Guus der Kinderen <[email protected]> writes: > Hi Simon, > >> Yes I am happy if you can sign artifacts and make the upload. > > Thanks! > >> Are they reproducible? > > Not as things stand. The jar and javadoc tooling both embed timestamps. > Fixable, but I'd rather leave it out of scope for now and get 1.44 out. > > What I built: the Java code from the 1.44 tarball, unmodified, recompiled > with Java 8 for compatibility.
No worries - getting things published definitely has priority. I don't know about Java reproducible artifacts, or if anyone in the Central/Java community cares. >> I suspect Java people aren't using *.JAR's from GNU tarballs, but get >> things through Maven or other sites, though. > > That's exactly right, and the current situation isn't very good: Central > has only 1.15 (2009) and 0.6.5 (2006): > https://mvnrepository.com/artifact/org.gnu.inet/libidn People can route > around it with private repositories (e.g. > https://igniterealtime.org/archiva/repository/maven/org/gnu/inet/libidn/), > which is unsigned and unofficial and not a real fix - and likely outdated > too. Not having it in Central will effectively make it unavailable to most > developers. Getting 1.44 onto Central should sort it. Yay! /Simon
signature.asc
Description: PGP signature
