bug#38162: icedtea "jar" tool could automatically pack reproducible jars

bug#38162: icedtea "jar" tool could automatically pack reproducible jars

[Danny Milosavljevic]

[-- Attachment #1: Type: text/plain, Size: 548 bytes --]

Hi,

it would be better if icedtea's "jar" tool automatically packed reproducible jar
files instead of us doing some barely safe unzip-then-rezip-with-specific-order
in the ant-build-system.

It could check the environment variable SOURCE_DATE_EPOCH and then use that as
timestamp for the zip entries.

Alternatively, it could just leave the DOS timestamp field off of the zip
entries.

Maven already has support for the former[1]--we might be able to reuse that.

[1] https://maven.apache.org/plugins/maven-jar-plugin/jar-mojo.html

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

bug#38162: icedtea "jar" tool could automatically pack reproducible jars

[Ludovic Courtès]

Hi Danny,

Danny Milosavljevic <dannym@scratchpost.org> skribis:

> it would be better if icedtea's "jar" tool automatically packed reproducible jar
> files instead of us doing some barely safe unzip-then-rezip-with-specific-order
> in the ant-build-system.
>
> It could check the environment variable SOURCE_DATE_EPOCH and then use that as
> timestamp for the zip entries.

Someone proposed patches several months ago to reset timestamps in
jar/zip files, which I reviewed, but then lost track of (which may well
be my fault!) and I can’t find them on guix-patches now.

If you don’t mind researching a bit :-), this could be helpful.

Ludo’.