Three Pillars of Reproducible Builds
fossa.com
Three Pillars of Reproducible Builds
1–10 of 15 posts
Re: Three Pillars of Reproducible Builds
#2On the JVM, maven doesn’t make this particularly easy.
It’s possible to try to store dependencies locally instead of shared in a global m2 repository, but it’s difficult to stop maven from adding the current time in jars or wars…
It’s as if all the default settings are the opposite of what they should be for reproducible builds.
Any idea if there is a project to try to improve things with maven or with another JVM tool? (Grade, sbt, etc.)
Re: Three Pillars of Reproducible Builds
#3On the JVM, maven doesn’t make this particularly easy. It’s possible to try to store dependencies locally instead of shared in a global m2 repository, but it’s difficult to stop maven from adding the current time in jars or wars… It’s as if all the default settings are the opposite of what they should be for reproducible builds. Any idea if there is a project to try to improve things with maven or with another JVM to…
If you have an option to containerize the app, Jib may be what you are looking for. Plugs into Maven, and the same source/content always generates the same image - https://github.com/GoogleContainerTools/jib
Re: Three Pillars of Reproducible Builds
#4On the JVM, maven doesn’t make this particularly easy. It’s possible to try to store dependencies locally instead of shared in a global m2 repository, but it’s difficult to stop maven from adding the current time in jars or wars… It’s as if all the default settings are the opposite of what they should be for reproducible builds. Any idea if there is a project to try to improve things with maven or with another JVM to…
If you have an option to containerize the app, Jib may be what you are looking for. Plugs into Maven, and the same source/content always generates the same image - https://github.com/GoogleContainerTools/jib
And this is the best explanation of Jib [1], but it’s hard to find via Google. It’s how all builds for every ecosystem should work IMO.
Re: Three Pillars of Reproducible Builds
#5On the JVM, maven doesn’t make this particularly easy. It’s possible to try to store dependencies locally instead of shared in a global m2 repository, but it’s difficult to stop maven from adding the current time in jars or wars… It’s as if all the default settings are the opposite of what they should be for reproducible builds. Any idea if there is a project to try to improve things with maven or with another JVM to…
Huawei just published a paper (Towards Build Verifiability for Java-based Systems[0]) on trying to get the JVM ecosystem reproducible. It looks like it's early days, but I'm paying attention.
Re: Three Pillars of Reproducible Builds
#6I guess any stubs the compiler adds will also have to be reproducible, big whoop.
Re: Three Pillars of Reproducible Builds
#7These three aren't enough, you also need to take care of not storing build timestamps, hostnames, timezones, sorting and more:
Re: Three Pillars of Reproducible Builds
#8On the JVM, maven doesn’t make this particularly easy. It’s possible to try to store dependencies locally instead of shared in a global m2 repository, but it’s difficult to stop maven from adding the current time in jars or wars… It’s as if all the default settings are the opposite of what they should be for reproducible builds. Any idea if there is a project to try to improve things with maven or with another JVM to…
https://reproducible-builds.org/docs/jvm/
Which links to
https://maven.apache.org/guides/mini/guide-reproducible-buil...
Haven't tried this myself as I don't particularly like maven. It should be possible though
Re: Three Pillars of Reproducible Builds
#9One of the most fun non-determinism bugs I have worked on was the result of using an associative container with the key type being a pointer (like a std::map or similar), and then iterating over this container.
Since the order and value of dynamically allocated pointers is non-deterministic, this resulted in diverging behaviour at some point.
Better be sure that all your tools used during the build don't do this kind of thing as well.
Re: Three Pillars of Reproducible Builds
#10How can you discuss this w/o mentioning Nix (or the likes)?