ant-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Stefan Bodewig <bode...@apache.org>
Subject Re: Reproducible JARs
Date Sun, 27 Aug 2017 16:56:46 GMT
On 2017-08-23, George Bateman wrote:

> Stefan wrote:
>> The manifest may contain the current time stamp, to make things worse
>> for you :-)

> Fortunately, I don't see anywhere in Jar.java that mentions time or date,
> except passing it to Zip#zipFile() as the modification time, and I override
> it there anyway.

I thought we might add a build timestamp inside the default manifest. I
just checked and we don't. All is well.

>> I'm not sure what you want can be achieved at all. The best you can get
>> is the exact same jar when the build has been run on the same OS with
>> the same version of java, javac and zlib (and probably a few other
>> things I'm missing right now).

>> Different javacs will create different class files. ZIP (and thus JAR)
>> creation uses zlib under the covers and different versions may result in
>> different deflated output.

> That's fine. It's sufficient to be able to say that if you set up your
> build environment to my exact but reasonable instructions (as you get in a
> Debian source package, for example), you will get the same thing I got.
> This would prove that I built the binaries from the source I said I did
> just by comparing the single eventual output file.

In this case you could <touch> all files that end up inside the archive
to some fixed timestamp and obtain the same jar for all of them.

It may not work for the timestamp of the MANIFEST.MF, come to think of
it. See line 556 in Jar.java (master branch), the manifest will always
use the current timestamp. Same for the META-INF directory.

> I've attached the output of git diff so you can see it, but what's the
> correct way to submit the code to you?

Attachments are stripped, so your gif never made it through.

Please open an enhancement request in bugzilla[1] and attach your patch
or alternatively open a github pull request.

Stefan

[1] https://bz.apache.org/bugzilla/

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org


Mime
View raw message