- configure Maven to run build reproducibly [1]
- use UTC timestamp of checked out commit as build timestamp
- add git-describe, git-commit-id, git-commit-id, git-tags,
git-remote-origin-url to MANIFEST.MF files
- configure cyclonedx-maven-plugin to also use UTC timestamp of
checked out commit
- for packaging build use tycho-buildtimestamp-jgit [2] to ensure
version uses the timestamp of the last commit
- SBOMs are not reproducible by design [3] they should have a build
timestamp matching the time when the build was executed and a serial
number which is a unique UUID per build run. Hence exclude them from
comparison [4].
- Use gmavenplus-plugin to format build timestamps. Maven expects
build timestamp in ISO-8601 format, to replace the qualifier in
versions the timestamp format must be compatible with rules for OSGi
version numbers. Didn't find a way to read the properties set by the
git-commit-id-maven-plugin from another plugin. Hence use JGit in a
groovy script to get the commit time of the current HEAD and provide
it in these two formats.
TODO: packaging build (features and p2 repository) is not yet binary
reproducible since that's not yet supported by Tycho [5], artefacts have
reproducible version numbers but file lastModified timestamps are not
yet reproducible.
Test plan for Maven build:
- build using
mvn clean install"
- verify second build is reproducible:
mvn -T1 clean verify artifact:compare
verification seems not to be thread-safe, hence run it with a single
thread using option -T1
For packaging build (still fails due to non-reproducible file
timestamps):
- build using
mvn -f org.eclipse.jgit.packaging/pom.xml clean install
- verify second build is reproducible:
mvn -T1 -f org.eclipse.jgit.packaging/pom.xml clean verify artifact:compare
[1] https://maven.apache.org/guides/mini/guide-reproducible-builds.html
[2] https://wiki.eclipse.org/Tycho/Reproducible_Version_Qualifiers
[3] https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/84
[4] https://maven.apache.org/plugins/maven-artifact-plugin/compare-mojo.html
[5] https://github.com/eclipse-tycho/tycho/issues/233
Change-Id: I0202f55a1b6ae0edd922cfef638beb39d2ce9417
* stable-6.6:
Update to Tycho 4.0.1
Add verification in GcKeepFilesTest that bitmaps are generated
Express the explicit intention of creating bitmaps in GC
GC: prune all packfiles after the loosen phase
Prepare 5.13.3-SNAPSHOT builds
JGit v5.13.2.202306221912-r
Change-Id: I7294c21748897eb3f94eeffbda944b62e3206c0d
Tycho 4.0.0-SNAPSHOT is no longer available and it's a bad practice to
depend on any snapshot version (we had to since this was the only way
to get gpg signing to work in time for releasing 6.6.0).
Change-Id: I1d4af5f69965b4cad50b379fd81f6f442b38c8d0
Now that it is released there is no need anymore to use a snapshot
version.
Change-Id: Idd35c48022370abf18049ef4b6ddd6253613888e
Signed-off-by: Thomas Wolf <twolf@apache.org>
We need to update to Tycho in order to force PGP signing of the
bouncycastle libraries which isn't supported by earlier Tycho versions.
For that we need to run Maven on Java 17 or higher.
In order to run tests on Java 11 add a `toolchain.xml` file into the
`~/.m2` directory providing the path to Java installations:
<?xml version='1.0' encoding='UTF-8'?>
<toolchains>
<toolchain>
<type>jdk</type>
<provides>
<id>JavaSE-11</id>
<version>11</version>
</provides>
<configuration>
<jdkHome>/path/to/java-11</jdkHome>
</configuration>
</toolchain>
<toolchain>
<type>jdk</type>
<provides>
<id>JavaSE-17</id>
<version>17</version>
</provides>
<configuration>
<jdkHome>/path/to/java-17</jdkHome>
</configuration>
</toolchain>
</toolchains>
Change-Id: Ib0f18147826e5b4a7fa1f41590772516269de702
- com.github.siom79.japicmp:japicmp-maven-plugin to 0.17.2
- com.github.spotbugs:spotbugs-maven-plugin to 4.7.3.4
- maven-clean-plugin to 3.2.0
- maven-compiler-plugin to 3.11.0
- maven-deploy-plugin to 3.1.1
- maven-enforcer-plugin to 3.3.0
- maven-javadoc-plugin to 3.5.0
- maven-project-info-reports-plugin to 3.4.3
- maven-resources-plugin to 3.3.1
- maven-surefire-plugin to 3.0.0
- maven-surefire-report-plugin to 3.0.0
- org.codehaus.mojo:build-helper-maven-plugin to 3.3.0
- org.jacoco:jacoco-maven-plugin to 0.8.10
- org.springframework.boot:spring-boot-maven-plugin to 2.7.11
Change-Id: I42f3a09362a3b1afef65981cd3a862780f592af2
* stable-6.5:
Ensure parsed RevCommitCG has derived data from commit-graph
Downgrade maven-site-plugin to 3.12.1
Use wagon-ssh-external to deploy Maven site
Change-Id: Ide721fb088fa04f6276ac495968a45e732f6e139
This may fix the current authentication failures happening when trying
to deploy the jgit Maven site.
Change-Id: I55d4706cd041d93194af48fac9e8bfcd067e2cac
Remove tycho-extras-version, because Tycho and Tycho Extras are
meanwhile in a single repository and maintained together.
Update
- build-helper-maven-plugin to 3.3.0
- eclipse-jarsigner-plugin to 1.3.5
- jacoco-maven-plugin to 0.8.8
- japicmp to 0.17.1
- maven-antrun-plugin to 3.1.0
- maven-clean-plugin to 3.2.0
- maven-compiler-plugin to 3.10.1
- maven-dependency-plugin to 3.5.0
- maven-deploy-plugin to 3.0.0
- maven-enforcer-plugin to 3.1.0
- maven-install-plugin to 3.1.0
- maven-jar-plugin to 3.3.0
- maven-javadoc-plugin to 3.4.1
- maven-jxr-plugin to 3.3.0
- maven-pmd-plugin to 3.20.0
- maven-project-info-reports-plugin to 3.4.2
- maven-resources-plugin to 3.3.0
- maven-shade-plugin to 3.4.1
- maven-site-plugin to 4.0.0-M4
- maven-surefire-plugin to 3.0.0-M8
- spotbugs-maven-plugin to 4.7.3.0
- spring-boot-maven-plugin to 2.7.7
Change-Id: I14d9ff06d2f509d782eb63adfa6b5733649f11f1
Matthias Sohn