[jira] [Updated] (MSHARED-992) maven-shared-components uses commons-io 2.5 which is vulnerable
[
https://issues.apache.org/jira/browse/MSHARED-992?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dwayne E Culbertson updated MSHARED-992:
Description:
Note: This vulnerability has been assigned CVE-2021-29425.
h4. ADVISORIES
Project:[https://github.com/apache/commons-io/pull/52]
Project:https://issues.apache.org/jira/browse/IO-556
Project:https://issues.apache.org/jira/browse/IO-559
was:
h4. EXPLANATION
The {{commons-io}} package is vulnerable to Path Traversal. The
{{getPrefixLength}} method in {{FilenameUtils.class}} improperly verifies the
hostname value received from user input before processing client requests. An
attacker could abuse this behavior by crafting a special payload containing
unexpected characters that could allow the access to unintended resources.
Note: This vulnerability has been assigned CVE-2021-29425.
h4. DETECTION
The application is vulnerable by using this component.
h4. RECOMMENDATION
We recommend upgrading to a version of this component that is not vulnerable to
this specific issue.
Note: If this component is included as a bundled/transitive dependency of
another component, there may not be an upgrade path. In this instance, we
recommend contacting the maintainers who included the vulnerable package.
Alternatively, we recommend investigating alternative components or a potential
mitigating control.
h4. ROOT CAUSE
apache-maven-3.8.1-bin.tar.gzapache-maven-3.8.1/lib/commons-io-2.5.jarorg/apache/commons/io/FilenameUtils.class[1.1
, 2.7-SNAPSHOT)
h4. ADVISORIES
Project:[https://github.com/apache/commons-io/pull/52]
Project:https://issues.apache.org/jira/browse/IO-556
Project:https://issues.apache.org/jira/browse/IO-559
h4. CVSS DETAILS
Sonatype CVSS 3:7.8
CVSS Vector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary: maven-shared-components uses commons-io 2.5 which is
vulnerable (was: maven-shared-components uses commons-io 2.5 which is
vulnerable to sonatype-2018-0705)
> maven-shared-components uses commons-io 2.5 which is vulnerable
> ---
>
> Key: MSHARED-992
> URL: https://issues.apache.org/jira/browse/MSHARED-992
> Project: Maven Shared Components
> Issue Type: Bug
>Reporter: Dwayne E Culbertson
>Priority: Major
> Labels: Security
>
>
> Note: This vulnerability has been assigned CVE-2021-29425.
> h4. ADVISORIES
> Project:[https://github.com/apache/commons-io/pull/52]
> Project:https://issues.apache.org/jira/browse/IO-556
> Project:https://issues.apache.org/jira/browse/IO-559
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Updated] (MNG-7168) maven-shared-utils package is vulnerable to Command Injection
[
https://issues.apache.org/jira/browse/MNG-7168?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dwayne E Culbertson updated MNG-7168:
-
Description:
Project:[https://github.com/apache/maven-shared-utils/pull/40]
Project:https://issues.apache.org/jira/browse/MSHARED-297
was:
h4. EXPLANATION
The {{maven-shared-utils}} package is vulnerable to Command Injection. The
constructor and {{unifyQuotes()}} method in the {{BourneShell}} class and the
{{getRawCommandLine()}} and {{getShellCommandLine()}} methods in the {{Shell}}
class fail to escape double-quoted arguments emitted from {{Commandline}}. A
remote attacker can exploit this behavior to execute arbitrary commands by
supplying a combination of shell metacharacters and commands via any affected
input parameter.
h4. DETECTION
The application is vulnerable by using this component.
h4. RECOMMENDATION
We recommend upgrading to a version of this component that is not vulnerable to
this specific issue.
Note: If this component is included as a bundled/transitive dependency of
another component, there may not be an upgrade path. In this instance, we
recommend contacting the maintainers who included the vulnerable package.
