Conversation
- e.g. all files now have fixed timestamp of '02-01-1980 00:00' and fixed permissions - furthermore OSGi MANIFEST.MF has no timestamped attributes
* this makes it easier to build e.g. when no JDK16 is installed. It installs it automatically (see https://docs.gradle.org/current/userguide/toolchains.html#sub:download_repositories). see also the discussion here apache#79 (comment) Feel free to exclude this commit if this should be in a separate PR
|
@ddekany those changes are an attempt for a reproducible build. (see discussion #79 (review) ) One nice side effect could be to show up in this list at https://github.com/jvm-repo-rebuild/reproducible-central Feel free to cherry pick whatever you see fit. It tried to describe what the change does in the description above. |
|
So is it already reproducible with this little change? Things to consider:
|
This change at least makes the (linux) file-timestamps and permissions kinda static and removes timestamps from Manifest.MF. So yes to a large extend it is. I based my suggestion here on this which I was suggested recently as an example for a reproducible build. Where I am unsure is the timestamps in the local build vs. release build e.g. But my assumption was that the "real" release build won't have the timestamp. Maybe you could try to do a preview of a real release build without the timestamps (or tell me how). But I am not an expert. We could start with this. I think more information can be found here also a list of tools to verify it.
Feel free to remove this commit about Only the first commit 1f9800c is related to reproducibility.
Not sure I understand. I have used
Not sure I understand how this relates to reproducible. Is this something affection the build result artifact (freemarker.jar)? |
|
So there's The version number itself has no date in a release (see in
|
Ok thanks for the tip. The I managed to get a reproducible build locally. But I had to manually adjust versions.properties and completely remove all the qualifiers and @-variables from I guess this is not how its done, but at least it proves that if the output of What do I need to do, to build so the version is I think it basically comes down to "How to to create a
You mean more specific to "what exact Java version (incl. build) to use and to do to get the exact same build result"? I need to get a bit more familiar with it. I just found out about it.
How do you create this |
Yes. Like is it Oracle, is it OpenJDK, etc., and then which build exactly. I assume we have to specify that, and from there, the JDK will be pretty much always downloaded at first build (because the user doesn't have exactly the same version).
|
* I did that because there are testcases which failed when removing the buildTimestamp completely. Also there is code reading it. To stay backwards compatible we return a fixed date. * if this should be removed completely then more places needed to be adjusted, which I tried to avoid here to keep it simple
* this does not touch the other artifacts like source distribution and thus avoids problems with files like gradlew not being executable
* because otherwise they are replaced during the build with a timestamp
* now attributes are applied to all jars e.g. freemarker-gae-2.3.33-sources.jar freemarker-gae-2.3.33-javadoc.jar freemarker-gae-2.3.33.jar
Ok thanks. I discovered one problem: The tokens like That way during a release you only have to adjust the real properties Few more words to my latest 3 commits: c9aa766 : I decided to NOT remove the 17ee92c and 5bcc56f: here I think I fixed the problem related to executability of
I just applied the permissions and reproducible attributes (file timestamps, ordering) to the contents of the .jar files e.g. in IMO these three files are what's need to be reproducible.
Hmm regarding exact vendor and version. I did a little more investigation. I found that you could specify the vendor. The guide e.g. https://maven.apache.org/guides/mini/guide-reproducible-builds.html mentions:
And I have the feeling that this is the way it is treated. The
So I don't really know how to proceed. My gut feeling is that we could keep it like it is now. We could provide to make it easier to build right away, but document in the README that for a reproducible build a specific JDK is required.
Oh, so simple.. Thanks :) One thing I could not test: Only Maybe you could try it since I guess you have this |
Now that that the timestamp causes complications, we should just change the convention to
I say, we just keep it in the
Ironically, we did have the exact JDK version in the META-INF of
Yeah, releases must be signed. (If you have |
Version.getBuildDate() now always returns null because we do not store the buildTimestamp anymore for reproducible builds
|
But because we don't download a specific JDK (although even if we did, one wonders if that will be possible few years later), I think it's better if the information is not there. Because, in your case, if someone rebuilds this, it very likely will not be Eclipse Adoptium, while here's a realistic chance that the 16 they use generates the same bytecode. That's why I though that it's just 16 then, and we put the information about the exacy JDK variant elsewhere, like into the source artifact and source distro tgz. |
This reverts commit d186a91.
I see. Just reverted this. So no JDK in the MANIFEST.MF. I will check how to put
|
|
FYI, now you can issue |
* now the source distribution tarball (e.g. apache-freemarker-gae-src-2.3.33.tgz) contains a .buildinfo file containing information about how the source is to be built to get a reproducible build * based on https://reproducible-builds.org/docs/jvm/ * we can add more information if needed Example output: #Effective recorded build environment information #Tue Dec 26 12:08:57 CET 2023 source.scm.uri=scm\:git\:https\://git-wip-us.apache.org/repos/asf/freemarker.git build-tool=gradle build.setup=https\://github.com/apache/freemarker/blob/2.3-gae/README.md\#building-freemarker java.vendor=Eclipse Adoptium java.version=17.0.9 os.name=Mac OS X buildinfo.version=1.0-SNAPSHOT source.scm.tag=v2.3.33
Thanks. Commit 3791ef5 now creates a E.g. my local build created this: Where would you mention and explain this file? |
| private final String originalStringValue; | ||
|
|
||
| private final Boolean gaeCompliant; | ||
| private final Date buildDate; |
There was a problem hiding this comment.
Admittedly this has near 0 practical importance, but... as Version has public constructor, and we allow passing in the build date, it would be more round if getBuildDate() still gives back the same value. Even if it will be almost always null.
There was a problem hiding this comment.
Ok than I misinterpreted your previous comment.
I say, we just keep it in the
VersionAPI, but mark it as deprecated, and always returnnull. (It was documented that it can returnnull, and it's quite unlikely that anyone even calls that method, and also fails onnull.)
Could you please clarify?
Do you mean we keep Version.java as it was before, but just remove the part in Configuration.java
9a138b6#diff-114f8ea56965362193c291c9a631f7c7860c71c8ec76a94b16f5f801267bd578
There was a problem hiding this comment.
Yes, Version need not change, we just won't have the build date in version.properties.
|
I guess |
I could do that.
|
Yes, but I guess, if someone ever wants to check a build, they check against a jar on Maven Central, and that's published together with source artifact. The src distro is not necessarily that tightly coupled. But it's a minor thing really. |
Ok. Should I put it in the root of the jar or META-INF ? Currently there is nothing in the root. EDIT: in root it would be
|
* then this would also be in the sources.jar in maven central
|
The root is fine. |
* as discussed we keep the buildDate in Version.java but deprecate the getBuildDate() method. * but we keep the new behavior that Configuration.java does not pass the buildDate anymore to the constructor since it we removed it from version.properties
Ok I just commited this. I also reverted the Let me know if you had something else in mind. |
|
Ok, I am done for today. Let me know if you see more issues. |
|
I will merge this (then add stuff to README and version history). Can you send me the exact e-mail address you were using for the Apache ICLA (assuming you have an ICLA)? |
Sent you an email |
|
Did some cleanup/docs after merge: 663925c |
|
Great thanks. |


Before this change:
After this change:
Also there are differences in the MANIFEST.MF
Attached 2 files before.txt and after.txt to compare the outputs.
MANIFEST.MF is the printable output from the jarviewer of bndtools which produces a nice readable output.
after.txt
before.txt