codeconsole commented on PR #16142: URL: https://github.com/apache/grails-core/pull/16142#issuecomment-5386585919
You're right, and my claim was wrong — thanks for the correction. I traced it: the M5 jar's `LAST_MODIFIED = 1785699288000` is exactly commit `3d129b7140` (2026-08-02 19:34:48 UTC), not a build wall-clock time. `release.yml:70-72` derives `SOURCE_DATE_EPOCH` from `git log -1 --pretty=%ct` and touches every file to it before building, and `verify-reproducible.sh:50` replays the same epoch from the published `BUILD_DATE`. So M5 is byte-reproducible and release verification is not affected by this. I'd read that script looking for GSP exclusions and missed the normalization a few lines above. I've corrected the PR description. What the change still buys is the build-cache side, which is where #16132's measurement came from: the mtime normalization is release-only, so ordinary CI runs and developer clones still produce differing `gsp-classes`, and every task downstream of those jars re-keys. A checksum also means the GSP case no longer depends on that normalization being applied. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
