #16142:
URL: https://github.com/apache/grails-core/pull/16142#issuecomment-5384955659
> > Wasn't `8.0.0-M5` verified as fully reproducible?
>
> @matrei I checked the published artifact rather than guess.
`grails-fields-8.0.0-M5.jar` contains precompiled GSP classes, and one of them
decompiles to:
>
> ```
> public static final long LAST_MODIFIED = 1785699288000l;
> ```
>
> That decodes to 2026-08-02 19:34:48 UTC — the wall-clock time of the
release builder's checkout. Anyone rebuilding from their own checkout gets a
different value in that constant, so the class bytes and therefore the jar
differ.
>
> So M5 is not byte-reproducible for the jars carrying precompiled GSPs.
Either the verification didn't cover those, or the diff was put down to the
platform note in `RELEASE.md` ("Grails is officially built on Linux so if there
are differences they may be due to the OS platform"). Worth re-checking against
M5 if you want independent confirmation — `grails-fields` and
`grails-spring-security` are the ones to look at.
@codeconsole The release workflow creates a BUILD_DATE file and sets that
date on all the files before building. The date stored in that file is then
used in the verification script when building the jars again before comparing
the checksums.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