Alternatively, we recommend investigating alternative components or a potential
mitigating control.
h4. ROOT CAUSE
apache-maven-3.8.1-bin.zipapache-maven-3.8.1/lib/maven-shared-utils-3.2.1.jarorg/apache/maven/shared/utils/cli/shell/Shell.class(
, 3.3.3)
h4. ADVISORIES
Project:[https://github.com/apache/maven-shared-utils/pull/40]
Project:https://issues.apache.org/jira/browse/MSHARED-297
h4. CVSS DETAILS
Sonatype CVSS 3:9.8
CVSS Vector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary: maven-shared-utils package is vulnerable to Command Injection
(was: SONATYPE-2020-0491)
> maven-shared-utils package is vulnerable to Command Injection
> -
>
> Key: MNG-7168
> URL: https://issues.apache.org/jira/browse/MNG-7168
> Project: Maven
> Issue Type: Bug
>Reporter: Dwayne E Culbertson
>Priority: Major
> Labels: Security
>
>
> Project:[https://github.com/apache/maven-shared-utils/pull/40]
> Project:https://issues.apache.org/jira/browse/MSHARED-297
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Closed] (MINDEXER-127) Maven repository indexing error: java.nio.channels.OverlappingFileLockException
[ https://issues.apache.org/jira/browse/MINDEXER-127?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Sylwester Lachiewicz closed MINDEXER-127. - Resolution: Fixed > Maven repository indexing error: > java.nio.channels.OverlappingFileLockException > --- > > Key: MINDEXER-127 > URL: https://issues.apache.org/jira/browse/MINDEXER-127 > Project: Maven Indexer > Issue Type: Bug >Affects Versions: 6.0.0 >Reporter: Victor Rubezhny >Assignee: Sylwester Lachiewicz >Priority: Major > Fix For: 6.0.1 > > > The `openAndWarmup()` method is invoked twice from `purge()` method of > `org.apache.maven.index.context.DefaultIndexingContext` which results into > `OverlappingFileLockException` during the index re-indexing, because the > `openAndWarmup()` method call creates a `FileLock` for an index and the > second call tries to create and add the second `FileLock` for the same index > which is erroneous: > ``` > java.nio.channels.OverlappingFileLockException > at java.base/sun.nio.ch.FileLockTable.checkList(FileLockTable.java:229) > at java.base/sun.nio.ch.FileLockTable.add(FileLockTable.java:123) > at java.base/sun.nio.ch.FileChannelImpl.tryLock(FileChannelImpl.java:1154) > at java.base/java.nio.channels.FileChannel.tryLock(FileChannel.java:1165) > at > org.apache.maven.index.context.DefaultIndexingContext.unlockForcibly(DefaultIndexingContext.java:927) > at > org.apache.maven.index.context.DefaultIndexingContext.prepareIndex(DefaultIndexingContext.java:244) > at > org.apache.maven.index.context.DefaultIndexingContext.purge(DefaultIndexingContext.java:612) > at > org.eclipse.m2e.core.internal.index.nexus.NexusIndexManager.purgeCurrentIndex(NexusIndexManager.java:529) > at > org.eclipse.m2e.core.internal.index.nexus.NexusIndexManager.reindexWorkspace(NexusIndexManager.java:561) > at > org.eclipse.m2e.core.internal.index.nexus.NexusIndexManager.updateIndex(NexusIndexManager.java:1072) > at > org.eclipse.m2e.core.internal.index.nexus.NexusIndex.updateIndex(NexusIndex.java:147) > at > org.eclipse.m2e.core.ui.internal.preferences.MavenSettingsPreferencePage$2.runInWorkspace(MavenSettingsPreferencePage.java:263) > at > org.eclipse.core.internal.resources.InternalWorkspaceJob.run(InternalWorkspaceJob.java:42) > at org.eclipse.core.internal.jobs.Worker.run(Worker.java:63) > ``` > The referencing issue is reported at: > https://github.com/eclipse-m2e/m2e-core/issues/169 -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Commented] (MJAVADOC-681) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MJAVADOC-681?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361822#comment-17361822
]
Michael Osipov commented on MJAVADOC-681:
-
Maybe we can reconvince him referencing this issue?!
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MJAVADOC-681
> URL: https://issues.apache.org/jira/browse/MJAVADOC-681
> Project: Maven Javadoc Plugin
> Issue Type: Bug
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MJAVADOC-681) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MJAVADOC-681?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361805#comment-17361805
]
Robert Scholte commented on MJAVADOC-681:
-
Ah, I didn't recognize ... as a timestamp. In that case: build is indeed
non-reproducible. Jonathan says it has been fixed in JDK14, it seems there's no
intention to backport it.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MJAVADOC-681
> URL: https://issues.apache.org/jira/browse/MJAVADOC-681
> Project: Maven Javadoc Plugin
> Issue Type: Bug
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Comment Edited] (MJAVADOC-681) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MJAVADOC-681?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361802#comment-17361802
]
Piotr Zygielo edited comment on MJAVADOC-681 at 6/11/21, 1:59 PM:
--
{quote}AFAIK to have reproducible builds, you're already forced to use the same
JDK, so I'm not sure if creating/reopening an issue makes sense.
