desruisseaux commented on PR #508: URL: https://github.com/apache/maven-jar-plugin/pull/508#issuecomment-5395040822
> I might add the actual JDK version since reproducible builds require the same toolchain for now. Are we requiring toolchain? I thought that we were betting on different JDKs producing the same bytecode when used with the same `--release` version (which seems a fragile assumption). > For the record, I do not think "semantically reproducible builds" are a thing. Byte-per-byte comparison is the only thing that works. For the security goal, I have not yet seen a technical argument explaining why semantically reproducible builds would not work. On the contrary, I think that it is _more_ secure than strictly reproducible builds for the [reason given above](https://github.com/apache/maven-jar-plugin/pull/508#issuecomment-5353734439). In addition of security goal, it seems that there is also a caching goal. It has been argued that Docker images use hash-code for caching JAR files. This is a more difficult case and may be a reason to keep strictly reproducible builds as an option, but not necessarily a reason for makes it the default if semantically reproducible builds can be guaranteed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
