You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fesod.apache.org by de...@apache.org on 2026/09/11 03:50:30 UTC
(fesod) branch main updated: build: set fixed project.build.outputTimestamp for reproducible builds (#1094)
This is an automated email from the ASF dual-hosted git repository.
delei pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/fesod.git
The following commit(s) were added to refs/heads/main by this push:
new 3be8b48b build: set fixed project.build.outputTimestamp for reproducible builds (#1094)
3be8b48b is described below
commit 3be8b48b2be8dcde7663d77d10220c5028d27762
Author: ian zhang <ia...@gmail.com>
AuthorDate: Fri Sep 11 11:50:26 2026 +0800
build: set fixed project.build.outputTimestamp for reproducible builds (#1094)
---
pom.xml | 10 +++++-----
website/community/release/release-version.md | 10 ++++++++++
.../current/release/release-version.md | 10 ++++++++++
3 files changed, 25 insertions(+), 5 deletions(-)
diff --git a/pom.xml b/pom.xml
index 6de8cd0b..c02efd4b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -81,11 +81,11 @@ under the License.
<properties>
<revision>2.1.0-incubating</revision>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
- <!-- Clear the parent `apache` POM's stale outputTimestamp (2023): apache-jar-resource-bundle derives the JAR
- NOTICE copyright end-year from it, and a stale value yields an inverted "2025-2023" range. An empty value
- falls back to the current build year, so the NOTICE stays correct without a hardcoded date. For a
- reproducible release, set this to a fixed ISO-8601 commit timestamp (typically done at release pre). -->
- <project.build.outputTimestamp></project.build.outputTimestamp>
+ <!-- Fixed build timestamp for reproducible builds (see https://maven.org.cn/guides/mini/guide-reproducible-builds.html).
+ apache-jar-resource-bundle derives the JAR NOTICE copyright end-year from this value; keep it in the same
+ year range as the release so the NOTICE shows a correct, non-inverted range (e.g. "2025-2026"). Update it
+ to the current release branch's creation time in every release so each build produces identical artifacts. -->
+ <project.build.outputTimestamp>2026-09-10T00:00:00Z</project.build.outputTimestamp>
<java.version>1.8</java.version>
<maven.compiler.target>1.8</maven.compiler.target>
<maven.compiler.source>1.8</maven.compiler.source>
diff --git a/website/community/release/release-version.md b/website/community/release/release-version.md
index 168ae091..1cf5e12c 100644
--- a/website/community/release/release-version.md
+++ b/website/community/release/release-version.md
@@ -316,6 +316,7 @@ For example, to release version `2.0.0-incubating`, follow these steps:
- Create a new branch `2.0.0-incubating` as the release branch.
- Update the version number in `pom.xml` to `2.0.0-incubating`.
+- Set the `project.build.outputTimestamp` in `pom.xml` to a fixed ISO-8601 timestamp (e.g., the release branch creation time) to ensure [reproducible builds](https://maven.org.cn/guides/mini/guide-reproducible-builds.html). If it is left empty, every build records a different timestamp, which does not satisfy reproducible-build requirements.
- Push the RC (Release Candidate) version tag.
```bash
@@ -329,6 +330,15 @@ git tag -s 2.0.0-incubating-rc1 -m "release: release for 2.0.0-incubating RC1"
git push origin 2.0.0-incubating-rc1
```
+When the version is updated, also set a fixed build timestamp:
+
+```bash
+# Set a fixed build timestamp so every build produces identical artifacts
+mvn versions:set-property -Dproperty=project.build.outputTimestamp -DnewVersion=2026-09-10T00:00:00Z
+# Or edit pom.xml directly:
+# <project.build.outputTimestamp>2026-09-10T00:00:00Z</project.build.outputTimestamp>
+```
+
#### 3.3.2 Push Binary Packages
Compile the source code of the pre-release RC branch and push the binary packages to the [staging repository](https://repository.apache.org/#stagingRepositories).
diff --git a/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md b/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md
index b22470a5..5fd68990 100644
--- a/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md
+++ b/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md
@@ -316,6 +316,7 @@ svn ci -m "add gpg key for xxx"
- 创建一个新分支`2.0.0-incubating`作为发布分支
- 修改 `pom.xml` 中的版本号为 `2.0.0-incubating`
+- 将 `pom.xml` 中的 `project.build.outputTimestamp` 设置为固定的 ISO-8601 时间戳（例如发布分支的创建时间），以保证[可复现构建](https://maven.org.cn/guides/mini/guide-reproducible-builds.html)。如果留空，每次构建的时间戳都会不同，不满足可复现构建的要求
- 推送 RC(Release Candidates) 版本标签
```bash
@@ -329,6 +330,15 @@ git tag -s 2.0.0-incubating-rc1 -m "release: release for 2.0.0-incubating RC1"
git push origin 2.0.0-incubating-rc1
```
+同时设置固定的构建时间戳：
+
+```bash
+# 设置固定构建时间戳，保证每次构建产物一致
+mvn versions:set-property -Dproperty=project.build.outputTimestamp -DnewVersion=2026-09-10T00:00:00Z
+# 或直接在 pom.xml 中设置：
+# <project.build.outputTimestamp>2026-09-10T00:00:00Z</project.build.outputTimestamp>
+```
+
#### 3.3.2 推送二进制包
编译预发布RC版本分支源码，并推送二进制包到 [预发仓库](https://repository.apache.org/#stagingRepositories)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fesod.apache.org
For additional commands, e-mail: commits-help@fesod.apache.org