Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Tamás Cservenák
Not just that (def value): release plugin will NOT update the timestamp, if value is "inherited" from super POM, as opposed to "property is present in top level reactor POM". At least this is what I see from release sources, may be wrong. Still, the simplest is to have property in the project (pare

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Manfred Moser
Without looking at the details in the PR or issue.. I strongly support this on principle. Maven was always about doing the right thing out of the box. I think this falls very much in that category. +1 Manfred On 2024-09-24 12:03 a.m., Hervé Boutemy wrote: everything is in the title Jira is

Re: upgrade jdk 17 used in maven jenkins cicd

2024-09-24 Thread Guillaume Nodet
I raised https://issues.apache.org/jira/projects/INFRA/issues/INFRA-26146 a few days ago for that. Le mar. 24 sept. 2024 à 15:41, Xeno Amess a écrit : > > Hi all. > No mean to be offensive but maven repo's master branch failed ci (again) for > quite a long time. > That be introduced by the new a

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Mateusz Gajewski
Reproducible builds are immensely helpful and if this can be supported out of the box I’m all in :) On Tue, Sep 24, 2024 at 09:05 Hervé Boutemy wrote: > everything is in the title > > Jira issue is https://issues.apache.org/jira/browse/MNG-8258 > PR is https://github.com/apache/maven/pull/1726 >

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Olivier Lamy
Hi It looks like you have some comments on the PR :) I know it's been implemented as is for a long time now, but I wonder I (and it looks like a few others) wonder if we could avoid this "random" build timestamp. On Tue, 24 Sept 2024 at 17:05, Hervé Boutemy wrote: > > everything is in the title

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Christoph Läubrich
> yes, this is the idea: there is no other option I can imagine to get a reproducible zip entries timestamp, whatever the precise value of the timestamp it is > If anybody has any other algorithm idea (that supports wide reality of situation: not everything is built from Git, for example), I'm a

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Ceki Gulcu
Hi Hervé, Thank you for the clarification. If there is a fixed default timestamp value, then the timestamp in various builds would not respect temporal causality. Also, people looking inside MANIFEST.MF files would get confused. A fixed default timestamp value would inject incorrect inform

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Manfred Moser
Fair enough .. that would be good as well. If we have no clear way for a reasonable default value .. the default can be a warning with advice. manfred On 2024-09-24 2:06 p.m., Tamás Cservenák wrote: Just to tie to the previous message: we also discussed making ".mvn" directory _mandatory_ (fro

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Tamás Cservenák
Just to tie to the previous message: we also discussed making ".mvn" directory _mandatory_ (from mvn4). So, essentially, if you have a Maven3 project, and you want to build it with Maven4, you MUST have a ".mvn" directory. You must create a ".mvn" directory. This "migration" is IMHO not biggie, as

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Ceki Gulcu
Hi Hervé, In my opinion, the value of should be part of the pom.xml file and thus visible after the build. Otherwise, how can the build be reproducible? Or is the idea to have a *fixed* *default* timestamp for all builds? -- Ceki Gülcü Sponsoring SLF4J/logback/reload4j at https://github

[VOTE] Release Maven GPG Plugin 3.2.7

2024-09-24 Thread Tamás Cservenák
Howdy, This issue fixes a lingering issue in the whole 3.2.x lineage, that resulted in "bad passphrase" on Windows OS with GPG signer. We solved 3 issues: https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12317521&version=12355101 There are still a couple of issues left in JIRA: h

RE: Most significant changes in history with every major release of Maven

2024-09-24 Thread Robert Scholte
I'm glad I asked the question, because this is indeed a huge and important change I was not aware of. Thanks, Robert -Original Message- From: Hervé Boutemy Sent: dinsdag 24 september 2024 08:28 To: Maven Developers List Subject: Re: Most significant changes in history with every major

[DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Hervé Boutemy
everything is in the title Jira issue is https://issues.apache.org/jira/browse/MNG-8258 PR is https://github.com/apache/maven/pull/1726 WDYT about merging this PR as part of the Maven 4 global update? Regards, Hervé - To uns

Re: upgrade jdk 17 used in maven jenkins cicd

2024-09-24 Thread Xeno Amess
glad to hear about that. Guillaume Nodet 于2024年9月24日周二 21:56写道: > I raised https://issues.apache.org/jira/projects/INFRA/issues/INFRA-26146 > a few days ago for that. > > Le mar. 24 sept. 2024 à 15:41, Xeno Amess a écrit : > > > > Hi all. > > No mean to be offensive but maven repo's master bran

Re: upgrade jdk 17 used in maven jenkins cicd

2024-09-24 Thread Xeno Amess
maybe also should add to readme that this repo can only be built on 17.0.11+, but I'm not quite sure whether it suitable Xeno Amess 于2024年9月24日周二 21:41写道: > Hi all. > No mean to be offensive but maven repo's master branch failed ci (again) > for quite a long time. > That be introduced by the new

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Herve Boutemy
> Or is the idea to have a *fixed* *default* timestamp for all builds? yes, this is the idea: there is no other option I can imagine to get a reproducible zip entries timestamp, whatever the precise value of the timestamp it is If anybody has any other algorithm idea (that supports wide reality

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Tamás Cservenák
Howdy, we discussed this with Guillaume for a bit, and we got to a question: why does Maven not warn IF build is not reproducible? (somehow similar situation as with lack of .mvn directory) Yes, Maven always "does right", but in these two cases (date of the build and locating .mvn directory) the

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Mateusz Gajewski
On Wed, Sep 25, 2024 at 5:58 AM Christoph Läubrich wrote: > > yes, this is the idea: there is no other option I can imagine to get > a reproducible zip entries timestamp, whatever the precise value of the > timestamp it is > > If anybody has any other algorithm idea (that supports wide reality

Re: [DISCUSSION] activating Reproducible Builds by default in Maven 4

2024-09-24 Thread Richard Eckart de Castilho
Please do not make us have to create an empty directory just to please the build tool... -- Richard > On 24. Sep 2024, at 23:06, Tamás Cservenák wrote: > > So, essentially, if you have a Maven3 project, and you want to build it > with Maven4, you MUST have a ".mvn" directory. You must create a