{quote}
I don't understand.
Problem is that using the same JDK (11-13) even on the same machine will
result in different index.html (in the part "on ...").
was (Author: pzygielo):
bq. AFAIK to have reproducible builds, you're already forced to use the same
JDK, so I'm not sure if creating/reopening an issue makes sense.
I don't understand.
Problem is that using the same JDK (11-13) even on the same machine will result
in different index.html.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MJAVADOC-681
> URL: https://issues.apache.org/jira/browse/MJAVADOC-681
> Project: Maven Javadoc Plugin
> Issue Type: Bug
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MJAVADOC-681) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MJAVADOC-681?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361802#comment-17361802
]
Piotr Zygielo commented on MJAVADOC-681:
bq. AFAIK to have reproducible builds, you're already forced to use the same
JDK, so I'm not sure if creating/reopening an issue makes sense.
I don't understand.
Problem is that using the same JDK (11-13) even on the same machine will result
in different index.html.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MJAVADOC-681
> URL: https://issues.apache.org/jira/browse/MJAVADOC-681
> Project: Maven Javadoc Plugin
> Issue Type: Bug
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MJAVADOC-681) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MJAVADOC-681?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361797#comment-17361797
]
Pavel Varchenko commented on MJAVADOC-681:
--
I'll try to create a pull request via github. I'm interested in contribution
process. I've read contribution guide vi HG and understand nothing =)
https://wiki.openjdk.java.net/display/JDKUpdates/JDK11u
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MJAVADOC-681
> URL: https://issues.apache.org/jira/browse/MJAVADOC-681
> Project: Maven Javadoc Plugin
> Issue Type: Bug
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MJAVADOC-681) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MJAVADOC-681?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361791#comment-17361791
]
Michael Osipov commented on MJAVADOC-681:
-
At least the javadoc would be consistent. Java 14 is irrelevant for most.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MJAVADOC-681
> URL: https://issues.apache.org/jira/browse/MJAVADOC-681
> Project: Maven Javadoc Plugin
> Issue Type: Bug
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Moved] (MJAVADOC-681) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MJAVADOC-681?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Robert Scholte moved MNG-7171 to MJAVADOC-681:
--
Key: MJAVADOC-681 (was: MNG-7171)
Affects Version/s: (was: 3.8.1)
Project: Maven Javadoc Plugin (was: Maven)
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MJAVADOC-681
> URL: https://issues.apache.org/jira/browse/MJAVADOC-681
> Project: Maven Javadoc Plugin
> Issue Type: Bug
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361772#comment-17361772
]
Robert Scholte commented on MNG-7171:
-
AFAIK to have reproducible builds, you're already forced to use the same JDK,
so I'm not sure if creating/reopening an issue makes sense.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7170) Allow to associate pomFile/${basedir} with DefaultProjectBuilder.build(ModelSource, ...)
[
https://issues.apache.org/jira/browse/MNG-7170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361756#comment-17361756
]
Mickael Istria commented on MNG-7170:
-
I've implemented a workaround:
[https://github.com/eclipse/lemminx-maven/commit/2e553da35bcc2495887f9d72209c84085ab433eb]
Feel free to close as won't fix if 3.8.2 will never happen
> Allow to associate pomFile/${basedir} with
> DefaultProjectBuilder.build(ModelSource, ...)
>
>
> Key: MNG-7170
> URL: https://issues.apache.org/jira/browse/MNG-7170
> Project: Maven
> Issue Type: Improvement
> Components: core
>Affects Versions: 3.8.1
>Reporter: Mickael Istria
>Priority: Major
>
> In LemMinX-Maven Language Server for pom.xml files, we're building models
> from "working copy" (unsaved) pom files. We do so by invoking
> {code}DefaultProjectBuilder.build( ModelSource modelSource,
> ProjectBuildingRequest request ){code}
> One pitfall is that this cascades to pomFile being null for the Model, and as
> a result {code}${basedir}{code} is not resolved.
