[
https://issues.apache.org/jira/browse/MSOURCES-120?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16923638#comment-16923638
]
Hervé Boutemy commented on MSOURCES-120:
----------------------------------------
thank you for the hint: I added some details to the output to confirm/show:
on my machine, with Paris timezone UTC+2:
{noformat}reproducible-1.0-sources.jar sha1 =
7bd062f9b45afb7423f3c004c8080ebad4e98754
encoding: UTF8
timezone offset (minutes): -120
M size (cmp) crc java time date time zip time mode name
-comment; extra
8 25 ( 27) ee027fb2 1566419332000 2019-08-21 22:28:52 1326822298 100644
META-INF/MANIFEST.MF ; 0{noformat}
on ASF CI server, with UTC configuration:
{noformat}reproducible-1.0-sources.jar sha1 =
acf461ff37ddc3c44c620770a73d9cf42f7ca429
encoding: UTF8
timezone offset (minutes): 0
M size (cmp) crc java time date time zip time mode name
-comment; extra
8 25 ( 27) ee027fb2 1566419332000 2019-08-21 20:28:52 1326818202 100644
META-INF/MANIFEST.MF ; 0{noformat}
as you can see from the "zip time field", which is the long value that is
really stored in the zip stream, we get 1326822298 for a machine in UTC+2 but
1326818202 for a machine in UTC
now, I'll update the code to trick the Java timestamp using local timezone:
this will give unexpected different Dates in Java (should I say incorrect?),
but from a zip stream perspective, we'll get the same value on every timezone
Zip dates are tricky :)
> Reproducible Builds: make entries in output jar files reproducible (order +
> timestamp)
> --------------------------------------------------------------------------------------
>
> Key: MSOURCES-120
> URL: https://issues.apache.org/jira/browse/MSOURCES-120
> Project: Maven Source Plugin
> Issue Type: New Feature
> Affects Versions: 3.0.1
> Reporter: Hervé Boutemy
> Priority: Major
>
> since a jar file is a zip file, entries order and timestamp are a natural
> source of non Reproducible Builds:
> https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=74682318
--
This message was sent by Atlassian Jira
(v8.3.2#803003)
