[MJAR-263] Reproducible Builds: make entries in output jar files reproducible (order + timestamp)

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.2.0
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 12/Mar/19 07:15
• Updated: 15/Apr/24 21:01
• Resolved: 03/Nov/19 09:13

Description

since a jar file is a zip file, entries order and timestamp are a natural source of non Reproducible Builds: https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=74682318

notice: on MANIFEST.MF content, MJAR-262 is expected to make the default content reproducible

Issue Links

• causes: MJAR-300 maven jar plugin does not interpret build outputTimestamp correctly
• Is contained by: MNG-6276 Support Reproducible Builds (https://reproducible-builds.org)
• is depended upon by: MNG-6789 Make Maven distribution build Reproducible
• is related to: MJAR-275 outputTimestamp not applied to module-info; breaks reproducible builds
• is related to: MSHADE-347 Reproducible Builds: make entries in output jar files reproducible
• supercedes: MJAR-257 Option to strip non-deterministic aspects of jars post-creation
• links to: GitHub Pull Request #53

Sub-Tasks

• versioned files do not use project.build.outputTimestamp: Closed