Am 2020-03-07 um 13:45 schrieb Michael Osipov:
Am 2020-03-07 um 11:36 schrieb Hervé BOUTEMY:
Hi,

Yesterday, I made a key step forward for Reproducible Builds with Maven: I wrote code to easily check that your local build produces the same binaries as the reference binaries published either to staging or to Central repository.

For a live example, see the last paragraph of Maven Site Plugin vote that just started [1].

Process to check build output is based on a single plugin goal, currently named buildinfo:save [2]: 1. it creates a buildinfo file during build recording output fingerprints, that will eventually in the future be published to Central repository 2. it downloads reference artifacts and/or reference buildinfo and checks that the output of the local build is the same as the reference.

Now I want to discuss: is it clear? can you test and report, please?

If the feedback is positive, the next question will be: in which plugin should we put this goal to make a release and add it to our parent pom during release, so we publish reference buildinfo along our reference binaries to Central repository.

Fails for me with:
osipovmi@deblndw011x:~/var/Projekte/maven-site-plugin ((maven-site-plugin-3.9.0)
$ ~/apache-maven-3.7.0-SNAPSHOT/bin/mvn -v
Apache Maven 3.7.0-SNAPSHOT (f2e9afd788de919646717532d26eca38826e9924)
Maven home: /net/home/osipovmi/apache-maven-3.7.0-SNAPSHOT
Java version: 1.8.0_242, vendor: Oracle Corporation, runtime: /usr/local/openjdk8/jre
Default locale: de_DE, platform encoding: UTF-8
OS name: "freebsd", version: "12.1-stable", arch: "amd64", family: "unix"

The build completely stalls at
[INFO] Replacing /var/osipovmi/Projekte/maven-site-plugin/target/maven-site-plugin-3.9.0.jar with /var/osipovmi/Projekte/maven-site-plugin/target/maven-site-plugin-3.9.0-shaded.jar [INFO] Dependency-reduced POM written at: /var/osipovmi/Projekte/maven-site-plugin/dependency-reduced-pom.xml

CPU time is consumed like hell, I killed the process after 10 min.

Looking at it with JConsole shows that main thread is heavy working on

org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:317) org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:229) org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveDependencies(DefaultRepositorySystem.java:340) org.apache.maven.project.DefaultProjectDependenciesResolver.resolve(DefaultProjectDependenciesResolver.java:203) org.apache.maven.shared.dependency.graph.internal.Maven31DependencyGraphBuilder.resolveDependencies(Maven31DependencyGraphBuilder.java:124) org.apache.maven.shared.dependency.graph.internal.Maven31DependencyGraphBuilder.buildDependencyGraph(Maven31DependencyGraphBuilder.java:110) org.apache.maven.shared.dependency.graph.internal.DefaultDependencyGraphBuilder.buildDependencyGraph(DefaultDependencyGraphBuilder.java:98) org.apache.maven.shared.dependency.graph.internal.DefaultDependencyGraphBuilder.buildDependencyGraph(DefaultDependencyGraphBuilder.java:67 org.apache.maven.plugins.shade.mojo.ShadeMojo.updateExcludesInDeps(ShadeMojo.java:1266) org.apache.maven.plugins.shade.mojo.ShadeMojo.rewriteDependencyReducedPomIfWeHaveReduction(ShadeMojo.java:1188) org.apache.maven.plugins.shade.mojo.ShadeMojo.createDependencyReducedPom(ShadeMojo.java:1098)
org.apache.maven.plugins.shade.mojo.ShadeMojo.execute(ShadeMojo.java:599)
org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPlug

This is a complete contrast to Maven 3.5.4 and not related to this new plugin. A mere "mvn clean verify" on MSITE stalls completely during shade. Need to test more.

OK, found it:

716cc1fe02661897232a7cc3e4c1bb3b3df3b832 is the first bad commit
commit 716cc1fe02661897232a7cc3e4c1bb3b3df3b832
Author: rfscholte <[email protected]>
Date:   Wed Jan 29 21:18:42 2020 +0100

    [MNG-5669] same pom.xml is read multiple times

 .../java/org/apache/maven/building/FileSource.java |  31 ++++
 .../org/apache/maven/building/StringSource.java    |  33 +++-
 .../java/org/apache/maven/building/UrlSource.java  |  32 +++-
 .../apache/maven/project/ReactorModelCache.java    |  78 +++++++-
 .../maven/model/building/ArtifactModelSource.java  |  59 ++++++
 .../maven/model/building/DefaultModelBuilder.java  | 206 ++++++++++++++++-----
 .../maven/model/building/FileModelSource.java      |   9 +-
 .../apache/maven/model/building/ModelCache.java    |  29 +++
 .../apache/maven/model/building/ModelCacheTag.java |  26 +++
 .../model/superpom/DefaultSuperPomProvider.java    |   2 +-
 .../internal/DefaultArtifactDescriptorReader.java  |   7 +-
 .../repository/internal/DefaultModelResolver.java  |   7 +-
 12 files changed, 451 insertions(+), 68 deletions(-)
 create mode 100644 maven-model-builder/src/main/java/org/apache/maven/model/b


@Robert, do you want to revert? This requires more testing obviously.

Michael


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to