> One could expect that the {code}ModelSource2.getLocationURI(){code} could be
> used to derive the pomFile when possible. LemMinX-Maven happens to properly
> set this.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361755#comment-17361755
]
Michael Osipov commented on MNG-7171:
-
Isn't there? Even better, I did not try, honestly.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Comment Edited] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361753#comment-17361753
]
Pavel Varchenko edited comment on MNG-7171 at 6/11/21, 1:21 PM:
What if just create a pull request here
[https://github.com/openjdk/jdk11u-dev/blob/c143b396f468963a1deacc3b57ed366e735a/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/IndexRedirectWriter.java#L80]
with change of only one line?
{{.setTimestamp(!configuration.notimestamp, false)}}
was (Author: varpa89):
What if just create a pull request here
[https://github.com/openjdk/jdk11u-dev/blob/c143b396f468963a1deacc3b57ed366e735a/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/IndexRedirectWriter.java#L80]
with change of only one line?
.setTimestamp(!configuration.notimestamp, false)
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361753#comment-17361753
]
Pavel Varchenko commented on MNG-7171:
--
What if just create a pull request here
[https://github.com/openjdk/jdk11u-dev/blob/c143b396f468963a1deacc3b57ed366e735a/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/IndexRedirectWriter.java#L80]
with change of only one line?
.setTimestamp(!configuration.notimestamp, false)
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361748#comment-17361748
]
Pavel Varchenko commented on MNG-7171:
--
Looks like it was changed here but not sure
https://github.com/openjdk/jdk14u/commit/2ace3e69e6de678d77719376dad961bdcb0d550e#diff-ac839a98e6e91aa8aba6e1b9efdfc018616306f478fc95bae067dfc44d3667d4
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Comment Edited] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361688#comment-17361688
]
Michael Osipov edited comment on MNG-7171 at 6/11/21, 12:56 PM:
Which JDK bug exactly? Robert could ask for a backport.
was (Author: michael-o):
Which JDK bug exactly? Robert could as for a backport.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361735#comment-17361735
]
Piotr Zygielo commented on MNG-7171:
[~michael-o] why do you think there is such problem in jdk8?
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361713#comment-17361713
]
Michael Osipov commented on MNG-7171:
-
Pure crap, ignorant from Oracle. [~rfscholte], can you have this JDK ticket
reopened and addresed in Java 11 and 8?
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361692#comment-17361692
]
Piotr Zygielo commented on MNG-7171:
JDK-8261784
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361688#comment-17361688
]
Michael Osipov commented on MNG-7171:
-
Which JDK bug exactly? Robert could as for a backport.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361679#comment-17361679
]
Piotr Zygielo commented on MNG-7171:
javadoc was 'fixed' in JDK14+. I doubt it would be ported back to 11 since next
LTS is planned for September.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361676#comment-17361676
]
Michael Osipov commented on MNG-7171:
-
Show diffoscope diff.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7170) Allow to associate pomFile/${basedir} with DefaultProjectBuilder.build(ModelSource, ...)
[
https://issues.apache.org/jira/browse/MNG-7170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361672#comment-17361672
]
Robert Scholte commented on MNG-7170:
-
I wouldn't gamble on any Maven 3 releases. Maven 3.8.1 was already kind of
unintended, but required as an answer to CVE-2021-26291.
I think we're already hoping for about half a year to push the first alpha out,
we should be close.
> Allow to associate pomFile/${basedir} with
> DefaultProjectBuilder.build(ModelSource, ...)
>
>
> Key: MNG-7170
> URL: https://issues.apache.org/jira/browse/MNG-7170
> Project: Maven
> Issue Type: Improvement
> Components: core
>Affects Versions: 3.8.1
>Reporter: Mickael Istria
>Priority: Major
>
> In LemMinX-Maven Language Server for pom.xml files, we're building models
> from "working copy" (unsaved) pom files. We do so by invoking
> {code}DefaultProjectBuilder.build( ModelSource modelSource,
> ProjectBuildingRequest request ){code}
> One pitfall is that this cascades to pomFile being null for the Model, and as
> a result {code}${basedir}{code} is not resolved.
> One could expect that the {code}ModelSource2.getLocationURI(){code} could be
> used to derive the pomFile when possible. LemMinX-Maven happens to properly
> set this.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7170) Allow to associate pomFile/${basedir} with DefaultProjectBuilder.build(ModelSource, ...)
