[GitHub] [maven-apache-parent] hboutemy edited a comment on pull request #35: MPOM-261 create buildinfo file for reproducible builds

[GitBox <gi...@apache.org>]

hboutemy edited a comment on pull request #35:
URL: https://github.com/apache/maven-apache-parent/pull/35#issuecomment-783971716


   > Are you also implying that the buildinfo is not necessary even in the long-term for Maven based projects as the relevant information can be derived from pom.xml and MANIFEST.MF or do you agree that the buildinfo in the long term should be published along with the artifacts?
   
   in short, currently, even in the long term, I don't see much benefit in publishing buildinfo.
   
   > For me the primary goal is to verify that the build artifacts published/downloaded from Central are really based on a specific source. For that the buildinfo is crucial as otherwise you have to rely on heuristics
   
   We're ok on the goal. But on buildinfo being crucial, I thought when I wrote the spec, but I'm less convinced nowadays after 1 year of experience of really rebuilding and checking if expected reproducible build is really reproducible or not.
   
   Key reason is: **having a buildinfo does not prove that the build is reproducible**
   
   Did you try to rebuild a release that you did not produce yourself at first?
   
   Notice: please continue the discussion, it's useful to dig as we are doing, because we're doing the journey to effective reproducibility check = what we need


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org