search

raboof / sbt-reproducible-builds

Make your published artifacts bit-by-bit reproducible, and compare with other certifications
Apache License 2.0
36 stars 4 forks source link

cross-publish for sbt 2.0.0 #344

Open raboof opened 1 week ago

raboof commented 1 week ago

Without actually switching to it for our build (that's #351)

Requires upstream:

BillyAutrey commented 1 week ago

I started on sbt-ci-release. Because it pulls in plugins via addSbtPlugin, as far as I can tell we're forced to require crossbuilds of those plugins as well.

This means we'll need 2.0.0-M2 crossbuilds of:

BillyAutrey commented 1 week ago

Side note - this plugin strips timestamps. But zinc removes them in 2.0.0, actually to try and create more reproducible builds.

I think some of this plugin's aims are still valuable to have separately (e.g., buildinfo for publication). But I wonder how much this will have to change for 2.0.0?

raboof commented 1 week ago

Side note - this plugin strips timestamps. But zinc removes them in 2.0.0, actually to try and create more reproducible builds.

I think some of this plugin's aims are still valuable to have separately (e.g., buildinfo for publication). But I wonder how much this will have to change for 2.0.0?

I agree! Making the stripping (or perhaps individual strippers?) optional is something I'd like to do in any case (#299), and under sbt 2.x could perhaps even become the default.

raboof commented 1 week ago

I started on sbt-ci-release. Because it pulls in plugins via addSbtPlugin, as far as I can tell we're forced to require crossbuilds of those plugins as well.

This means we'll need 2.0.0-M2 crossbuilds of:

  • sbt-dynver
  • sbt-git (in progress)
  • sbt-pgp (done with 2.3.0)
  • sbt-sonatype.

great that you're pushing for this! should we create a tracking issue in sbt-ci-release and link to that here?

BillyAutrey commented 1 week ago

great that you're pushing for this! should we create a tracking issue in sbt-ci-release and link to that here?

Sure, that's a good idea. I can do that.

BillyAutrey commented 1 week ago

https://github.com/sbt/sbt-ci-release/issues/314