[MNG-6276] Support Reproducible Builds (https://reproducible-builds.org)

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Component/s: Core, General
• Assignee: Herve Boutemy
• Reporter: Paolo Sacconier
• Created: 25/Aug/17 21:29
• Updated: 05/Nov/23 10:16
• Resolved: 18/Apr/22 09:31

Description

A venerable build system like Maven should support full build reproducibilty (i.e. producing bit a bit identical binaries from the same source).

As initiatives like https://reproducible-builds.org gain traction and the news of the recent Debian policy change to mandate this build behavior (see https://reproducible.alioth.debian.org/blog/posts/121/), this seems a feature that needs to be considered for inclusion into Maven core & core plugins.

There is an independent ongoing effort to support this feature and the author stated that he has found interest from maven project to integrate his work: https://github.com/Zlika/reproducible-build-maven-plugin/issues/6#issuecomment-325005883

I hope this issue helps kickstart the effort.

Issue Links

• contains: ARCHETYPE-590 support Reproducible Builds for archetype:jar
• contains: MACR-53 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• contains: MASSEMBLY-921 Reproducible Builds: make entries in output archive reproducible (order + timestamp)
• contains: MEAR-280 Reproducible Builds: make entries in output ear files reproducible (order + timestamp)
• contains: MEJB-128 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• contains: MJAR-263 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• contains: MJAVADOC-627 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• contains: MRAR-86 Reproducible Builds: make entries in output rar files reproducible (order + timestamp)
• contains: MSHADE-347 Reproducible Builds: make entries in output jar files reproducible
• contains: MSITE-851 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• contains: MSOURCES-120 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• contains: MWAR-432 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• contains: MJLINK-75 Reproducibility of ZIP artifacts
• contains: MRRESOURCES-114 make projectTimespan reproducible: use outputTimestamp instead of current date
• contains: MPLUGIN-326 Remove timestamp in generated descriptor
• is related to: COMPRESS-485 Reproducible Builds: keep entries order when gathering ScatterZipOutputStream content in ParallelScatterZipCreator
• is related to: MSHARED-796 use java.specification.version instead of java.version in Build-Jdk manifest entry
• is related to: MSHARED-797 Move current Build-Jdk manifest entry to Build-Jdk-Spec
• is required by: MNG-6789 Make Maven distribution build Reproducible
• is superceded by: MARTIFACT-24 add artifact:check-buildplan goal to check that plugins versions do not have known reproducibility issues
• relates to: MSHARED-494 Impossible to generate a reproducible build due to timestamp in pom.properties
• relates to: MSHARED-787 Add optional buildEnvironment information to the manifest
• relates to: MSHARED-362 Support removing default manifest entries with Maven Archiver
• relates to: MSHARED-511 Using structures to keep insertion order for MANIFEST.MF
• relates to: MSHARED-661 Remove manifest entry "Built-By: <username>" for reproducible builds
• relates to: MPLUGIN-261 sort goals in generated plugin.xml
• links to: Add ability to NOT write timestamps for zip file entries
• links to: GitHub Pull Request #77
• mentioned in: Page Loading...