[
https://issues.apache.org/jira/browse/MARTIFACT-36?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17691422#comment-17691422
]
Herve Boutemy edited comment on MARTIFACT-36 at 2/21/23 7:19 AM:
-----------------------------------------------------------------
the purpose of {{artifact:compare}} is to compare 2 binaries (actual output
against reference): it takes all factors into account (obviously) because it's
basic binary comparison
what you seem to look for is an automagic analysis and explanation of *why*
binary result is different: explaining _why_ is beyond {{artifact:compare}}
purpose
in case of binary difference, {{artifact:compare}} just propose a
{{diffoscope}} command to help the user get more details on the difference:
it's up to the user to use this command or any other way to do his human
analysis (with a brain) to understand why the difference is there (yes, it
could be because of a timezone difference between the reference builder and the
rebuilder, it could be many other reasons)
In my first comment, I said something in a misleading way:
bq. compare goal detects the issue: the result is not reproducible
compare goal does not really detect that the result *is not reproducible*, but
only that the *current rebuild is different from reference*
it cannot say if some environment change (for example JDK version, Maven
version, timezone, Operating System, other mvn CLI parameters...) could give a
rebuild result that matches reference build
Said another way:
- if artifact:compare says the rebuild output equals reference, it shows the
build is reproducible (without explaining which parts of the rebuilder
environment were significant)
- if artifact:compare says the rebuild output differs from reference, it does
not show that changing something in the rebuilder environment may fix the
output: the project may have reproducible builds, but just have some
environment prerequisites. Notice that the project may not be reproducible at
all, like when output contain a "current" timestamp, that varies on every build
was (Author: hboutemy):
the purpose of {{artifact:compare}} is to compare 2 binaries (actual output
against reference): it takes all factors into account because it's basic binary
comparison
what you seem to look for is an automagic analysis and explanation of *why*
binary result is different: explaining _why_ is beyond {{artifact:compare}}
purpose
in case of binary difference, {{artifact:compare}} just propose a
{{diffoscope}} command to help the user get more details on the difference:
it's up to the user to use this command or any other way to do his human
analysis (with a brain) to understand why the difference is there (yes, it
could be because of a timezone difference between the reference builder and the
rebuilder, it could be many other reasons)
In my first comment, I said something in a misleading way:
bq. compare goal detects the issue: the result is not reproducible
compare goal does not really detect that the result *is not reproducible*, but
only that the *current rebuild is different from reference*
it cannot say if some environment change (for example JDK version, Maven
version, timezone, Operating System, other mvn CLI parameters...) could give a
rebuild result that matches reference build
Said another way:
- if artifact:compare says the rebuild output equals reference, it shows the
build is reproducible (without explaining which parts of the rebuilder
environment were significant)
- if artifact:compare says the rebuild output differs from reference, it does
not show that changing something in the rebuilder environment may fix the
output: the project may have reproducible builds, but just have some
environment prerequisites. Notice that the project may not be reproducible at
all, like when output contain a "current" timestamp, that varies on every build
> compare goal does not detect timezone changes
> ---------------------------------------------
>
> Key: MARTIFACT-36
> URL: https://issues.apache.org/jira/browse/MARTIFACT-36
> Project: Maven Artifact Plugin
> Issue Type: Bug
> Components: artifact:compare
> Affects Versions: 3.3.0
> Reporter: Michael Osipov
> Priority: Critical
>
> Consider:
> CI server in Europe/Berlin
> User in Europe/Paris.
> Let's compare:
> {noformat}
> osipovmi@deblndw011x:~/var/Projekte/lda-cafe/backend-services/service-controller
> ((v2.4) %)
> $ mvn clean verify artifact:compare -DskipTests -Dreference.repo=lda-public
> [INFO] Scanning for projects...
> [INFO]
> [INFO] --------------< com.siemens.lda.cafe:service-controller
> >---------------
> [INFO] Building service-controller 2.4
> [INFO] --------------------------------[ jar
> ]---------------------------------
> [INFO]
> [INFO] --- maven-clean-plugin:3.2.0:clean (default-clean) @
> service-controller ---
> [INFO] Deleting
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target
> [INFO]
> [INFO] --- maven-enforcer-plugin:3.1.0:enforce (enforce-maven) @
> service-controller ---
> [INFO]
> [INFO] --- jacoco-maven-plugin:0.8.3:prepare-agent (default) @
> service-controller ---
> [INFO] argLine set to
> -javaagent:/net/home/osipovmi/.m2/repository/org/jacoco/org.jacoco.agent/0.8.3/org.jacoco.agent-0.8.3-runtime.jar=destfile=/var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/jacoco.exec,excludes=com/siemens/lda/cafe/servicecontroller/exception/**:com/siemens/lda/cafe/servicecontroller/test/**:com/siemens/lda/cafe/servicecontroller/test_integration/**:com/siemens/lda/cafe/servicecontroller/core/model/**:com/siemens/lda/cafe/servicecontroller/config/BeanConfig:com/siemens/lda/cafe/servicecontroller/security/CustomJwtValidator:com/siemens/lda/cafe/servicecontroller/ServiceControllerApplication:com/siemens/lda/cafe/servicecontroller/security/**:com/siemens/lda/cafe/servicecontroller/repository/generic/impl/GatewayJobRepository:com/siemens/lda/cafe/servicecontroller/repository/generic/impl/GatewayModuleRepository
> [INFO]
> [INFO] --- maven-resources-plugin:3.3.0:resources (default-resources) @
> service-controller ---
> [INFO] Copying 8 resources
> [INFO]
> [INFO] --- maven-compiler-plugin:3.10.1:compile (default-compile) @
> service-controller ---
> [INFO] Changes detected - recompiling the module!
