Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: another source of issues

...

  • Timestamps:
    • Timestamp in pom.properties generated by maven-archiver (MSHARED-494)
    • Timestamp in plugin.xml and plugin-help.xml descriptors generated by maven-plugin-tools-generator (MPLUGIN-326)
    • Timestamp in MANIFEST.MF (Bnd-LastModified) generated by maven-bundle-plugin
    • Timestamps in ZIP/JAR files: file last modification time/date in central directory and file entry headers + possible optional fields "X5455_ExtendedTimestamp" (PLEXUS-ARCHIVER-48)
    • Timestamps in generated javadoc HTML files (can be disabled with javadoc options "notimestamp" and "bottom")
    • Timestamps in bytecode generated from Groovy code (added by GroovyClassLoader.addTimeStamp())
  • Username:
    • Username in MANIFEST.MF (Built-By) generated by maven-archiver (MSHARED-661)
    • UID/GID in tar file entries
  • Ordering:
    • Order of the file entries in a ZIP/JAR file (depends on file system order)
    • Order of goals in plugin.xml generated by maven-plugin-tools (MPLUGIN-261)
    • Order of the methods of the ObjectFactory.java file generated by JAXB/xjc (JAXB-598)
    • Order of components in META-INF/plexus/components.xml generated by plexus metadata


Version numbers of some of the tools used to build the artifact are also added to the artifact itself (e.g. "Built-Jdk" and "Created-By" MANIFEST entries added by maven-archiver to record the exact JDK and Maven versions used to build). This does not make the build unreproducible (because you just have to use the same tool versions to generate the same artifact) but it makes it more difficult to reproduce because of that. Line endings is also a problem, and even if we could force given line endings for build-generated text files (MANIFEST, pom.properties...), it would be hazardous to try to change the line endings of the resource files.

...

issue trackingdescription
MNG-6276"Parent" issue
MSHARED-661maven-archiver adds "Built-By" and "Built-Jdk" Manifest entries
MSHARED-494Timestamp in pom.properties
 support SOURCE_DATE_EPOCH environment variable: see https://reproducible-builds.org/docs/timestamps/
MPLUGIN-261before maven-plugin-plugin 3.3, generated plugin.xml non-deterministic
MPLUGIN-326Timestamp in plugin.xml and plugin-help.xml descriptors generated by maven-plugin-tools-generator
codehaus-plexus/plexus-archiver issue #48avoid timestamp issues in archives created by plexus-archiver (widely used in Maven plugins creating jar, zip, war, tar... archives)
 sort components when generating META-INF/plexus/components.xml