Update jaxb-tools for reproducible builds

[mattrpav]

ref: https://maven.apache.org/guides/mini/guide-reproducible-builds.html

[hboutemy]

need help?

[laurentschoelens]

Duplicate of #572

[laurentschoelens]

@hboutemy I've dig into this and it was close to work but feel free to provide PR for this if you want to. Any help is welcomed 😄

[hboutemy]

ok, I'll try
notice that #572 is not a duplicate:

• this issue is about having jaxb-tools itself reproducible
• Support jaxb-tools generated projects to succesfully have reproducible builds #572 is about having projects that use jaxb-tools still be reproducible

[laurentschoelens]

I'm pretty sure link was the same

Maybe @mattrpav could explain more of this

[laurentschoelens]

By the way we got external dep issue with #640

[mattrpav]

I updated the GH Actions to run the reproducible build check.

Currently, getting some failures:

https://github.com/highsource/jaxb-tools/actions/runs/16891953051

[laurentschoelens]

I updated the GH Actions to run the reproducible build check.

Currently, getting some failures:

https://github.com/highsource/jaxb-tools/actions/runs/16891953051

Not sure good idea if no more able to build here ❓

This was the kind of error I got too when digging into #572, will try to add more details when I get it to run again locally

[INFO] --- artifact:3.6.0:compare (default-cli) @ jaxb-maven-plugin-tests-p_o-parentbom ---
Warning:  SCM source tag in buildinfo source.scm.tag=4.0.10-SNAPSHOT does not permit rebuilders reproducible source checkout
[INFO] Reference buildinfo file not found: it will be generated from downloaded reference artifacts
[INFO] Reference build java.version: 21 (from MANIFEST.MF Build-Jdk-Spec)
[INFO] Reference build os.name: Unix (from pom.properties newline)
[INFO] Minimal buildinfo generated from downloaded artifacts: /home/runner/work/jaxb-tools/jaxb-tools/maven-plugin/tests/p_o-parentbom/target/reference/jaxb-maven-plugin-tests-p_o-parentbom-4.0.10-SNAPSHOT.buildinfo
Error:  sha512 mismatch jaxb-maven-plugin-tests-p_o-parentbom-4.0.10-SNAPSHOT.jar: investigate with diffoscope maven-plugin/tests/p_o-parentbom/target/reference/org.jvnet.jaxb/jaxb-maven-plugin-tests-p_o-parentbom-4.0.10-SNAPSHOT.jar maven-plugin/tests/p_o-parentbom/target/jaxb-maven-plugin-tests-p_o-parentbom-4.0.10-SNAPSHOT.jar
Error:  Reproducible Build output summary: 1 files ok, 1 different
Error:  see diff maven-plugin/tests/p_o-parentbom/target/reference/jaxb-maven-plugin-tests-p_o-parentbom-4.0.10-SNAPSHOT.buildinfo maven-plugin/tests/p_o-parentbom/target/jaxb-maven-plugin-tests-p_o-parentbom-4.0.10-SNAPSHOT.buildinfo
Error:  see also https://maven.apache.org/guides/mini/guide-reproducible-builds.html

[hboutemy]

project added to Reproducible Central https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/jvnet/jaxb/README.md
as you can see, there are a few remaining issues:

• some on the release process: should clean, should avoid french locale, should use latest JDK 11 (I was forced to not use latest, as it produces a few different bytecode)
• one on JAXB itself: it generates a timestamp (IIRC, fixing that issue was the initial intent)

[mattrpav]

@hboutemy good find! What is the recommended locale settings for reproducible builds? We'll add it to the build setup by default so that every release will always pickup the correct setting.

[laurentschoelens]

Nice tool thanks for that

I'll see where to define locale as en to avoid that mistake in future (my current locale is fr and was responsible for the last 2 releases)

[hboutemy]

Reproducible Builds will do as much it can to match what release manager did.

One aspect I like when rebuilding and comparing is discovering facts that the release manager did not know about what aspects from his personal environment went into the release: I suppose generated code with french comments was not deliberate (even if not really a problem for myself: I'm french :) )

on this, you'll need to define what your project release practice has to be documented to match your own expectations

some people automate the release process from CI
some just write a documentation that makes sure the locale is the one they chose for the project (in general english...)
some define a container for building independently from their laptop (which is nice when someone has a non-*nix laptop: crlf is not really ideal for a release, IMHO)

Reproducible Builds discovers facts, does not impose solutions