[FELIX-6304] bundle:bundle generates non-reproducible JAR archives (timestamps)

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: maven-bundle-plugin-5.1.1
• Component/s: Maven Bundle Plugin
• Labels: reproducible-builds
• Assignee: Unassigned
• Reporter: Jochen Schalanda
• Created: 15/Jul/20 07:20
• Updated: 15/Jul/20 07:59

Description

The JAR archives built by maven-bundle-plugin are not reproducible (as in reproducible builds) because the timestamps of their entries are variable and are using the current system time.

The maven-jar-plugin supports using a fixed timestamp via the outputTimestamp setting (default: ${project.build.outputTimestamp}) while the maven-bundle-plugin doesn't expose a similar setting.

Support for reproducible builds in the maven-jar-plugin was added with this commit: https://github.com/apache/maven-jar-plugin/commit/64c5e6530b4712cd95501fffb2de6bb1a202cd89

Issue Links

• relates to: FELIX-6203 Make bundleplugin pom.proterties reproducible
• relates to: FELIX-6269 bundle:manifest generates non-reproducible entries in MANIFEST.MF