desruisseaux commented on PR #508: URL: https://github.com/apache/maven-jar-plugin/pull/508#issuecomment-5331743397
We may not be able to enable reproducible build at all with the `jar` tool at it stands today because the `jar` tool does not seem to be designed for an explicit enumeration of files to include. It seems to be designed for working on directories only, in which case the entry order may depend on the tool or the platform. Reference: * [Obligation to repeat the -C option for each file](https://github.com/apache/maven-jar-plugin/pull/508/changes/00b5e534619b1e63fdebdc9a3575ac4b23efd614) * [Analysis of missing directory entries problem reported on the mailing list](https://lists.apache.org/thread/9rqskbq13xpy1woxxykl7b6f5fmy2ylq) While I agree that we need a way to verify the integrity of a JAR file, I disagree that every bits must be identical. I think that we should write a tool comparing two JAR files ignoring dates, compression and entry order. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
