[FELIX-6269] bundle:manifest generates non-reproducible entries in MANIFEST.MF

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: maven-bundle-plugin-3.5.0, maven-bundle-plugin-4.2.1
• Fix Version/s: maven-bundle-plugin-5.1.1
• Component/s: Maven Bundle Plugin
• Assignee: Guillaume Nodet
• Reporter: Herve Boutemy
• Created: 26/Apr/20 12:27
• Updated: 27/Sep/20 00:22
• Resolved: 11/May/20 14:21

Description

trying to rebuild maven-resolver 1.4.2 release that only uses bundle:manifest goal, and already configured <_removeheaders>Bnd-LastModified</_removeheaders> to avoid some reproducibility issues, I still get following differences:

• with "Built-By: <user name>"
• with "Build-Jdk: <detailed JDK version>"
• and "Private-Package: ..." value seems not reproducible

see the result of diffoscope:

$ diffoscope target/reference/maven-resolver-util-1.4.2.jar maven-resolver-util/target/maven-resolver-util-1.4.2.jar
--- target/reference/maven-resolver-util-1.4.2.jar
+++ maven-resolver-util/target/maven-resolver-util-1.4.2.jar
[...]
├── META-INF/MANIFEST.MF
│ @@ -1,11 +1,11 @@
│  Manifest-Version: 1.0
│  Bundle-License: https://www.apache.org/licenses/LICENSE-2.0.txt
│  Bundle-SymbolicName: org.apache.maven.resolver.util
│ -Built-By: mosipov
│ +Built-By: herve
│  Specification-Title: Maven Artifact Resolver Utilities
│  Implementation-Vendor-Id: org.apache.maven.resolver
│  Bundle-DocURL: https://maven.apache.org/resolver/maven-resolver-util/
│  Import-Package: javax.net.ssl,org.eclipse.aether;version="[1.4,2)",org
│   .eclipse.aether.artifact;version="[1.4,2)",org.eclipse.aether.collect
│   ion;version="[1.4,2)",org.eclipse.aether.graph;version="[1.4,2)",org.
│   eclipse.aether.metadata;version="[1.4,2)",org.eclipse.aether.reposito
│ @@ -44,20 +44,20 @@
│  Implementation-Version: 1.4.2
│  Specification-Vendor: The Apache Software Foundation
│  Bundle-ManifestVersion: 2
│  Bundle-Vendor: The Apache Software Foundation
│  Tool: Bnd-3.5.0.201709291849
│  Implementation-Vendor: The Apache Software Foundation
│  Bundle-Version: 1.4.2
│ -Private-Package: org.eclipse.aether.util.artifact,org.eclipse.aether.u
│ - til,org.eclipse.aether.util.concurrency,org.eclipse.aether.util.filte
│ - r,org.eclipse.aether.util.graph.manager,org.eclipse.aether.util.graph
│ - .selector,org.eclipse.aether.util.graph.transformer,org.eclipse.aethe
│ - r.util.graph.traverser,org.eclipse.aether.util.graph.version,org.ecli
│ - pse.aether.util.graph.visitor,org.eclipse.aether.util.listener,org.ec
│ - lipse.aether.util.repository,org.eclipse.aether.util.version
│ +Private-Package: org.eclipse.aether.util.filter,org.eclipse.aether.uti
│ + l.repository,org.eclipse.aether.util.artifact,org.eclipse.aether.util
│ + .listener,org.eclipse.aether.util.version,org.eclipse.aether.util.gra
│ + ph.transformer,org.eclipse.aether.util.graph.manager,org.eclipse.aeth
│ + er.util.graph.version,org.eclipse.aether.util.graph.selector,org.ecli
│ + pse.aether.util.graph.visitor,org.eclipse.aether.util.graph.traverser
│ + ,org.eclipse.aether.util,org.eclipse.aether.util.concurrency
│  Created-By: Apache Maven Bundle Plugin
│  Specification-Version: 1.4.2
│ -Build-Jdk: 1.8.0_232
│ +Build-Jdk: 1.8.0_202
│  Implementation-URL: https://maven.apache.org/resolver/maven-resolver-u
│   til/

Issue Links

• causes: FELIX-6337 Maven Bundle Plugin generates incorrect Provide-Capability
• is related to: FELIX-6304 bundle:bundle generates non-reproducible JAR archives (timestamps)
• is related to: FELIX-6203 Make bundleplugin pom.proterties reproducible
• relates to: MSHARED-661 Remove manifest entry "Built-By: <username>" for reproducible builds
• relates to: MSHARED-797 Move current Build-Jdk manifest entry to Build-Jdk-Spec
• Wiki Page: Wiki Page Loading...