[FELIX-6304] bundle:bundle generates non-reproducible JAR archives (timestamps)

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: maven-bundle-plugin-5.1.1
• Component/s: Maven Bundle Plugin
• Labels: reproducible-builds
• Assignee: Jean-Baptiste Onofré
• Reporter: Jochen Schalanda
• Created: 15/Jul/20 07:20
• Updated: 09/Nov/21 15:41
• Resolved: 23/Mar/21 09:08

Description

The JAR archives built by maven-bundle-plugin are not reproducible (as in reproducible builds) because the timestamps of their entries are variable and are using the current system time.

The maven-jar-plugin supports using a fixed timestamp via the outputTimestamp setting (default: ${project.build.outputTimestamp}) while the maven-bundle-plugin doesn't expose a similar setting.

Support for reproducible builds in the maven-jar-plugin was added with this commit: https://github.com/apache/maven-jar-plugin/commit/64c5e6530b4712cd95501fffb2de6bb1a202cd89

Issue Links

• is superceded by: FELIX-6404 bundle:bundle:5.1.2 add non-reproducible Built-By and Build-Jdk to MANIFEST.MF
• relates to: FELIX-6203 Make bundleplugin pom.proterties reproducible
• relates to: FELIX-6269 bundle:manifest generates non-reproducible entries in MANIFEST.MF