Locally built transitive snapshot artifacts don't cause checksum change of a dependent module

[ParadoxShmaradox]

Affected version

1.2.1

Bug description

Our setup might be a bit unique. We have 2 maven multi module projects one libs and one apps (they share a parent multi module but it's irrelevant).

We compile the libs first and then the apps. All libs versions are snapshot versions.

When a change is made to one of the libs module, If the an app module does not directly reference said lib module its checksum is unchanged, as the effective pom is unchanged and looking the the buildinfo.xml for the app module it only includes the direct snapshot dependencies and not all transitive snapshots dependencies.

There is a contributing factor, we also set the jar plugin outputTimestamp for a reproducible build but it can also be set globally with the project.build.outputTimestamp property as defined in the maven reproducible builds documentation , I can go into details why it's necessary if needed.

In cases where the direct snapshot dependency of the app module doesn't change any bytecode during its triggered build while having the same timestamps in the jar entries (due to reproducible build) it will have the same checksum and will not trigger a build of the app module.

Thanks!