Bug 61269 - Ant should support reproducible builds
Summary: Ant should support reproducible builds
Status: NEW
Alias: None
Product: Ant
Classification: Unclassified
Component: Core tasks (show other bugs)
Version: unspecified
Hardware: All All
: P2 enhancement with 2 votes (vote)
Target Milestone: ---
Assignee: Ant Notifications List
Depends on: 62617
  Show dependency tree
Reported: 2017-07-09 22:02 UTC by Emilian Bold
Modified: 2022-07-29 12:44 UTC (History)
2 users (show)


Note You need to log in before you can comment on or make changes to this bug.
Description Emilian Bold 2017-07-09 22:02:14 UTC
Reproducible Java builds need reproducible outputs (JARs, etc) created by Ant.

The current work arounds for JARs [1][2] re-create the archive by ordering the entries and setting a fixed timestamp.

So, Ant would really help reproducible builds everywhere if it would start generating deterministic files.

The Jar task is the most important, but Zip is also related and there are probably more.

This could be provided with a boolean "deterministic" (or "reproducible") task parameter which would default to "false".

1. https://wiki.debian.org/ReproducibleBuilds/TimestampsInJarFiles
2. https://github.com/emilianbold/reproducible-nextbeans/commit/385a2dfe1211b60e0760fef6ceadb5dcdf56d5ea#diff-cca8843bd49355638f50da9975b53a49R47
Comment 2 Jaikiran Pai 2019-10-25 08:22:48 UTC
Like I replied to another bugzilla issue previously - it would be good to have these patches contributed to upstream Ant, if you are interested.
Comment 3 Emmanuel Bourg 2022-07-29 12:44:04 UTC
@Jaikiran Feel free to pick anything you find interesting in the Debian patches, they are licensed under the ASLv2 and can be copied directly.