Martijn Visser created FLINK-40460:
--------------------------------------
Summary: Upgrade archive-producing Maven plugins to
reproducible-capable versions
Key: FLINK-40460
URL: https://issues.apache.org/jira/browse/FLINK-40460
Project: Flink
Issue Type: Improvement
Components: Build System
Reporter: Martijn Visser
Flink inherits {{project.build.outputTimestamp=2025-06-09T20:48:22Z}} from
Apache
Parent POM 35, which should put every archive-producing plugin into
maven-archiver's reproducible mode. It has no effect today, because Flink pins
several of those plugins to versions that predate that support.
{{mvn org.apache.maven.plugins:maven-artifact-plugin:3.6.0:check-buildplan}}
currently fails in 173 of 173 modules:
||Plugin||Pinned||Minimum required||Modules affected||
|maven-remote-resources-plugin|3.2.0|3.3.0|173|
|maven-jar-plugin|2.4|3.2.0|149|
|maven-assembly-plugin|2.4|3.2.0|2|
|maven-archetype-plugin|2.2|3.2.0|3|
Every one of these pins carries a {{$NO-MVN-MAN-VER$}} marker (an Eclipse m2e
warning suppressor), which is why the staleness has gone unnoticed.
Proposal: drop the pins where Apache Parent 35 already manages a
reproducible-capable version (jar 3.4.2, remote-resources 3.3.0, assembly
3.7.1), and bump maven-archetype-plugin together with the archetype-packaging
extension to 3.4.1, which the parent does not manage.
maven-jar-plugin 3.x additionally rejects a classifier-less {{jar}} execution
that would replace the main artifact ("You have to use a classifier to attach
supplemental artifacts to the project instead of replacing them"), which 2.4
tolerated silently. Four modules depend on the old behaviour and have to be
adjusted in the same change:
* flink-s3-fs-hadoop, flink-s3-fs-presto, flink-dist: redundant id-less {{jar}}
executions. The {{Multi-Release: true}} entry they appear to exist for comes
from the plugin-level {{<configuration>}} and survives their removal.
* flink-runtime-web: five executions building manifest-only test fixtures.
Ported to maven-assembly-plugin with {{{}<attach>false</attach>{}}}, matching
the
existing convention in flink-clients and flink-tests. A classifier is not an
option: jar-plugin 3.x has no {{attach}} parameter, and a classifier would
change the filenames the tests resolve and publish five test artifacts.
Note this changes the manifest of all published jars: {{{}Archiver-Version{}}},
{{Built-By}} and {{Implementation-Vendor-Id}} are dropped, {{Created-By}} names
the plugin rather than the building machine's Maven, {{Build-Jdk}} becomes
{{{}Build-Jdk-Spec{}}}, and {{Specification-Version}} becomes {{2.4}} rather
than
{{{}2.4-SNAPSHOT{}}}. Nothing in the repository reads these attributes.
Out of scope, as follow-ups:
* maven-source-plugin 3.2.1 -> parent-managed 3.3.1, maven-deploy-plugin 2.4,
maven-clean-plugin 2.5. None produce archives, so check-buildplan passes
without them.
* maven-release-plugin 2.1 -> 3.x, which is what maintains outputTimestamp per
release.
* Byte-for-byte reproducibility itself remains blocked by shade's
ApacheNoticeResourceTransformer writing a build-time-stamped aggregated
META-INF/NOTICE, cyclonedx SBOMs, the flink-runtime-web npm/webpack bundle,
Scala compilation, and the {{tar czf}} in
tools/releasing/create_binary_release.sh. This ticket only makes the build
plan pass the static check.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
