Hi all, so the Maven team is currently voting on releasing some plugins in new versions that allow creating reproducible builds.
It should be possible to simply update some plugin versions and then set one additional maven property. However it seems there are limitations to the reproducibility: - OS matters - Major JDK matters So I was thinking: How about using Docker to create a controlled release/verification environment? We already have a Dockerfile which builds PLC4X and creates Docker images from the Hello World example. It might be a great idea to create one for releasing and verifying ... I'm not suggesting to distribute Docker images, but to use Docker for a controlled release environment. Guess releasing and verifying releases could become a no-brainer task. What do you think? Chris Am 11.10.19, 08:30 schrieb "Christofer Dutz" <[email protected]>: Hi all, In the maven project there is currently a great initiative to update the core maven pluggins to allow creating of reproducible builds. In theory using a given source package and running it with the same timestamp it should produce binary identical output. I think this would be a great measure to increase trust. Right now theoretically nobody is able to check when voting on a release, if the staged maven binaries were rely built from the identical source. With reproducible builds we could add another level of verification to our release process. Ideally the step of comparing the built artifacts with the ones staged in nexus. However this should probably be automated though ;-) What do you generally think? A path worth walking? Chris Holen Sie sich Outlook für Android<https://aka.ms/ghei36>
