Bug 61269

Summary: Ant should support reproducible builds
Product: Ant Reporter: Emilian Bold <emi>
Component: Core tasksAssignee: Ant Notifications List <notifications>
Status: NEW ---    
Severity: enhancement CC: apache-bugzilla, ebourg
Priority: P2    
Version: unspecified   
Target Milestone: ---   
Hardware: All   
OS: All   
Bug Depends on: 62617    
Bug Blocks:    

Description Emilian Bold 2017-07-09 22:02:14 UTC
Reproducible Java builds need reproducible outputs (JARs, etc) created by Ant.

The current work arounds for JARs [1][2] re-create the archive by ordering the entries and setting a fixed timestamp.

So, Ant would really help reproducible builds everywhere if it would start generating deterministic files.

The Jar task is the most important, but Zip is also related and there are probably more.

This could be provided with a boolean "deterministic" (or "reproducible") task parameter which would default to "false".

1. https://wiki.debian.org/ReproducibleBuilds/TimestampsInJarFiles
2. https://github.com/emilianbold/reproducible-nextbeans/commit/385a2dfe1211b60e0760fef6ceadb5dcdf56d5ea#diff-cca8843bd49355638f50da9975b53a49R47
Comment 2 Jaikiran Pai 2019-10-25 08:22:48 UTC
Like I replied to another bugzilla issue previously - it would be good to have these patches contributed to upstream Ant, if you are interested.