Hi Gary, On Fri, 29 Dec 2023 at 15:11, Gary Gregory <garydgreg...@gmail.com> wrote: > I run, copied from the > https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/compress/commons-compress-1.25.0.buildspec: > > mvn -Prelease clean package package -DskipTests -Dmaven.javadoc.skip > -Dgpg.skip -Dcyclonedx.skip -Dcommons.release.dryRun > -Dcommons.release.isDistModule=false > > Then: > > mvn package package artifact:compare
Maven has a short guide to check reproducibility: https://maven.apache.org/guides/mini/guide-reproducible-builds.html If you want to check a local artifact vs a previous local artifact you need to use: mvn clean install mvn clean package artifact:compare -DskipTests The first run install the artifact into the local Maven repo, the second one generates new ones and compares them with those installed. To check local vs remote you just need the second part. I am able to reproduce the current Commons Compress snapshot with: export TZ=UTC export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64 mvn clean package artifact:compare \ -Dreference.repo=apache.snapshots \ -DskipTests \ -Dcommons.spdx.version=0.7.1 -Dspdx.skip I have no idea how those snapshots are generated, but they match my local ones. The last line bumps the SPDX Maven Plugin to a version that supports `-Dspdx.skip` ;-) Piotr --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h...@commons.apache.org