> [INFO] Compiling 161 source files to
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/classes
> [INFO]
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/config/SslConfiguration.java:
>
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/config/SslConfiguration.java
> uses or overrides a deprecated API.
> [INFO]
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/config/SslConfiguration.java:
> Recompile with -Xlint:deprecation for details.
> [INFO]
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/core/model/request/generic/RequestContentDisposition.java:
> Some input files use unchecked or unsafe operations.
> [INFO]
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/core/model/request/generic/RequestContentDisposition.java:
> Recompile with -Xlint:unchecked for details.
> [INFO]
> [INFO] --- maven-resources-plugin:3.3.0:testResources (default-testResources)
> @ service-controller ---
> [INFO] Copying 156 resources
> [INFO]
> [INFO] --- maven-compiler-plugin:3.10.1:testCompile (default-testCompile) @
> service-controller ---
> [INFO] Changes detected - recompiling the module!
> [INFO] Compiling 30 source files to
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/test-classes
> [INFO]
> [INFO] --- maven-surefire-plugin:3.0.0-M7:test (default-test) @
> service-controller ---
> [INFO] Tests are skipped.
> [INFO]
> [INFO] --- jacoco-maven-plugin:0.8.3:report (report) @ service-controller ---
> [INFO] Skipping JaCoCo execution due to missing execution data file.
> [INFO]
> [INFO] --- maven-jar-plugin:3.3.0:jar (default-jar) @ service-controller ---
> [INFO] Building jar:
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/service-controller-2.4.jar
> [INFO]
> [INFO] --- spring-boot-maven-plugin:2.5.5:repackage (default) @
> service-controller ---
> [INFO] Replacing main artifact with repackaged archive
> [INFO]
> [INFO] --- maven-artifact-plugin:3.3.0:compare (default-cli) @
> service-controller ---
> [INFO] Saved info on build to
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/service-controller-2.4.buildinfo
> [INFO] Checking against reference build from lda-public...
> [INFO] Reference buildinfo file not found: it will be generated from
> downloaded reference artifacts
> [INFO] Reference build java.version: 1.8 (from MANIFEST.MF Build-Jdk-Spec)
> [INFO] Reference build os.name: Unix (from pom.properties newline)
> [INFO] Minimal buildinfo generated from downloaded artifacts:
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/reference/service-controller-2.4.buildinfo
> [INFO] Reproducible Build output summary: 2 files ok
> [INFO] Reproducible Build output comparison saved to
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/service-controller-2.4.buildcompare
> [INFO]
> ------------------------------------------------------------------------
> [INFO] BUILD SUCCESS
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Total time: 18.812 s
> [INFO] Finished at: 2023-02-01T13:44:09+01:00
> [INFO]
> ------------------------------------------------------------------------
> {noformat}
> Now the user moves to another timezone (e.g., Europe/Bucharest):
> {noformat}
> osipovmi@deblndw011x:~/var/Projekte/lda-cafe/backend-services/service-controller
> ((v2.4) %)
> $ TZ=Europe/Bucharest mvn clean verify artifact:compare -DskipTests
> -Dreference.repo=lda-public
> [INFO] Scanning for projects...
