[jira] [Commented] (BEAM-2727) Make Beam released artifacts reproducible

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/BEAM-2727?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16114300#comment-16114300 ] 

ASF GitHub Bot commented on BEAM-2727:
--------------------------------------

GitHub user iemejia opened a pull request:

    https://github.com/apache/beam/pull/3685

    [BEAM-2727] Make beam builds reproducible

    Follow this checklist to help us incorporate your contribution quickly and easily:
    
     - [x] Make sure there is a [JIRA issue](https://issues.apache.org/jira/projects/BEAM/issues/) filed for the change (usually before you start working on it).  Trivial changes like typos do not require a JIRA issue.  Your pull request should address just this issue, without pulling in other changes.
     - [x] Each commit in the pull request should have a meaningful subject line and body.
     - [x] Format the pull request title like `[BEAM-XXX] Fixes bug in ApproximateQuantiles`, where you replace `BEAM-XXX` with the appropriate JIRA issue.
     - [ ] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
     - [x] Run `mvn clean verify` to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
     - [ ] If this contribution is large, please file an Apache [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).
    
    ---


You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/iemejia/beam BEAM-2727-reproducible-builds

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/beam/pull/3685.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #3685
    
----
commit 3d0e23044ee4b660011263939d0f0e862f83e051
Author: Ismaël Mejía <ie...@apache.org>
Date:   2017-07-30T08:19:20Z

    [BEAM-2727] Make beam builds reproducible

----


> Make Beam released artifacts reproducible
> -----------------------------------------
>
>                 Key: BEAM-2727
>                 URL: https://issues.apache.org/jira/browse/BEAM-2727
>             Project: Beam
>          Issue Type: Improvement
>          Components: build-system
>    Affects Versions: Not applicable
>            Reporter: Ismaël Mejía
>            Assignee: Ismaël Mejía
>            Priority: Minor
>
> There is a recent movement to create a verifiable path from source code to binary releases in different open source projects. See http://reproducible-builds.org/
> For the case of Java binaries (classes and jars) if we want to have a reproducible build we need to have a consistent build environment so we can reproduce those.
> For Beam we need to create an environment with a fixed version of the Java compiler, maven and its plugins. This is addressed by BEAM-1534. But also by including the (JDK/Maven versions) used to generate the jar artifacts in the information to validate at the vote. Additionally we need to fix the Jar files because by default the maven-jar-plugin include the timestamp of the build in the files which breaks the reproducibility of the process, fortunately there is a Maven plugin that fixes this and that we can include in the release build.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)