[MNG-8258] activate Reproducible Builds by default

[jira-importer]

Hervé Boutemy opened MNG-8258 and commented

Reproducible Builds is a good practice that is easy to enable: it would be nice to enable it by default, and have projects

• either disable it (<project.build.outputTimestamp>x</project.build.outputTimestamp>) if they really have a problem with the default Reproducible behaviour
• or customize locally the value of the default Maven core-provided timestamp, to have a project-specific value

---

Affects: 3.9.9, 4.0.0-beta-4

Issue Links:

• MSHARED-1430 Use a predefined constant for project.build.outputTimestamp
  ("supercedes")
• MNG-6276 Support Reproducible Builds (https://reproducible-builds.org)
  ("depends upon")

Remote Links:

• GitHub Pull Request #563
  
• GitHub Pull Request #1726
  
• GitHub Pull Request #1813
  
• discussion on dev@maven.apache.org
  
• Wiki Reproducible/Verifiable Builds
  
• Configuring for Reproducible Builds
  

Backported to: 4.0.0-beta-5

0 votes, 5 watchers

[jira-importer]

Guillaume Nodet commented

Would it be possible to get the warning from Maven instead of having to run a plugin to find that ?

[jira-importer]

Hervé Boutemy commented

Would it be possible to get the warning from Maven instead of having to run a plugin to find that ?

of course, plugin code can go into Maven core: but is it a good idea?
for example: do we code enforcer's JDK and Maven minimum version checks into core, or let the plugin do its job when people are interested to check?

the spirit for now is: have a reasonable default even if basic, let people override if they are more opinionated (disable or get a value dedicated to their project instead of default)

adding warning for people who don't care is just causing friction (the type of friction we removed when adding default encodings)

[jira-importer]

Hervé Boutemy commented

additional notice: "[WARNING] <project.build.outputTimestamp> property is inherited, it should be defined in pom.xml"
probably this message from artifact:checkbuildplan is too aggressive: it's a pure project choice to define if it cares about having a project-specific timestamp for entries in its jar files
having the default value from super pom is perfectly fine, it does not deserve any warning: more an INFO = "this project inherits timestamp from parent pom, value xxx"
MARTIFACT-71 issue created for that...

[jira-importer]

Sergey Ponomarev commented

I created a PR to change the 1 Jan 2001 to the Gradle's 1 Feb 1080 #1813

[jira-importer]

Andreas Höhmann commented

Just a little hint because I found this "relation" right now while I'm working on qoomon/maven-git-versioning-extension#340 :)

There is another "special" value for the "project.build.outputTimestamp" in the springboot-maven-plugin. They decide to accept also "off" here :)

https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-tools/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/BuildInfoMojo.java#L81

Is there an official schema for the allowed values inside project.build.outputTimestamp ?

[jira-importer]

Sergey Ponomarev commented

See method that parses the timestamp https://github.com/apache/maven-archiver/blob/master/src/main/java/org/apache/maven/archiver/MavenArchiver.java#L692