THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
| issue tracking | description |
|---|---|
| MSHARED-661 | maven-archiver adds "Built-By" and "Built-Jdk" Manifest entries |
| MSHARED-494 | Timestamp in pom.properties |
support SOURCE_DATE_EPOCH environment variable or equivalent: see https://reproducible-builds.org/docs/timestamps/ | |
| generated plugin.xml is non-deterministic | |
| MPLUGIN-326 | Timestamp in plugin.xml and plugin-help.xml descriptors generated by maven-plugin-tools-generator |
| codehaus-plexus/plexus-archiver issue #48 | avoid timestamp issues in archives created by plexus-archiver (widely used in Maven plugins creating jar, zip, war, tar... archives) |
| codehaus-plexus/plexus-containers issue #8 | sort components when generating META-INF/plexus/components.xml |
Debian approach
Debian has a strong reproducible builds structure working on the topic for a few years.
On java and Maven issues, Debian maintains a serie of patches that perhaps could be integrated (thank you Emmanuel Bourg for the summary):
- Maven core management of SOURCE_DATE_EPOCH: https://github.com/Debian/maven/blob/master/debian/patches/reproducible-build-timestamp.patch
- fix for MPLUGIN-326: https://sources.debian.net/src/maven-plugin-tools/3.5-4/debian/patches/04-reproducible-plugin-descriptor.patch/
- dates in javadoc footer: https://sources.debian.net/src/maven-javadoc-plugin/2.10.4-1/debian/patches/reproducible-footer.patch/
- plexus containers issue #8: https://sources.debian.net/src/plexus-containers1.5/1.7.1-4/debian/patches/03-reproducible-metadata.patch/ and old https://sources.debian.net/src/plexus-maven-plugin/1.3.8-10/debian/patches/0005-reproducible-metadata.patch/
- sisu-inject: https://sources.debian.net/src/sisu-ioc/2.3.0-9/debian/patches/reproducible-index.patch/
REX on Clojure: source .clj must have one second difference with .class, or Clojure will recompile