Details
-
Improvement
-
Status: Closed
-
Major
-
Resolution: Won't Fix
-
None
-
None
-
None
-
None
Description
The "Configuring for Reproducible Builds" guide shows and example how to specify a static outputTimestamp:
<project.build.outputTimestamp>2023-01-01T00:00:00Z</project.build.outputTimestamp>
The date inside is really doesn't matter and I used the property as is but was afraid of being asked on a review why the 2023 year was used so used the current year.
But still during a review I was asked:
these changes are likely going to confuse future developers ("This date shouldn't be static! Lets make it a variable!").
The Gradle has an option preserveFileTimestamps = false that will just put 1 Feb 1980 as a date. The 1 Jan 1980 is a minimal date in Zip archive but the 1 Jan has some special treatment by Java that's why the Gradle team used the 1 Feb.
See more detailed description in CONSTANT_TIME_FOR_ZIP_ENTRIES
https://github.com/gradle/gradle/blob/master/platforms/core-runtime/files/src/main/java/org/gradle/api/internal/file/archive/ZipEntryConstants.java#L39
I don't think it worth to declare some new property e.g.
<preserveFileTimestamps>true</preserveFileTimestamps>
But we can simply make a special constant value like:
<project.build.outputTimestamp>REPRODUCIBLE_BUILD_STATIC_DATE</project.build.outputTimestamp>
Then the constant will be replaced with the same 1 Feb 1980 to be similar with Gradle produced artifacts.
This constant should make it more clear intention of the outputTimestamp but also easier to find an explanation for this.
The outputTimestamp parsing is performed in the maven-archiver but the maven-compiler-plugin and maven-jar-plugin would need to update a JavaDoc for the outputTimestamp config option
Attachments
Issue Links
- Dependency
-
-
- Closed
-
- links to