jaxen
jaxen copied to clipboard
Implement Maven reproducible builds
This PR implements Maven reproducible builds for the Jaxen project, ensuring that building the same source code multiple times produces bit-for-bit identical artifacts.
Changes Made
Core Implementation:
- Added
project.build.outputTimestampproperty set to2024-01-15T00:00:00Zin the mainpom.xml - This property ensures all Maven plugins use a fixed timestamp for artifact generation
Verification & Documentation:
- Created
verify-reproducible-build.shscript that builds the project twice and compares SHA256 hashes to verify reproducibility - Updated
README.mdwith a new "Reproducible Builds" section explaining the feature and how to verify it
Benefits
Reproducible builds provide several important advantages:
- Security: Enables verification that distributed binaries match the claimed source code
- Trust: Users can independently verify that artifacts haven't been tampered with
- Debugging: Identical builds make it easier to track down issues across different environments
- Compliance: Meets modern software supply chain security requirements
Testing
The implementation has been thoroughly tested:
- Multiple builds produce identical SHA256 hashes for all JAR artifacts
- Builds remain reproducible across different directories and environments
- All existing tests continue to pass
- The verification script successfully validates reproducibility
All Maven plugins used in the build are at versions that support reproducible builds (maven-compiler-plugin 3.13.0, maven-source-plugin 3.3.1, maven-bundle-plugin 5.1.9, etc.).
Fixes #173.
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.