[
https://issues.apache.org/jira/browse/MNG-7170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361669#comment-17361669
]
Mickael Istria commented on MNG-7170:
-
> The model itself shouldn't need this information. The Reader of the Model
> already says {{read ModelSource X}} so it knows the location.
I agree it would be best. A setter here is probably the cause why the getter
returns null in some cases: the issue with getters is that it's never clear
who's supposed to call them.
So do I understand it right that there will be no Maven 3.8.2? When is Maven
4.0 expected to be released?
> Allow to associate pomFile/${basedir} with
> DefaultProjectBuilder.build(ModelSource, ...)
>
>
> Key: MNG-7170
> URL: https://issues.apache.org/jira/browse/MNG-7170
> Project: Maven
> Issue Type: Improvement
> Components: core
>Affects Versions: 3.8.1
>Reporter: Mickael Istria
>Priority: Major
>
> In LemMinX-Maven Language Server for pom.xml files, we're building models
> from "working copy" (unsaved) pom files. We do so by invoking
> {code}DefaultProjectBuilder.build( ModelSource modelSource,
> ProjectBuildingRequest request ){code}
> One pitfall is that this cascades to pomFile being null for the Model, and as
> a result {code}${basedir}{code} is not resolved.
> One could expect that the {code}ModelSource2.getLocationURI(){code} could be
> used to derive the pomFile when possible. LemMinX-Maven happens to properly
> set this.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361662#comment-17361662
]
Pavel Varchenko commented on MNG-7171:
--
This is not a problem to set notimestamp in the plugin settings. Sad that it
does not work with 11.0.11.hs-adpt. We can't exclude javadoc from out builds
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361609#comment-17361609
]
Michael Osipov commented on MNG-7171:
-
Not Java 11, but our deviation to provide {{notimestamp}} by default.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361600#comment-17361600
]
Pavel Varchenko commented on MNG-7171:
--
[~michael-o] do you mean default values for java 11?
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7170) Allow to associate pomFile/${basedir} with DefaultProjectBuilder.build(ModelSource, ...)
[
https://issues.apache.org/jira/browse/MNG-7170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361594#comment-17361594
]
Robert Scholte commented on MNG-7170:
-
By the way, I don't expect that we will spend time on backporting to Maven 3.
Focus is fully on Maven 4.
> Allow to associate pomFile/${basedir} with
> DefaultProjectBuilder.build(ModelSource, ...)
>
>
> Key: MNG-7170
> URL: https://issues.apache.org/jira/browse/MNG-7170
> Project: Maven
> Issue Type: Improvement
> Components: core
>Affects Versions: 3.8.1
>Reporter: Mickael Istria
>Priority: Major
>
> In LemMinX-Maven Language Server for pom.xml files, we're building models
> from "working copy" (unsaved) pom files. We do so by invoking
> {code}DefaultProjectBuilder.build( ModelSource modelSource,
> ProjectBuildingRequest request ){code}
> One pitfall is that this cascades to pomFile being null for the Model, and as
> a result {code}${basedir}{code} is not resolved.
> One could expect that the {code}ModelSource2.getLocationURI(){code} could be
> used to derive the pomFile when possible. LemMinX-Maven happens to properly
> set this.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7170) Allow to associate pomFile/${basedir} with DefaultProjectBuilder.build(ModelSource, ...)
[
https://issues.apache.org/jira/browse/MNG-7170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361593#comment-17361593
]
Robert Scholte commented on MNG-7170:
-
I wanted to investigate if this field method is still required. While rewriting
the DefaultModelBuilder I was able to remove several pieces of code that were
using this code.
To me it still looks a bit weird: this is the only field that cannot be read
from the pom, but is set after post-processing.
The model itself shouldn't need this information. The Reader of the Model
already says {{read ModelSource X}} so it knows the location.
It is good to know there's a case we can use to validate this.
> Allow to associate pomFile/${basedir} with
> DefaultProjectBuilder.build(ModelSource, ...)
>
>
> Key: MNG-7170
> URL: https://issues.apache.org/jira/browse/MNG-7170
> Project: Maven
> Issue Type: Improvement
> Components: core
>Affects Versions: 3.8.1
>Reporter: Mickael Istria
>Priority: Major
>
> In LemMinX-Maven Language Server for pom.xml files, we're building models
> from "working copy" (unsaved) pom files. We do so by invoking
> {code}DefaultProjectBuilder.build( ModelSource modelSource,
> ProjectBuildingRequest request ){code}
> One pitfall is that this cascades to pomFile being null for the Model, and as
> a result {code}${basedir}{code} is not resolved.
