[Bug] Reproducible Builds issues on 4.1.0 release

[hboutemy]

Search before reporting

• [x] I searched in the issues and found nothing similar.

Read release policy

• [x] I understand that unsupported versions don't get bug fixes. I will attempt to reproduce the issue on a supported version of Pulsar client and Pulsar broker.

User environment

see https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/pulsar/README.md

Issue Description

I already annotated diff https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/pulsar/pulsar-4.1.0.diffoscope

if project is interested, I can later try to fix a few issues and discuss what I can't "just fix" myself but requires updates in project release process or features

Error messages

Reproducing the issue

from https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/pulsar/README.md

./rebuild.sh content/org/apache/pulsar/pulsar-4.1.0.buildspec

Additional information

provided #23639 in the past, that seems to still hit 4.1.0 release

Are you willing to submit a PR?

• [x] I'm willing to submit a PR!

[lhotari]

@hboutemy Thank you for filing the issue, I'll be interested in getting Pulsar's build reproducible. I'll take a look later.

[hboutemy]

happy to help as much as I can

[hboutemy]

FYI, rebuilding 4.1.2 just started https://github.com/jvm-repo-rebuild/reproducible-central/pull/4415

[hboutemy]

uh, file system full: too big build for a normal GHA builder I'll have to build locally:

git switch pulsar-4.1.2
./rebuild.sh content/org/apache/pulsar/pulsar-4.1.2.buildspec

[hboutemy]

diffoscope analysis published https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/pulsar/pulsar-4.1.2.diffoscope

@lhotari we'll need to see what issues can easily be solved: this will probably be a step by step process, need to do small fixes each time and see the improvement for the next release

[hboutemy]

what causes the majority of differences is the PulsarVersion class, that is copied in many output artifacts, and gets data from Git: https://github.com/apache/pulsar/blob/v4.1.2/pulsar-common/src/main/java-templates/org/apache/pulsar/PulsarVersion.java#L85

for bouncy-castle-bc-4.1.2-pkg.jar, it is a plugin https://github.com/apache/pulsar/blob/v4.1.2/bouncy-castle/bc/pom.xml#L62

for pulsar-client-all https://github.com/apache/pulsar/blob/v4.1.2/pulsar-client-all/pom.xml#L137 need to check that latest shade plugin is used

there are a few dependencies like accessors-smart-2.5.2.jar and json-smart-2.5.2.jar that seem to not be the official ones on your laptop doing the release

nar-plugin to update

[hboutemy]

for the Git properties, we can inject them: https://github.com/jvm-repo-rebuild/reproducible-central/pull/4477

for the rest, need to change the build, update plugins