laeubi commented on PR #508: URL: https://github.com/apache/maven-jar-plugin/pull/508#issuecomment-5351497629
> So the same sources produce **different manifest bytes on different JDK distributions** I wanted to note here that (binary) reproducible builds are not guaranteeing anyways between different JDK versions and vendors as they could provide different byte codes. Apart from that, supplying the manifest directly would be the safest choice (also for the future) and thats why I think generation of files should be independent from packaging a jar: - https://github.com/apache/maven-jar-plugin/issues/586 Apart from that, having the validation of MR-jars baked into the jar tool is from my opinion a design flaw and actually what we aim here if I understand correctly, so if the `JarOutputStream` would have this support this would not only benefit maven but also others as this verification can then be reused see for reference here: - https://github.com/eclipse-jdt/eclipse.jdt.core/issues/4274 so if anyone is in contact with the JDK team it would be great to bring this to their attention as it would avoid people doing duplicate work an/or workarounds where a programmatic solution would be superior. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
