[jira] [Created] (MCOMPILER-439) outputTimestamp not applied to module-info; breaks reproducible builds

["Anand Beh (Jira)" <ji...@apache.org>]

Anand Beh created MCOMPILER-439:
-----------------------------------

             Summary: outputTimestamp not applied to module-info; breaks reproducible builds
                 Key: MCOMPILER-439
                 URL: https://issues.apache.org/jira/browse/MCOMPILER-439
             Project: Maven Compiler Plugin
          Issue Type: Bug
    Affects Versions: 3.8.1
         Environment: Mac OS X 10.14.6
JDK 15 (build 15+36)
JDK 11 (build 11.0.8+10)
            Reporter: Anand Beh
         Attachments: Screenshot 2020-10-25 at 2.35.59 PM.png

Setting {{project.build.outputTimestamp}} to a fixed value allows creating reproducible builds per this guide: [https://maven.apache.org/guides/mini/guide-reproducible-builds.html |https://maven.apache.org/guides/mini/guide-reproducible-builds.html]However, if one adds a module-info file to the project, reproducible builds break.

This is caused by module-info.class using the latest timestamp and not {{project.build.outputTimestamp}}. I was able to identify the problem using diffoscope: [https://diffoscope.org/.|https://diffoscope.org/] With it I determined the timestamp across 2 builds was constant for all but the module-info.class:

 
{code:java}
// code placeholder
  -rw----     2.0 fat      862 bl defN 20-Oct-17 00:40 space/arim/libertybans/api/select/SelectionOrder.class
│  -rw----     2.0 fat     1113 bl defN 20-Oct-17 00:40 space/arim/libertybans/api/select/SelectionOrderBuilder.class
│  -rw----     2.0 fat     2285 bl defN 20-Oct-17 00:40 META-INF/maven/space.arim.libertybans/bans-api/pom.xml
│  -rw----     2.0 fat       74 bl defN 20-Oct-17 00:40 META-INF/maven/space.arim.libertybans/bans-api/pom.properties
│ --rw----     2.0 fat      557 bl defN 20-Oct-25 12:39 module-info.class
│ +-rw----     2.0 fat      557 bl defN 20-Oct-25 12:41 module-info.class
{code}
 

Note the + and - which are diffoscope's way of indicating the difference between the .jar files. Here the {{project.build.outputTimestamp}} is on 17 October. As shown, module-info has a "rebellious" timestamp.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)