desruisseaux commented on PR #508: URL: https://github.com/apache/maven-jar-plugin/pull/508#issuecomment-5353734439
> I wanted to note here that (binary) reproducible builds are not guaranteeing anyways between different JDK versions and vendors as they could provide different byte codes. I agree, and this is one reason why I disagree with the importance given to strict (as opposed to semantically) reproducible builds. I think that it can even deserve the real goal, which is security. If some Java tools produce vulnerable code (e.g., [Javadoc HTML frame injection vulnerability](https://www.kb.cert.org/vuls/id/225657) in 2013), it is difficult to know if a JAR file has been produced by patched tools if we don't have a useful `Created-By` entry in the `MANIFEST.MF` file. But we are throwing away this information in the name of strict reproducible builds. Regarding the split of metadata generation (`MANIFEST.MF` and Maven files) and packaging in two different phases, I agree with that. But I propose to go step by step: 1. Fix the issue raised in above comments (missing directory entries, `Created-By` attribute). 2. Get this pull request merged. 3. In a separated pull request, copy (in modified form) in this plugin the Maven Archiver code which is still used. This is the code that generates the `MANIFEST.MF` attributes. 4. Refactor in two separated goals. Regarding the JAR file validation, this is one of the reasons for this migration to the `jar` tool but not the only one. There is also additional options such as `--hash-modules`. The support of this option is not included in this pull request because it will be a new feature, but it would be the topic of a future pull request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
