Since build reproducibility is broken and not a requirement, it should be marked as optional in the review kit. I am going to ignore it and use a more simple "mvn clean verify -P docker" check. This gives me:
[ERROR] Errors: [ERROR] RollingAppenderDirectCronTest.testAppender:57 » Runtime java.lang.RuntimeException: Rollover completion verification failure for file: /Users/garygregory/rc/log4j-2.26.0/src/log4j-core-test/target/logs/core/appender/rolling/RollingAppenderDirectCronTest_69f8eb82_16734836558386803739/test-2026-05-04T02-54-59.log [INFO] [ERROR] Tests run: 8656, Failures: 0, Errors: 1, Skipped: 35 Using: Openjdk version "17.0.19" 2026-04-21 OpenJDK Runtime Environment Homebrew (build 17.0.19+0) OpenJDK 64-Bit Server VM Homebrew (build 17.0.19+0, mixed mode, sharing) Apache Maven 3.9.15 (98b2cdbfdb5f1ac8781f537ea9acccaed7922349) Maven home: /opt/homebrew/Cellar/maven/3.9.15/libexec Java version: 17.0.19, vendor: Homebrew, runtime: /opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home Default locale: en_US, platform encoding: UTF-8 OS name: "mac os x", version: "26.4.1", arch: "aarch64", family: "mac" Darwin ****.local 25.4.0 Darwin Kernel Version 25.4.0: Thu Mar 19 19:33:25 PDT 2026; root:xnu-12377.101.15~1/RELEASE_ARM64_T6041 arm64 Docker version 29.4.1, build 055a478 Gary On Mon, May 4, 2026 at 2:19 PM Piotr P. Karwasz <[email protected]> wrote: > > Hi Gary, > > On 4.05.2026 14:16, Gary Gregory wrote: > > I tried to adapt the review kit to my setup, running: > > > > sh mvn verify -P docker \ > > -Prelease artifact:compare \ > > > > -Dreference.repo=https://repository.apache.org/content/repositories/orgapachelogging-1325 > > > Reproducibility likely requires: > > export CI=true > > This variable toggles the activation of two profiles (`java8-tests` and > `java8-incompat-fixes`) that allow CI to run tests against a JDK 8 > toolchain. Unfortunately, it also has some side effects on the generated > artifacts: > > - `jspecify` appears in the `test` scope instead of `provided` scope. > The artifact is added to the `test` scope by the profile as a workaround > for a JDK 8 bug, so the SBOMs generated with `CI=true` and `CI=false` > differ slightly in where `jspecify` appears. > - For reasons I couldn't fully pin down, the POM files embedded in the > `*-sources.jar` archive may differ by a comment. The order in which a > POM-modifying plugin and `maven-source-plugin` execute differs between > `CI=true` and `CI=false`. > > We should almost certainly fix this going forward, for example, by > running the `deploy-release` workflow without the JDK 8 fixups and > reserving those for `build` runs[*]. > > Piotr > > [*] As an aside: the `build` workflow is a misnomer. Its main purpose is > to run unit tests, and building the artifacts is just a side effect. > Conversely, the main purpose of `deploy-release` is to build the > artifacts (without testing) and deploy them to the staging repository. >
