[MARTIFACT-25] add .pom to the output files being verified

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.0
• Fix Version/s: 3.2.0
• Component/s: artifact:buildinfo, artifact:compare
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 12/Jul/21 09:33
• Updated: 14/Nov/21 15:50
• Resolved: 13/Oct/21 20:51

Description

pom.xml fingerprint is not checked until now: this is a bad idea for multiple reasons:

• depending on release manager OS, pom.xml deployed to remote repository may be different from rebuilder output, even if they use the same Git repository and commit
• in the future, with Maven 4 differentiating build and consumer POMs, output pom.xml is consumer POM, may be different from pom.xml in Git (with more differences than just newlines)
• for consistency with buildinfo from other build tools, because the purely generate their pom.xml then absolutely consider it as an output to be checked

Issue Links

• is related to: MARTIFACT-29 add support for pom generated by flatten-maven-plugin