Issue #19: xmvn modifications are unstable - project

fedora-reproducible-builds / project

#19 xmvn modifications are unstable

Opened Jul 2, 2024 by zbyszek. Modified Nov 8, 2024

In general, ant builds report lots of differences in jar files:
ant-1.10.14-11.fc41:

ant-1.10.14-11.fc41.src
ant-1.10.14-11.fc41.noarch
ant-antlr-1.10.14-11.fc41.noarch
    jar_library
ant-apache-bcel-1.10.14-11.fc41.noarch
    jar_library
ant-apache-bsf-1.10.14-11.fc41.noarch
    jar_library
ant-apache-oro-1.10.14-11.fc41.noarch
    jar_library
ant-apache-regexp-1.10.14-11.fc41.noarch
    jar_library
ant-apache-resolver-1.10.14-11.fc41.noarch
    jar_library
ant-apache-xalan2-1.10.14-11.fc41.noarch
    jar_library
ant-commons-logging-1.10.14-11.fc41.noarch
    jar_library
ant-commons-net-1.10.14-11.fc41.noarch
    jar_library
ant-imageio-1.10.14-11.fc41.noarch
    jar_library
ant-jakartamail-1.10.14-11.fc41.noarch
    jar_library
ant-javadoc-1.10.14-11.fc41.noarch
ant-jdepend-1.10.14-11.fc41.noarch
    jar_library
ant-jmf-1.10.14-11.fc41.noarch
    jar_library
ant-jsch-1.10.14-11.fc41.noarch
    jar_library
ant-junit-1.10.14-11.fc41.noarch
    jar_library
ant-junit5-1.10.14-11.fc41.noarch
    jar_library
ant-lib-1.10.14-11.fc41.noarch
    jar_library
ant-manual-1.10.14-11.fc41.noarch
ant-swing-1.10.14-11.fc41.noarch
    jar_library
ant-testutil-1.10.14-11.fc41.noarch
    jar_library
ant-xz-1.10.14-11.fc41.noarch
    jar_library

And the differences look like this:

│ │ ├── ./usr/share/maven-metadata/ant-apache-bcel.xml                                                                          
│ │ │ @@ -1,49 +1,49 @@                                                                                                         
│ │ │  <?xml version="1.0" encoding="utf-8"?>                                                                                   
│ │ │  <metadata xmlns="http://fedorahosted.org/xmvn/METADATA/3.2.0">                                                           
│ │ │ -  <uuid>8a7a9ec3-aa3b-4adb-8c3a-b39d3f2555a1</uuid>                                                                      
│ │ │ +  <uuid>7f7cab81-7d50-407f-9b38-4f3f4f86ba02</uuid>                                                                      
│ │ │    <artifacts>                                                                                                            
│ │ │      <artifact>                                                                                                           
│ │ │        <groupId>org.apache.ant</groupId>                                                                                  
│ │ │        <artifactId>ant-apache-bcel</artifactId>                                                                           
│ │ │        <extension>pom</extension>                                                                                         
│ │ │        <version>1.10.14</version>                                                                                         
│ │ │        <path>/usr/share/maven-poms/ant/ant-apache-bcel.pom</path>                                                         
│ │ │ -      <uuid>43b60eae-1ba9-4ea4-9b13-f357647575a0</uuid>                                                                  
│ │ │ +      <uuid>aee90af0-9026-4e00-bcd7-631bd70a78b1</uuid>                                                                  
│ │ │        <dependencies>                                                                                                     
│ │ │          <dependency>                                
│ │ │ -          <groupId>org.apache.ant</groupId>                                                                    
│ │ │ -          <artifactId>ant</artifactId>              
│ │ │ -          <requestedVersion>1.10.14</requestedVersion>                                                                  
│ │ │ -          <optional>false</optional>                
│ │ │ -        </dependency>                               
│ │ │ -        <dependency>                                
│ │ │            <groupId>org.apache.bcel</groupId>                                                                   
│ │ │            <artifactId>bcel</artifactId>                                                                        
│ │ │            <requestedVersion>6.7.0</requestedVersion>                                                           
│ │ │            <optional>false</optional>                    
│ │ │          </dependency>                               
│ │ │ +        <dependency>                                
│ │ │ +          <groupId>org.apache.ant</groupId>                                                                    
│ │ │ +          <artifactId>ant</artifactId>                                                                         
│ │ │ +          <requestedVersion>1.10.14</requestedVersion>                                                                  
│ │ │ +          <optional>false</optional>                                                                           
│ │ │ +        </dependency>                                                                                          
│ │ │        </dependencies>                                                                                          
│ │ │      </artifact>

The spec file uses %mvn_alias :ant org.apache.ant:ant-nodeps apache:ant ant:ant,
and I suspect that this alias is inserted irreproducibly.

mizdebsk commented Nov 4, 2024

XMvn upstream had recently some updates that improve build reproducibility, notably:

https://github.com/fedora-java/xmvn/pull/302 for reproducible javadoc,
https://github.com/fedora-java/xmvn/pull/303 for reproducible manifest injection,
https://github.com/fedora-java/xmvn/pull/304 for the UUID issue as shown above.

If reproducibility issues still persist with XMvn >= 4.3.0 then please report them upstream at https://github.com/fedora-java/xmvn/issues

zbyszek commented Nov 8, 2024

Thanks. It seems that those issues are fixed, at least I don't see them in the (unfortunately somewhat limited) set of recent builds of java packages.

I identified some smaller issues:
https://github.com/fedora-java/xmvn/issues/363

(Also filed https://src.fedoraproject.org/rpms/jetbrains-annotations/pull-request/1, but that's not related to xmvn.)

Metadata

Assignee

None

Tags

Blocking

None

Depending on

None

Priority

None

fedora-reproducible-builds / project

#19 xmvn modifications are unstable Opened Jul 2, 2024 by zbyszek. Modified Nov 8, 2024

Metadata

irreproducibility

#19 xmvn modifications are unstable

Opened Jul 2, 2024 by zbyszek. Modified Nov 8, 2024