Hi all,
I am trying to investigate why `commons-daemon:commons-daemon:1.4.0` release is unreproducible and how to fix it. Since I did not see any related mail here<https://lists.apache.org/list?dev@commons.apache.org:lte=1M:reproducible>, I thought I should start another thread. The diff between the artifacts are documented here<https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/commons-daemon/commons-daemon-1.4.0.diffoscope>. It seems most of the zip and tar archives have some binaries missing. For example, `commons-daemon-1.4.0-bin-windows.zip` has three missing Windows executables. Checking the release instructions<https://github.com/apache/commons-daemon/blob/2b4fa9a14b8b073ade4c95ba4564455c06e1ae29/HOWTO-RELEASE.txt#L83-L100>, it seems that these executables require running some shell scripts and nmake command. Hence, I tried to make the release reproducible by placing the commands under `execBefore` in the buildspec file<https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/doc/BUILDSPEC.md>. It seems that it fixes artifacts "commons-daemon-1.4.0-native-src.tar.gz commons-daemon-1.4.0-native-src.zip commons-daemon-1.4.0-src.tar.gz commons-daemon-1.4.0-src.zip", however, `commons-daemon-1.4.0-bin-windows.zip` still marked as unreproducible. I saw that it builds with nmake which is on Windows. A solution make build scripts portable is to use `cmake`. I think successfully building them and place them in the target folder should achieve a successful reproducible build. Regards, Aman Sharma PhD Student KTH Royal Institute of Technology School of Electrical Engineering and Computer Science (EECS) Department of Theoretical Computer Science (TCS) <http://www.kth.se><https://www.kth.se/profile/amansha><https://www.kth.se/profile/amansha> <https://www.kth.se/profile/amansha>https://algomaster99.github.io/
