[MNG-6789] Make Maven distribution build Reproducible

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.6.2
• Fix Version/s: 3.6.3
• Component/s: Bootstrap & Build
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 20/Oct/19 10:15
• Updated: 04/Oct/22 08:16
• Resolved: 07/Nov/19 13:09

Description

with Maven native Reproducible Builds near available, it would be great to have Maven itself being the first Maven project that gets Reproducible Builds

there is already a proof of concept available in reproducible branch: https://github.com/apache/maven/tree/reproducible with corresponding Jenkins build https://builds.apache.org/view/M-R/view/Maven/job/maven-box/job/maven/job/reproducible/

once maven-jar-plugin, maven-assembly-plugin and maven-source-plugin have a reproducible release available, the last 2 plugins that bring non reproducible result in this build are plexus-component-metadata 2.0.0 and sisu-maven-plugin

Issue Links

• depends upon: MASSEMBLY-921 Reproducible Builds: make entries in output archive reproducible (order + timestamp)
• depends upon: MJAR-263 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• depends upon: MSOURCES-120 Reproducible Builds: make entries in output jar files reproducible (order + timestamp)
• depends upon: MNG-6859 Build not easily reproducible when built from source release archive
• is related to: MNG-6580 Unable to inject annotations from classes compiled for Java 9+
• is related to: MNG-6512 Checking possibility to require Java 11 to run Maven
• requires: MNG-6276 Support Reproducible Builds (https://reproducible-builds.org)
• requires: MNG-6799 avoid model interpolation instability risk: ensure StringVisitorModelInterpolator replaces StringSearchModelInterpolator
• links to: plexus-containers plexus-metadata issue #27
• links to: sisu.inject PR #5