> One could expect that the {code}ModelSource2.getLocationURI(){code} could be
> used to derive the pomFile when possible. LemMinX-Maven happens to properly
> set this.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361591#comment-17361591
]
Michael Osipov commented on MNG-7171:
-
I talked about this with [~rfscholte] recently. [~hboutemy] tried to make
Javadoc to be reproducible, but there are too many pitfalls and we don't want
to change default values if not necessary.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7170) Allow to associate pomFile/${basedir} with DefaultProjectBuilder.build(ModelSource, ...)
[
https://issues.apache.org/jira/browse/MNG-7170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361585#comment-17361585
]
Mickael Istria commented on MNG-7170:
-
Patch
[https://github.com/apache/maven/commit/5cdb8332f99a36e5a1da202da43e3c7dfbb49322]
for MNG-5669 has fixed that for master/Maven 4.
I tried to apply it to maven-3.8.1 but it seems to have important dependencies
on some major Maven 4 commits; so it seems tricky to backport it fully. So I've
just reincorporate the related changes, added a test and submitted a PR for the
maven-3.8.x branch: https://github.com/apache/maven/pull/478
> Allow to associate pomFile/${basedir} with
> DefaultProjectBuilder.build(ModelSource, ...)
>
>
> Key: MNG-7170
> URL: https://issues.apache.org/jira/browse/MNG-7170
> Project: Maven
> Issue Type: Improvement
> Components: core
>Affects Versions: 3.8.1
>Reporter: Mickael Istria
>Priority: Major
>
> In LemMinX-Maven Language Server for pom.xml files, we're building models
> from "working copy" (unsaved) pom files. We do so by invoking
> {code}DefaultProjectBuilder.build( ModelSource modelSource,
> ProjectBuildingRequest request ){code}
> One pitfall is that this cascades to pomFile being null for the Model, and as
> a result {code}${basedir}{code} is not resolved.
> One could expect that the {code}ModelSource2.getLocationURI(){code} could be
> used to derive the pomFile when possible. LemMinX-Maven happens to properly
> set this.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361541#comment-17361541
]
Pavel Varchenko commented on MNG-7171:
--
Thank you! I tested on 11.0.11.hs-adpt.
On 15.0.1.hs-adpt it is ok.
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7161) Error thrown during uninstalling of JAnsi
[
https://issues.apache.org/jira/browse/MNG-7161?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361527#comment-17361527
]
Guy Brand commented on MNG-7161:
[~michael-o] [~gnodet] Are you ok with doing the proposed option #2 ? We are
currently not able to reliably test with the latest Maven nightly, therefore
should we provide a pull request for that change such that we can get that into
the main branch soonish?
> Error thrown during uninstalling of JAnsi
> -
>
> Key: MNG-7161
> URL: https://issues.apache.org/jira/browse/MNG-7161
> Project: Maven
> Issue Type: Bug
>Affects Versions: 4.0.x-candidate, 4.0.0, 4.0.0-alpha-1
>Reporter: Guy Brand
>Priority: Critical
>
> Our integration tests stopped working after we started to test with a Maven
> {{4.0.0-alpha-1}} nightly which included this commit:
> [https://github.com/apache/maven/commit/195fb626a9a4e5a0774f779b6d8da1cb9ef38468#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8R310-R317]
> In this commit the {{maven-shared-utils}} and the {{jansi}} dependencies are
> being upgraded. When we then run our integration tests we get the following
> null pointer exception:
> {code:java}
> java.lang.NullPointerException
> at org.fusesource.jansi.AnsiPrintStream.uninstall(AnsiPrintStream.java:79)
> at org.fusesource.jansi.AnsiConsole.systemUninstall(AnsiConsole.java:524)
> at
> org.apache.maven.shared.utils.logging.MessageUtils.doSystemUninstall(MessageUtils.java:101)
> at
> org.apache.maven.shared.utils.logging.MessageUtils.systemUninstall(MessageUtils.java:80)
> at org.apache.maven.cli.MavenCli.main(MavenCli.java:203)
> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native
> Method)
> at
> java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> at
> java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.base/java.lang.reflect.Method.invoke(Method.java:566)
> at
> org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:282)
> at
> org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:225)
> at
> org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:406)
> at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:347)
> {code}
>
> We debugged this and [these
> changes|https://github.com/fusesource/jansi/commit/63bd892b2bdfc253ec119a57bdd42df5e80fd859#diff-d59db8655d9ae2d11948e2b411c34fc9e8513f29065d82c978d7128dafbe3bafR414-R420]
> in JAnsi introduced in the above upgraded version, is the source of the
> exception. The NPE is caused because the {{out}} reference is {{null}} at the
> time it wants to uninstall the {{AnsiOutputStream}}. This reference is nulled
> because we use the Plexus interactivity library which [disposes the
> {{DefaultOutputHandler}}|https://github.com/codehaus-plexus/plexus-interactivity/blob/master/plexus-interactivity-api/src/main/java/org/codehaus/plexus/components/interactivity/DefaultOutputHandler.java#L51-L54]
> on the tear down of Plexus, in which the {{System.out}} reference will be
> closed which is in fact the {{out}} reference of the {{AnsiConsole}} JAnsi
> will be [initialized
> before|https://github.com/apache/maven/blob/3e917677e484067b853eaa4a6de44ebcf5a988de/maven-embedder/src/main/java/org/apache/maven/cli/MavenCli.java#L200]
> the Plexus container). This happens
> [here|https://github.com/apache/maven/blob/3e917677e484067b853eaa4a6de44ebcf5a988de/maven-embedder/src/main/java/org/apache/maven/cli/MavenCli.java#L202],
> so before JAnsi will be uninstalled in
> [here|https://github.com/apache/maven/blob/3e917677e484067b853eaa4a6de44ebcf5a988de/maven-embedder/src/main/java/org/apache/maven/cli/MavenCli.java#L203].
> There are two options to solve this:
> 1. Report this to JAnsi such that they catch this valid use case and do not
> throw as this worked without any exceptions in older versions.
> 2. Fix the {{MessageUtils#doSystemUninstall()}} and catch all exceptions and
> swallow them, as if it can't uninstall it, then Maven itself is not capable
> of fixing this state either. This is already done in a similar way
> [here|https://github.com/apache/maven-shared-utils/blob/17091d82508deb9b7067f3434ba16f660ffc5023/src/main/java/org/apache/maven/shared/utils/logging/MessageUtils.java#L85-L92]
> for removing the shutdown hook.
> Our proposal is to do #2 which would make Maven itself resilient to such use
> cases as there are other extensions/plugin out there which also retrieve a
> reference for the system output streams and therefore they would fail with
> Maven 4.0.0. This would also make this part future proof, as when there are
> other errors th
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361504#comment-17361504
]
Piotr Zygielo commented on MNG-7171:
I believe it's due to
{quote}
{quote}
in {{index.html}}.
I think you shall complain to {{javadoc}} vendor, that for index.html
{{-notimestamp}} is not honoured (while for other files it is).
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Issue Comment Deleted] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Piotr Zygielo updated MNG-7171:
---
Comment: was deleted
(was: I believe it's due to
{quote}
{quote}
in {{index.html}}.
I think you shall complain to {{javadoc}} vendor, that for index.html
{{-notimestamp}} is not honoured (while for other files it is).)
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Commented] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17361503#comment-17361503
]
Piotr Zygielo commented on MNG-7171:
I believe it's due to
{quote}
{quote}
in {{index.html}}.
I think you shall complain to {{javadoc}} vendor, that for index.html
{{-notimestamp}} is not honoured (while for other files it is).
