[MPOM-255] Enforce local property "project.build.outputTimestamp" for reproducible builds

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: ASF-23
• Fix Version/s: ASF-24
• Component/s: asf
• Assignee: Michael Osipov
• Reporter: Konrad Windszus
• Created: 27/Jul/20 04:37
• Updated: 15/Jan/24 18:53
• Resolved: 05/Jan/21 19:10

Description

In case the release's root pom.xml doesn't overwrite "project.build.outputTimestamp" it takes the value from https://github.com/apache/maven-apache-parent/blob/4813409e6a1ecfea11c8eb22a5f0443f790f1454/pom.xml#L95.

Instead of the fallback an enforcer rule should be added to require a property "project.build.outputTimestamp" to be set in the right format for reproducible builds to work (https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-do-i-configure-my-maven-build) for every pom.xml locally.

Only that way the timestamps are automatically adjusted with each release (https://issues.apache.org/jira/browse/MRELEASE-1029)

Issue Links

• breaks: MPOM-229 make build reproducible by default
• causes: MPOM-266 Incorrect message with missing property "project.build.outputTimestamp"
• is fixed by: MPOM-265 re-enable reproducible builds for ASF parent POM source-release.zip
• is related to: SLING-9611 Enforce setting the "project.build.outputTimestamp" property
• relates to: MRELEASE-1029 update project.build.outputTimestamp property on prepare
• links to: GitHub Pull Request #30
• links to: GitHub Pull Request #33