GNU bug report logs - #38162
icedtea "jar" tool could automatically pack reproducible jars

Previous Next

To reply to this bug, email your comments to 38162 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Danny Milosavljevic <dannym <at> scratchpost.org>
To: <bug-guix <at> gnu.org>
Subject: icedtea "jar" tool could automatically pack reproducible jars
Date: Sun, 10 Nov 2019 15:48:49 +0100

[Message part 1 (text/plain, inline)]

Hi,

it would be better if icedtea's "jar" tool automatically packed reproducible jar
files instead of us doing some barely safe unzip-then-rezip-with-specific-order
in the ant-build-system.

It could check the environment variable SOURCE_DATE_EPOCH and then use that as
timestamp for the zip entries.

Alternatively, it could just leave the DOS timestamp field off of the zip
entries.

Maven already has support for the former[1]--we might be able to reuse that.

[1] https://maven.apache.org/plugins/maven-jar-plugin/jar-mojo.html

[Message part 2 (application/pgp-signature, inline)]

Message #8 received at 38162 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Danny Milosavljevic <dannym <at> scratchpost.org>
Cc: 38162 <at> debbugs.gnu.org
Subject: Re: bug#38162: icedtea "jar" tool could automatically pack
 reproducible jars
Date: Mon, 11 Nov 2019 21:59:13 +0100

Hi Danny,

Danny Milosavljevic <dannym <at> scratchpost.org> skribis:

> it would be better if icedtea's "jar" tool automatically packed reproducible jar
> files instead of us doing some barely safe unzip-then-rezip-with-specific-order
> in the ant-build-system.
>
> It could check the environment variable SOURCE_DATE_EPOCH and then use that as
> timestamp for the zip entries.

Someone proposed patches several months ago to reset timestamps in
jar/zip files, which I reviewed, but then lost track of (which may well
be my fault!) and I can’t find them on guix-patches now.

If you don’t mind researching a bit :-), this could be helpful.

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.