[jira] [Comment Edited] (MPOM-255) Enforce local property "project.build.outputTimestamp" for reproducible builds

["Herve Boutemy (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MPOM-255?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17465042#comment-17465042 ] 

Herve Boutemy edited comment on MPOM-255 at 12/24/21, 2:52 PM:
---------------------------------------------------------------

FYI, I added a check and a message in artifact:compare: see MARTIFACT-28

I know it's done when checking reproduciblity instead of normal initial build time, but that's a step in the right direction


was (Author: hboutemy):
FYI, I added a check and a message in artifact:compare: see MARTIFACT-28

> Enforce local property "project.build.outputTimestamp" for reproducible builds
> ------------------------------------------------------------------------------
>
>                 Key: MPOM-255
>                 URL: https://issues.apache.org/jira/browse/MPOM-255
>             Project: Maven POMs
>          Issue Type: Improvement
>          Components: asf
>    Affects Versions: ASF-23
>            Reporter: Konrad Windszus
>            Assignee: Michael Osipov
>            Priority: Major
>             Fix For: ASF-24
>
>
> In case the release's root pom.xml doesn't overwrite "project.build.outputTimestamp" it takes the value from [https://github.com/apache/maven-apache-parent/blob/4813409e6a1ecfea11c8eb22a5f0443f790f1454/pom.xml#L95.]
> Instead of the fallback an enforcer rule should be added to require a property "project.build.outputTimestamp" to be set in the right format for reproducible builds to work ([https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-do-i-configure-my-maven-build]) for every pom.xml locally.
> Only that way the timestamps are automatically adjusted with each release (https://issues.apache.org/jira/browse/MRELEASE-1029)



--
This message was sent by Atlassian Jira
(v8.20.1#820001)