[SUREFIRE-1802] improve Reproducible Builds after Surefire 3.0.0-M5 release

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 3.0.0-M5
• Assignee: Unassigned
• Reporter: Herve Boutemy
• Created: 19/Jun/20 06:19
• Updated: 20/Jun/20 11:16

Description

Surefire 3.0.0-M5 was released with build enhancements that sould make the build reproducible: results are good but not perfect

the good part: the release manager (Tibor) is able to rebuild on his local environment and get the full set of artifacts exactly as they are published to Central

the not perfect part: trying to reproduce independantly shows a few issues that are build with a little difference to the reference artifacts from Central

see https://github.com/jvm-repo-rebuild/reproducible-central for automated rebuild script, that when run on my own machine give followinf results: https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/maven/surefire/surefire-shared-utils-3.0.0-M5.buildinfo.compare

• the build produces 45 artifacts exactly like reference in Central
• 5 artifacts are not produced exactly like the reference in Central:
  • surefire-shadefire-3.0.0-M5.jar
  • maven-surefire-plugin-3.0.0-M5.jar
  • maven-failsafe-plugin-3.0.0-M5.jar
  • maven-surefire-plugin-3.0.0-M5-sources.jar
  • maven-failsafe-plugin-3.0.0-M5-sources.jar

We need to investigate how to make the build more independant from the environment, discovering how the environment impacts

First level of investigation shows that there are 2 issues: SUREFIRE-1803 (DEPENDENCIES) and SUREFIRE-1804 (shading)
and one additional nice to have MASFRES-34 (dependency-reduced-pom.xml)

Issue Links

• is related to: MASFRES-34 exclude maven-shade-plugin generated dependency-reduced-pom.xml

Sub-Tasks

• fix reproducibility fragility of DEPENDENCIES generation: Open
• fix surefire-shadefire-3.0.0-M5.jar reproducibility issue on other envs: Open