[M2] Repeatable builds and plugin versions

[Gunther Popp <Gu...@web.de>]

Hi!

I've seen several threads in the archive discussing reproducible builds, 
but didn't find an answer to the following issue: A few days ago, a 
number of M2 plugins have been updated in the repository. One of those 
updates, the new site-plugin, broke my existing build. In V2.0-beta-4 
one could define a custom site-directory using the parameter| 
<siteDirectory|> . This feature is broken is V2.0-beta-5 (see MSITE-91)

Once I recognized this, I decided to switch back to the V2.0-beta-4 in 
my POM:
...
  <reporting>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-site-plugin</artifactId>
        <version>2.0-beta-4</version>
       (...)
      </plugin>
   </plugins>
...

However, despite the fact that I declared an explicit plugin-version in 
the POM, Maven still uses V2.0-beta-5 of the site-plugin. I always 
thought that for plugins, the <version> element in the pom defines the 
_exact_ version I would like to use in my build-process. Apparently, I 
was wrong. I tried using the version ranges described in the Maven-book, 
but had no success (Maven throws an error complaining about unknown 
version "[2.0-beta-4]"). Luckily, I'm using a private repository for all 
plugins, so I simply discarded the new release of the site-plugin from 
my repos and everything is fine now.

I'm still wondering, if the described behavior of Maven is intended to 
be so or if  this is a bug. If the <version>-element does not pin-down a 
specific version of a plugin, how can repeatable builds be guaranteed? 
Even with private repos you basically have to archive a complete copy of 
the repo for every release of the product to guarantee that an older 
version can be rebuilt in the future.

CU,

Gunther

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org