It has been pointed out to me that this claim is too strong. I would want to take it back and simply admit that I was not able to reproduce the artifacts from source. I will appreciate any help to build those Windows binary and package them in the jar on my Linux machine.
Regards, Aman Sharma PhD Student KTH Royal Institute of Technology School of Electrical Engineering and Computer Science (EECS) Department of Theoretical Computer Science (TCS) <http://www.kth.se><https://www.kth.se/profile/amansha><https://www.kth.se/profile/amansha> <https://www.kth.se/profile/amansha>https://algomaster99.github.io/ ________________________________ From: Aman Sharma Sent: Monday, January 27, 2025 6:07:55 PM To: dev@commons.apache.org Cc: herve.bout...@gmail.com Subject: Release commons-daemon:commons-daemon:1.4.0 is unreproducible Hi all, I am trying to investigate why `commons-daemon:commons-daemon:1.4.0` release is unreproducible and how to fix it. Since I did not see any related mail here<https://lists.apache.org/list?dev@commons.apache.org:lte=1M:reproducible>, I thought I should start another thread. The diff between the artifacts are documented here<https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/commons-daemon/commons-daemon-1.4.0.diffoscope>. It seems most of the zip and tar archives have some binaries missing. For example, `commons-daemon-1.4.0-bin-windows.zip` has three missing Windows executables. Checking the release instructions<https://github.com/apache/commons-daemon/blob/2b4fa9a14b8b073ade4c95ba4564455c06e1ae29/HOWTO-RELEASE.txt#L83-L100>, it seems that these executables require running some shell scripts and nmake command. Hence, I tried to make the release reproducible by placing the commands under `execBefore` in the buildspec file<https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/doc/BUILDSPEC.md>. It seems that it fixes artifacts "commons-daemon-1.4.0-native-src.tar.gz commons-daemon-1.4.0-native-src.zip commons-daemon-1.4.0-src.tar.gz commons-daemon-1.4.0-src.zip", however, `commons-daemon-1.4.0-bin-windows.zip` still marked as unreproducible. I saw that it builds with nmake which is on Windows. A solution make build scripts portable is to use `cmake`. I think successfully building them and place them in the target folder should achieve a successful reproducible build. Regards, Aman Sharma PhD Student KTH Royal Institute of Technology School of Electrical Engineering and Computer Science (EECS) Department of Theoretical Computer Science (TCS) <http://www.kth.se><https://www.kth.se/profile/amansha><https://www.kth.se/profile/amansha> <https://www.kth.se/profile/amansha>https://algomaster99.github.io/