> [INFO]
> [INFO] --------------< com.siemens.lda.cafe:service-controller
> >---------------
> [INFO] Building service-controller 2.4
> [INFO] --------------------------------[ jar
> ]---------------------------------
> [INFO]
> [INFO] --- maven-clean-plugin:3.2.0:clean (default-clean) @
> service-controller ---
> [INFO] Deleting
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target
> [INFO]
> [INFO] --- maven-enforcer-plugin:3.1.0:enforce (enforce-maven) @
> service-controller ---
> [INFO]
> [INFO] --- jacoco-maven-plugin:0.8.3:prepare-agent (default) @
> service-controller ---
> [INFO] argLine set to
> -javaagent:/net/home/osipovmi/.m2/repository/org/jacoco/org.jacoco.agent/0.8.3/org.jacoco.agent-0.8.3-runtime.jar=destfile=/var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/jacoco.exec,excludes=com/siemens/lda/cafe/servicecontroller/exception/**:com/siemens/lda/cafe/servicecontroller/test/**:com/siemens/lda/cafe/servicecontroller/test_integration/**:com/siemens/lda/cafe/servicecontroller/core/model/**:com/siemens/lda/cafe/servicecontroller/config/BeanConfig:com/siemens/lda/cafe/servicecontroller/security/CustomJwtValidator:com/siemens/lda/cafe/servicecontroller/ServiceControllerApplication:com/siemens/lda/cafe/servicecontroller/security/**:com/siemens/lda/cafe/servicecontroller/repository/generic/impl/GatewayJobRepository:com/siemens/lda/cafe/servicecontroller/repository/generic/impl/GatewayModuleRepository
> [INFO]
> [INFO] --- maven-resources-plugin:3.3.0:resources (default-resources) @
> service-controller ---
> [INFO] Copying 8 resources
> [INFO]
> [INFO] --- maven-compiler-plugin:3.10.1:compile (default-compile) @
> service-controller ---
> [INFO] Changes detected - recompiling the module!
> [INFO] Compiling 161 source files to
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/classes
> [INFO]
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/config/SslConfiguration.java:
>
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/config/SslConfiguration.java
> uses or overrides a deprecated API.
> [INFO]
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/config/SslConfiguration.java:
> Recompile with -Xlint:deprecation for details.
> [INFO]
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/core/model/request/generic/RequestContentDisposition.java:
> Some input files use unchecked or unsafe operations.
> [INFO]
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/src/main/java/com/siemens/lda/cafe/servicecontroller/core/model/request/generic/RequestContentDisposition.java:
> Recompile with -Xlint:unchecked for details.
> [INFO]
> [INFO] --- maven-resources-plugin:3.3.0:testResources (default-testResources)
> @ service-controller ---
> [INFO] Copying 156 resources
> [INFO]
> [INFO] --- maven-compiler-plugin:3.10.1:testCompile (default-testCompile) @
> service-controller ---
> [INFO] Changes detected - recompiling the module!
> [INFO] Compiling 30 source files to
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/test-classes
> [INFO]
> [INFO] --- maven-surefire-plugin:3.0.0-M7:test (default-test) @
> service-controller ---
> [INFO] Tests are skipped.
> [INFO]
> [INFO] --- jacoco-maven-plugin:0.8.3:report (report) @ service-controller ---
> [INFO] Skipping JaCoCo execution due to missing execution data file.
> [INFO]
> [INFO] --- maven-jar-plugin:3.3.0:jar (default-jar) @ service-controller ---
> [INFO] Building jar:
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/service-controller-2.4.jar
> [INFO]
> [INFO] --- spring-boot-maven-plugin:2.5.5:repackage (default) @
> service-controller ---
> [INFO] Replacing main artifact with repackaged archive
> [INFO]
> [INFO] --- maven-artifact-plugin:3.3.0:compare (default-cli) @
> service-controller ---
> [INFO] Saved info on build to
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/service-controller-2.4.buildinfo
> [INFO] Checking against reference build from lda-public...
> [INFO] Reference buildinfo file not found: it will be generated from
> downloaded reference artifacts
> [INFO] Reference build java.version: 1.8 (from MANIFEST.MF Build-Jdk-Spec)
> [INFO] Reference build os.name: Unix (from pom.properties newline)
> [INFO] Minimal buildinfo generated from downloaded artifacts:
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/reference/service-controller-2.4.buildinfo
> [WARNING] sha512 mismatch service-controller-2.4.jar: investigate with
> diffoscope target/reference/service-controller-2.4.jar
> target/service-controller-2.4.jar
> [WARNING] Reproducible Build output summary: 1 files ok, 1 different
> [WARNING] see diff target/reference/service-controller-2.4.buildinfo
> target/service-controller-2.4.buildinfo
> [WARNING] see also
> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> [INFO] Reproducible Build output comparison saved to
> /var/osipovmi/Projekte/lda-cafe/backend-services/service-controller/target/service-controller-2.4.buildcompare
> [INFO]
> ------------------------------------------------------------------------
> [INFO] BUILD SUCCESS
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Total time: 25.336 s
> [INFO] Finished at: 2023-02-01T14:56:44+02:00
> [INFO]
> ------------------------------------------------------------------------
> {noformat}
> As you can see the comparison does not take care of timezone offsets. This
> caused by https://github.com/spring-projects/spring-boot/issues/21005.
> This I would expected to be detected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
