[
https://issues.apache.org/jira/browse/TIKA-4591?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18048941#comment-18048941
]
Hervé Boutemy commented on TIKA-4591:
-------------------------------------
> Set project.build.outputTimestamp property
you have a timestamp in parent pom
https://github.com/apache/tika/blob/main/tika-parent/pom.xml#L290
so that's already done: no need to add another in tika-server/pom.xml
from ideal practice, the only improvements that could be done would be:
- replace numeric value with a more human readable format "YYYY-MM-DDTHH:MM:SSZ"
- eventually update your release process to update the value at release time
(usually, people prefer having a timestamp that represents the release instant
in time)
> Implement Reproducible Builds for tika-server
> ---------------------------------------------
>
> Key: TIKA-4591
> URL: https://issues.apache.org/jira/browse/TIKA-4591
> Project: Tika
> Issue Type: Sub-task
> Reporter: Nicholas DiPiazza
> Priority: Major
> Labels: build, reproducible-builds, security, tika-server
>
> h2. Objective
> Implement reproducible builds for the tika-server module to ensure
> bit-for-bit identical outputs across different build environments.
> h2. Tasks
> * Configure Maven properties for reproducible builds in tika-server/pom.xml
> * Set project.build.outputTimestamp property
> * Configure maven-jar-plugin for reproducible archive creation
> * Configure maven-source-plugin for reproducible source archives
> * Configure maven-assembly-plugin if used for distribution packaging
> h2. Verification
> * Build tika-server multiple times and verify checksums match
> * Build on different machines/environments and verify reproducibility
> * Generate and verify .buildinfo file
> * Document verification steps
> h2. Acceptance Criteria
> # tika-server JAR builds are reproducible
> # Source archives are reproducible
> # All timestamps are normalized
> # buildinfo file is generated and validates successfully
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
