Bug 61269 - Ant should support reproducible builds
Summary: Ant should support reproducible builds
Status: NEW
Alias: None
Product: Ant
Classification: Unclassified
Component: Core tasks (show other bugs)
Version: unspecified
Hardware: All All
: P2 enhancement (vote)
Target Milestone: ---
Assignee: Ant Notifications List
URL:
Keywords:
Depends on: 62617
Blocks:
  Show dependency tree
 
Reported: 2017-07-09 22:02 UTC by Emilian Bold
Modified: 2019-10-25 08:22 UTC (History)
2 users (show)



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Emilian Bold 2017-07-09 22:02:14 UTC
Reproducible Java builds need reproducible outputs (JARs, etc) created by Ant.

The current work arounds for JARs [1][2] re-create the archive by ordering the entries and setting a fixed timestamp.

So, Ant would really help reproducible builds everywhere if it would start generating deterministic files.

The Jar task is the most important, but Zip is also related and there are probably more.

This could be provided with a boolean "deterministic" (or "reproducible") task parameter which would default to "false".


1. https://wiki.debian.org/ReproducibleBuilds/TimestampsInJarFiles
2. https://github.com/emilianbold/reproducible-nextbeans/commit/385a2dfe1211b60e0760fef6ceadb5dcdf56d5ea#diff-cca8843bd49355638f50da9975b53a49R47
Comment 2 Jaikiran Pai 2019-10-25 08:22:48 UTC
Like I replied to another bugzilla issue previously - it would be good to have these patches contributed to upstream Ant, if you are interested.