Your message dated Wed, 06 May 2015 17:35:25 +0000
with message-id <e1yq3ed-0008ti...@franck.debian.org>
and subject line Bug#784265: fixed in maven-plugin-tools 3.3-2
has caused the Debian Bug report #784265,
regarding maven-plugin-tools: please create reproducible plugin descriptors
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
784265: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784265
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: maven-plugin-tools
Version: 3.3-1
Severity: wishlist
Tags: patch
User: reproducible-bui...@lists.alioth.debian.org
Usertags: timestamps toolchain
X-Debbugs-CC: reproducible-bui...@lists.alioth.debian.org
Hi!
While working on Debian's “reproducible builds” effort [1], we have
noticed that maven-plugin-tools generates unreproducible plugin descriptors
(example [2]), because it embeds the build date into a comment inside the file.
As the date provides no valuable information, it would be nice if it was
removed,
so that more packages using it become reproducible.
A proposal for this is in the attached patch.
Regards,
Reiner
[1]: https://wiki.debian.org/ReproducibleBuilds
[2]:
https://reproducible.debian.net/rb-pkg/unstable/amd64/java-comment-preprocessor.html
diff --git a/debian/patches/04-reproducible-plugin-descriptor.patch b/debian/patches/04-reproducible-plugin-descriptor.patch
new file mode 100644
index 0000000..c675411
--- /dev/null
+++ b/debian/patches/04-reproducible-plugin-descriptor.patch
@@ -0,0 +1,27 @@
+Author: Reiner Herrmann <rei...@reiner-h.de>
+Description: Don't include the date in xml files
+ Embedding the current date will result in unreproducible files.
+
+Index: maven-plugin-tools-3.3/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java
+===================================================================
+--- maven-plugin-tools-3.3.orig/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java
++++ maven-plugin-tools-3.3/maven-plugin-tools-generators/src/main/java/org/apache/maven/tools/plugin/generator/PluginDescriptorGenerator.java
+@@ -24,8 +24,6 @@ import java.io.FileOutputStream;
+ import java.io.IOException;
+ import java.io.OutputStreamWriter;
+ import java.io.Writer;
+-import java.text.SimpleDateFormat;
+-import java.util.Date;
+ import java.util.LinkedHashMap;
+ import java.util.LinkedHashSet;
+ import java.util.List;
+@@ -132,8 +130,7 @@ public class PluginDescriptorGenerator
+
+ XMLWriter w = new PrettyPrintXMLWriter( writer, encoding, null );
+
+- w.writeMarkup( "\n<!-- Generated by maven-plugin-tools " + getVersion() + " on " + new SimpleDateFormat(
+- "yyyy-MM-dd" ).format( new Date() ) + " -->\n\n" );
++ w.writeMarkup( "\n<!-- Generated by maven-plugin-tools " + getVersion() + " -->\n\n" );
+
+ w.startElement( "plugin" );
+
diff --git a/debian/patches/series b/debian/patches/series
index 2d00408..eac1ecc 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
01-maven2-api-compatibility.patch
02-plexus-archiver1-compatibility.patch
03-plexus-utils2-compatibility.patch
+04-reproducible-plugin-descriptor.patch
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: maven-plugin-tools
Source-Version: 3.3-2
We believe that the bug you reported is fixed in the latest version of
maven-plugin-tools, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 784...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bourg <ebo...@apache.org> (supplier of updated maven-plugin-tools
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Wed, 06 May 2015 19:21:46 +0200
Source: maven-plugin-tools
Binary: libmaven-plugin-tools-java
Architecture: source all
Version: 3.3-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebo...@apache.org>
Description:
libmaven-plugin-tools-java - Maven Plugin Tools Base POM
Closes: 784265
Changes:
maven-plugin-tools (3.3-2) unstable; urgency=medium
.
* Team upload.
* Upload to unstable
.
[ Reiner Herrmann ]
* Removed the date from the plugin descriptor to make the build reproducible
(Closes: #784265)
Checksums-Sha1:
17640622c06c5e44fc3160492cd21af9fd12aaf6 2548 maven-plugin-tools_3.3-2.dsc
83c12994b07adf9cf444fb1e42dde7cd6cf2f3f5 12028
maven-plugin-tools_3.3-2.debian.tar.xz
13e9d7cf2e23ce04b9c77779c9b319943d582847 202930
libmaven-plugin-tools-java_3.3-2_all.deb
Checksums-Sha256:
ab31bf8f8b0a82a213a7f7cd7c29df85d32263b6c7171cc89c9a7f9ce11d013c 2548
maven-plugin-tools_3.3-2.dsc
c7dae8054fec28c7b932dec07a90b0a5bed381b12f0b878160545906e648d1ed 12028
maven-plugin-tools_3.3-2.debian.tar.xz
e14038722dc0d75446d6f46f879517688a952f42466f41a13b84c56b0589e3a4 202930
libmaven-plugin-tools-java_3.3-2_all.deb
Files:
f0f5bc4ffaab53b4ec2e8fc2ecd1b0f5 2548 java optional
maven-plugin-tools_3.3-2.dsc
617fe4365dc4c56ca7dcb594bdb8a145 12028 java optional
maven-plugin-tools_3.3-2.debian.tar.xz
d9252cc9b0c236623ed056cb99007c51 202930 java optional
libmaven-plugin-tools-java_3.3-2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJVSk4dAAoJEPUTxBnkudCsED0P/0ssFTX2qejrnGRCBFRAOZca
bmeAgl2UERTRGnruSUog3j4qhV3rhWncUkTNQmhoFvr1x1p5rN7TSPLiOqmLAmAB
3bPMaWUTAXHjoFPj58EIAjErp/Gafo5ZXNRodcvAnbszTkCoxSkSGEB3wVzAviqK
8FDK+PtavxCnmLjowgQH+YBqrfVD7ekXdPvhe3zI4ECWaLQZ/LXRPZdP4IlWvpgG
AVvV4JROFPHtzdOL7s2ClhQXmaCb2XWzyig3fwHbYE0JfrwI0mfBmrm2fXDdYtyK
2IyaZYikOIuiY56eRTMnlhigdH1C4lbLRNubV4eI2XRNpkt1dpwN8+BefKjh4sxV
DQwyOthXut5VXMeOcSoIa1FVaVKf5+VC1M0az6o/tMBXIE7nb0Y+mwBs68NC6KZ9
dhnbEF6Om3UqphvTlRXBqTCWIxLAs92NuHYq3Ykozwk6COpLocc10sQMiowWH+8k
lfzC9IiXLLbeOPCFUzwXxlYc1zh5AO8O0U1zl0MMngKeAssezI6+nH1wtojPjLNs
/9HXPXNVOTtD7mUqgU0MTLIHOf0bosqmTb5bn5eH7DYpAXZrFrt1+g/w6Zcy7VOj
J/gYUSq03g1/dcXz9b7na23J4zMiXyX9j5I0/ex3x3crx/4gkTvYCl9/zfa0C4Sj
+gij51gH5HYxbT2HgMxc
=ifmn
-----END PGP SIGNATURE-----
--- End Message ---
__
This is the maintainer address of Debian's Java team
<http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>.
Please use
debian-j...@lists.debian.org for discussions and questions.
