[MSOURCES-120] Reproducible Builds: make entries in output jar files reproducible (order + timestamp)

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.1
• Fix Version/s: 3.2.0
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 12/Mar/19 07:11
• Updated: 11/Nov/22 08:11
• Resolved: 29/Oct/19 20:30

Description

since a jar file is a zip file, entries order and timestamp are a natural source of non Reproducible Builds: https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=74682318

Issue Links

• Is contained by: MNG-6276 Support Reproducible Builds (https://reproducible-builds.org)
• is depended upon by: MNG-6789 Make Maven distribution build Reproducible
• is related to: MSOURCES-123 files in maven-shared-archive-resources are added in non-reproducible order
• is related to: MASSEMBLY-921 Reproducible Builds: make entries in output archive reproducible (order + timestamp)
• requires: MSHARED-833 make pom.properties entries order reproducible
• links to: plexus-archiver PR #121