Jin

Thanks for the helpful repro. This is definitely related to our custom `jvm_import.bzl` and https://github.com/bazelbuild/bazel/issues/4584. I dug into StrictJavaDepsPlugin.java for Bazel and found this snippet: https://github.com/bazelbuild/bazel/blob/3c341016a15d34f8e7b8f4527e679120c5d15c07/src/java_tools/buildjar/java/com/google/devtools/build/buildjar/javac/plugins/dependency/StrictJavaDepsPlugin.java#L326-L343 It looks like we'll...

Will be fixed by https://github.com/bazelbuild/rules_jvm_external/pull/285

I've received reports that the current implementation with the jar manifest stamping is not deterministic, and causes reproducibility issues. See https://github.com/bazelbuild/rules_jvm_external/pull/376 https://github.com/bazelbuild/rules_jvm_external/pull/355 adds a `--@rules_jvm_external//settings:stamp_manifest` flag to trigger this behavior,...

@JaredNeil kindly pointed out that the Bazel source tree has a tool to reproducibly produce modified JARs: https://github.com/bazelbuild/bazel/blob/master/src/java_tools/buildjar/java/com/google/devtools/build/buildjar/jarhelper/JarHelper.java

I'm quite confused about what's happening here. Is there an issue/context for this FR?

This is WAI, the `pom_file` rule only generates the dependency closure, which is the complex part of the pom file. Have you tried writing a simple `genrule` that adds the...

Can we add an artifact to the integration tests that uses this codepath?

Looks like it's actually possible to use the downloaded JDK (not embedded one, since the embedded one is minimal enough to run Bazel, and probably not other Java applications) to...

Thank you for taking the time to look into this, @spietras. It sounds like there's a usability gap between toolchains and repository rules, and the current API is not sufficient...

Also reported here, with a repro example: https://github.com/bazelbuild/rules_jvm_external/issues/450