search

quarkusio / quarkus

Quarkus: Supersonic Subatomic Java.
https://quarkus.io
Apache License 2.0
13.55k stars 2.62k forks source link

Output runner JARs reproducibly #7027

Open ppalaga opened 4 years ago

ppalaga commented 4 years ago

We write into several JAR files during our augmentation process. The ZIP entries get timestamps of the instant when they were written. Therefore, when repeating the build from an unchanged source tree, the resulting JAR files are binary different for every build.

We should take the same strategy as the maven-jar-plugin - i.e. take the stable value stored in the project.build.outputTimestamp property in the pom.xml file - see https://github.com/quarkusio/quarkus/issues/7026

A PR follows.

ppalaga commented 4 years ago

As agreed on the developer mailing list, Quarkus build reproducibility is not required at this time, see https://groups.google.com/forum/#!topic/quarkus-dev/6geWtb5HOdc Thus closing.

In case this becomes a topic in the future, here is my latest code https://github.com/ppalaga/quarkus/commits/native-image-cache-and-build-reproducibility

gsmet commented 3 weeks ago

Actually, that's really something we should work on :).

All the ecosystem is moving in this direction, we need to improve on that. I think we should keep this open.