Le 2024-12-04 17:49, Jorge Solórzano a écrit :
FTR, javadoc is unreproducible directly from the JDK, the output can
change
between minor versions because of updates to libraries like jQuery.
In the context of Debian reproducible is defined rather restrictively
[1] though current reproducibility tests include significant environment
changes (including locale) and project root path changes and fail the CI
build if they change the output. In "a set of versions" it is understood
that versions must match exactly, including the debian revision as
sometimes packaging changes or even just rebuilds (no other change in
source or packaging) may change the output (and that alone is a
significant issue downstream). Such rebuilds also carry a different
debian revision and are still referred to as "binary uploads" or
"binNMUs" even though binaries can no longer be directly uploaded, they
are now always rebuilt by a CI chain.
So changes such as jquery updates are already covered in that context,
and going further (and also for other reasons) I intend to patch the jdk
in Debian to use non-versioned symbolic links to the shared version of
jquery installed (or not...) on the target system when building Debian
packages, making jquery an optional run-time dependency and taking it
out of build dependencies of Javadoc packages for good.
If you are interested in the subject there is more to read at [2]
including stats and current/resolved challenges. Most packages are
already considered to build reproducibily, though they sometimes
experience issues, like the current one, and to be fair Java packages
have little excuses for not building reproducibly ^ ^.
[1]:
https://www.debian.org/doc/debian-policy/ch-source.html#reproducibility
[2]: https://wiki.debian.org/ReproducibleBuilds
Cheers,
--
Julien Plissonneau Duquène
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@maven.apache.org
For additional commands, e-mail: dev-h...@maven.apache.org