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Updated] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pavel Varchenko updated MNG-7171:
-
Description:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
{code}
/**
* Hello
*/
public class Hello {
}
{code}
Then I check buildinfo via
bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
was:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
{code}
{code}
Then I check buildinfo via
bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> maven-jar-plugin 3.2.0
> maven-javadoc-plugin 3.3.0
> maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Updated] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pavel Varchenko updated MNG-7171:
-
Description:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
* maven-jar-plugin 3.2.0
* maven-javadoc-plugin 3.3.0
* maven-source-plugin 3.2.1
This project has only one class
{code}
/**
* Hello
*/
public class Hello {
}
{code}
Then I check buildinfo via
bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
was:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
{code}
/**
* Hello
*/
public class Hello {
}
{code}
Then I check buildinfo via
bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> * maven-jar-plugin 3.2.0
> * maven-javadoc-plugin 3.3.0
> * maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
> /**
> * Hello
> */
> public class Hello {
> }
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Updated] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pavel Varchenko updated MNG-7171:
-
Description:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
/**
* Hello
*/
public class Hello {
}
Then I check buildinfo via
bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
was:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
{quote}/**
* Hello
*/
public class Hello {
}{quote}
Then I check buildinfo via
./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> maven-jar-plugin 3.2.0
> maven-javadoc-plugin 3.3.0
> maven-source-plugin 3.2.1
>
> This project has only one class
> /**
> * Hello
> */
> public class Hello {
> }
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Updated] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pavel Varchenko updated MNG-7171:
-
Description:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
{code}
{code}
Then I check buildinfo via
bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
was:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
/**
* Hello
*/
public class Hello {
}
Then I check buildinfo via
bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> maven-jar-plugin 3.2.0
> maven-javadoc-plugin 3.3.0
> maven-source-plugin 3.2.1
>
> This project has only one class
> {code}
>
>
>
> {code}
>
> Then I check buildinfo via
> bq. ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Updated] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pavel Varchenko updated MNG-7171:
-
Description:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
/**
* Hello
*/
public class Hello {
}
Then I check buildinfo via
./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
was:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
/**
* Hello
*/
public class Hello {
}
Then I check buildinfo via
./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
https://github.com/varpa89/reproducible-build
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> maven-jar-plugin 3.2.0
> maven-javadoc-plugin 3.3.0
> maven-source-plugin 3.2.1
>
> This project has only one class
> /**
> * Hello
> */
> public class Hello {
> }
>
> Then I check buildinfo via
> ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Updated] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
[
https://issues.apache.org/jira/browse/MNG-7171?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pavel Varchenko updated MNG-7171:
-
Description:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
{quote}/**
* Hello
*/
public class Hello {
}{quote}
Then I check buildinfo via
./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
was:
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
/**
* Hello
*/
public class Hello {
}
Then I check buildinfo via
./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
[https://github.com/varpa89/reproducible-build]
> Reproducible build does not work for maven-javadoc-plugin
> -
>
> Key: MNG-7171
> URL: https://issues.apache.org/jira/browse/MNG-7171
> Project: Maven
> Issue Type: Bug
>Affects Versions: 3.8.1
>Reporter: Pavel Varchenko
>Priority: Major
>
> I've created a project for reproducible build from this guide
> [https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
> Plugins:
> maven-jar-plugin 3.2.0
> maven-javadoc-plugin 3.3.0
> maven-source-plugin 3.2.1
>
> This project has only one class
> {quote}/**
> * Hello
> */
> public class Hello {
> }{quote}
>
> Then I check buildinfo via
> ./mvnw clean verify -e -DskipTests artifact:buildinfo
> -Dbuildinfo.ignoreJavadoc=false
>
> sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
> reproducible-build-1.0-SNAPSHOT-sources.jar
> But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each
> build
>
> Here is the example
> [https://github.com/varpa89/reproducible-build]
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
[jira] [Created] (MNG-7171) Reproducible build does not work for maven-javadoc-plugin
Pavel Varchenko created MNG-7171:
Summary: Reproducible build does not work for maven-javadoc-plugin
Key: MNG-7171
URL: https://issues.apache.org/jira/browse/MNG-7171
Project: Maven
Issue Type: Bug
Affects Versions: 3.8.1
Reporter: Pavel Varchenko
I've created a project for reproducible build from this guide
[https://maven.apache.org/guides/mini/guide-reproducible-builds.html]
Plugins:
maven-jar-plugin 3.2.0
maven-javadoc-plugin 3.3.0
maven-source-plugin 3.2.1
This project has only one class
/**
* Hello
*/
public class Hello {
}
Then I check buildinfo via
./mvnw clean verify -e -DskipTests artifact:buildinfo
-Dbuildinfo.ignoreJavadoc=false
sha512 is always the same for reproducible-build-1.0-SNAPSHOT.jar and
reproducible-build-1.0-SNAPSHOT-sources.jar
But for reproducible-build-1.0-SNAPSHOT-javadoc.jar it changes after each build
Here is the example
https://github.com/varpa89/reproducible-build
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
