Cannot rebuild and check how the output matches reference in the Central Repository

[nicokosi]

With the help from @hboutemy, I tried to check if QuickPerf 1.0.0-RC7's build is reproducible via reproducible-central, see issue https://github.com/jvm-repo-rebuild/reproducible-central/issues/16. Our first attempt showed that the build is not reproducible because an internal SNAPSHOT dependency cannot be found:

[INFO] ------------------------------------------------------------------------ [INFO] BUILD FAILURE [INFO] ------------------------------------------------------------------------ [INFO] Total time: 19.638 s [INFO] Finished at: 2020-10-27T19:07:17Z [INFO] ------------------------------------------------------------------------ [ERROR] Failed to execute goal on project quick-perf-junit5: Could not resolve dependencies for project org.quickperf:quick-perf-junit5:jar:1.0.0-RC7: Could not find artifact org.quickperf:quick-perf-junit5-test-util:jar:tests:1.0-SNAPSHOT -> [Help 1] org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal on project quick-perf-junit5: Could not resolve dependencies for project org.quickperf:quick-perf-junit5:jar:1.0.0-RC7: Could not find artifact org.quickperf:quick-perf-junit5-test-util:jar:tests:1.0-SNAPSHOT

Maybe that the Maven build can be improved in order to be reproducible? :innocent:

[jeanbisutti]

Thanks a lot @nicokosi and @hboutemy for trying to check if QuickPerf 1.0.0-RC7 is reproducible. Indeed, quick-perf-junit5-test-util:jar:tests:1.0-SNAPSHOT is an internal dependency used by testing modules, for example junit5-jvm-test. quick-perf-testng-test-util, quick-perf-sql-hibernate-test-util and junit4-spring-base-tests are also internal dependencies used by testing modules. All these dependencies are not expected to be published.

QuickPerf perhaps makes an improper use of Maven...

In quick-perf-junit5 POM, quick-perf-junit5-test-util is used in the following way:

        <dependency>
            <groupId>org.quickperf</groupId>
            <artifactId>quick-perf-junit5-test-util</artifactId>
            <version>1.0-SNAPSHOT</version>
            <classifier>tests</classifier>
            <type>test-jar</type>
            <scope>test</scope>
        </dependency>

quick-perf-junit5-test-util is previously built (but will not be published).

[nicokosi]

Thanks @jeanbisutti for your quick feedback. 🤗

May the Maven revision placeholder can be used, as explained in "Maven CI Friendly Versions"?

PS: you may want to remove the "bug" label from this issue (since it does not affect QuickPerf users)... 😇

[hboutemy]

@jeanbisutti how are we supposed to build (IIUC install) these dependencies, so the main build finds them?

[hboutemy]

ok, I found the difference in profiles in https://github.com/quick-perf/quickperf/blob/master/testng/pom.xml , now I understand how you did

if we build with default profile, the build will work but we'll have issues when comparing with Central Repository because these test libraries are not published. if we build with release profile, we'll get expected artifacts and source jars, but the build will fail because these required test jars are not available installing during a first default build is not an option: installing is prohibited for Reproducible Builds (this would change local repository content, that is expected to get content from Central Repository)

classical way to do such non-published artifacts is not to play with modules list in profile, but configure maven.deploy.skip property: IMHO, such a setup will be better in the future for now, we'll have to cheat a little bit at Reproducible Central rebuild...

[jeanbisutti]

@hboutemy @nicokosi Thank you for your investigations and explanations.

In the next days, I plan to release QuickPerf 1.0.

To have a reproducible build, I propose to change the QuickPerf build, and perhaps the Maven modules used for testing, in the frame of QuickPerf 1.1.

@nicokosi, you are very welcome if you want to work on this. The precious advice from @hboutemy is also very welcome.

[hboutemy]

PR #130 opened to apply the maven.deploy.skip property to modules that require to be built because they are used during tests, but avoid to ship test artifacts

[jeanbisutti]

PR #130 opened to apply the maven.deploy.skip property to modules that require to be built because they are used during tests, but avoid to ship test artifacts

I did not succeed to deploy with these modifications, see.

To deploy the release candidates, the following command lines were executed:

mvn clean install

mvn clean

mvn release:prepare -Prelease,spring-release 

mvn release:perform -Prelease,spring-release 

The published RC versions allow to use QuickPerf.

mvn release:prepare -Prelease,spring-release

=> the pom versions of the not published artifacts would not be updated...

installing during a first default build is not an option: installing is prohibited for Reproducible Builds (this would change local repository content, that is expected to get content from Central Repository)

=> QuickPerf build has to be improved

[jeanbisutti]

I merged #130. Many thanks @hboutemy