laeubi commented on PR #508: URL: https://github.com/apache/maven-jar-plugin/pull/508#issuecomment-5337763539
> > If that proves to be true and we can't find a workaround, that's a blocker. Reproducible builds are the more important feature. > > I disagree that it is the most important feature. I think that they real feature you are asking for is a way to verify the integrity of a JAR (no malicious code). This is **semantic** reproducible builds, and something that we could provide. Tycho has such comparison (and can even e.g. detect different order in manifest files) - https://github.com/eclipse-tycho/tycho/tree/main/tycho-artifactcomparator but it is more used to compare if a version increment is needed to prevent deploying an artifact that (semantically) only differs in its promoted version. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
