[MWAR-432] Reproducible Builds: make entries in output jar files reproducible (order + timestamp)

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.2.3
• Fix Version/s: 3.3.0
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 17/Apr/20 19:18
• Updated: 13/Jun/20 15:43
• Resolved: 10/May/20 14:51

Description

since a jar file is a zip file, entries order and timestamp are a natural source of non Reproducible Builds: https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=74682318

but given how war containers use timestamp to serve content, maybe fixed timestamp for SNASPHOTs is not appropriate: see https://github.com/gradle/gradle/issues/10917

after discussion, given we don't force to a fixed timestamp but use a configured one, no issue...

Issue Links

• Is contained by: MNG-6276 Support Reproducible Builds (https://reproducible-builds.org)
• is related to: MSHADE-347 Reproducible Builds: make entries in output jar files reproducible
• is superceded by: MWAR-436 Jar file created by archiveClasses option is not reproducible