Hi Gary,
On 10.12.2024 14:58, Gary Gregory wrote:
Here you go:
mvn verify -Prelease artifact:compare
-Dreference.repo=https://repository.apache.org/content/repositories/orgapachelogging-1309
diff target/reference/log4j-bom-2.24.3.buildinfo
target/log4j-bom-2.24.3.buildinfo
The `*.buildinfo` files are pretty much useless, they only give you some
information on the system the performed the build. It doesn't even
contain all the information that is known to influence the build (e.g.
we found out that the timezone, umask and system architecture can also
influence the build).
Could you diff the
`target/reference/org.apache.logging.log4j/log4j-bom-2.24.3-cyclonedx.xml`
and `target/bom.xml` files instead, as in my previous e-mail?
On Tue, Dec 10, 2024 at 8:52 AM Piotr P. Karwasz
<pi...@mailing.copernik.eu> wrote:
[ERROR] sha512 mismatch log4j-bom-2.24.3-cyclonedx.xml: investigate
with diffoscope
target/reference/org.apache.logging.log4j/log4j-bom-2.24.3-cyclonedx.xml
target/bom.xml
Any ideas?
Can you compare the two files above?
Piotr
