Page History

...

If you have a project that is built with Apache Maven, refer to the Configuring for Reproducible Builds guide.

Java / Gradle

...

Gradle builds may require setting some options in the build to ensure reproducible artifacts. Using the file-system permissions can be fine, but consider that different users (and OS's) may have different umask settings/defaults.

...

, Maven and sbt

Refer to the JVM build tools documentation on reproducible-builds.org.

Java / Gradle / Modifying the pom.xml content

To modify the generated pom.xml, Gradle offers a mechanism on the MavenPublication type via the withXml function.

Using Node.appendNode() can lead to non-reproducible builds, depending on whether your code can run before or after Gradle added the <dependencies> node.

Example code (Kotlin Script) to place a <parent> element at a deterministic position:

...

Java / .properties files

All Java properties generated using java.util.Properties.store() contain a comment line with the generation timestamp. This varying content breaks reproducible builds.

Consider setting the Java system property java.properties.date to some fixed value in your build scripts.

For Gradle, consider adding a line like the following to gradle.properties.

systemProp.java.properties.date=Your project's comment

Java / character set + locales

When building with Java 17 or older, consider setting file.encoding=UTF-8. UTF-8 is the default since Java 18.

Other system properties to consider depending on your build requirements: user.language=en, user.country=US, user.variant= (empty)

Python

Modern Python tooling (such as Flit and Hatch) support reproducible builds for pure-Python projects. You can read more about reproducible build support in Flit reproducible build docs and Hatch reproducible build docs. It's a bit more complex if your assets require native compilation, but if you can assure that your native compilation produces reproducible libraries on its own the packaging tool will produce reproducible builds..

...

3) Consider using a fixed mtime and not using git-archive's gzip. For example:  git archive --mtime="1980-02-01 00:00:00 UTC" --format=tar HEAD | gzip -6 --no-name > my-archive.tar.gz

...