On Thu, 2020-05-14 at 11:45 +0200, Konrad Windszus wrote: > Hi, > > Yes, all bundles built with the latest parent should be reproducible > (i.e. generate always the same checksum under certain circumstances). > There is some documentation at > https://maven.apache.org/guides/mini/guide-reproducible-builds.html < > https://maven.apache.org/guides/mini/guide-reproducible-builds.html>;
I think it would be nice to configure the release process to automatically add the project.build.outputTimestamp property to the POM when releasing. This way, rebuilding from a tag should succeed out-of-the-box. > . > > Some sling artifacts are already listed at > https://github.com/jvm-repo-rebuild/reproducible-central < > https://github.com/jvm-repo-rebuild/reproducible-central>;. > Our check script should be adjusted to verify that you end up with > the same checksum. Isn't the build result dependant on the OS and JDK version used? Thanks, Robert > Haven't had a chance to look at this yet though > > Konrad > > > On 14. May 2020, at 11:39, Bertrand Delacretaz < > > [email protected]> wrote: > > > > Hi, > > > > On Thu, May 14, 2020 at 9:23 AM Robert Munteanu (Jira) < > > [email protected]> wrote: > > > Robert Munteanu closed SLING-9307... > > > > Make build fully reproducible... > > > > Does this mean our builds are fully reproducible? > > > > And do we have documentation about that, how to avoid breaking that > > in > > modules, how to validate it etc. ? > > > > I haven't followed that story, sorry if I missed something. > > > > -Bertrand
