upgrade Felix maven-bundle-plugin for Reproducible

[hboutemy]

fix for bundle:manifest

[mboapache]

The change looks good. Thank you!

We are planning to merge this pull request once we are done with the current JDO release 3.2.

[hboutemy]

thank you
FYI, this 3.2 release (before this update) has only 1 non reproducible output: https://github.com/jvm-repo-rebuild/reproducible-central#org.apache.jdo:jdo

and you can check reproducibility by simply doing

mvn clean install
mvn clean package artifact:compare

[tzaeschke]

@hboutemy I had a look around and I do not fully understand how this works, maybe you can help or point us to some additional documentation?

• mvn clean install & mvn clean package artifact:compare: What is the purpose? As far as I understand it simply compares two local builds that were created on the same machine + environment. This will never detect problems resulting from different environments...?
• Should the second line be mvn clean verify artifact:compare?
• At what point in the release process is this best executed? It feels like it would need to be in the middle of release:perform in order to compare the final build (including version numbers) but before it is being uploaded. Still, it would only compare builds executed on the same environment....?

References:

• https://reproducible-builds.org/docs/jvm/
• https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/BUILDSPEC.md
• https://maven.apache.org/guides/mini/guide-reproducible-builds.html

[hboutemy]

This will never detect problems resulting from different environments...

you're right. There are many reproducibility problems that are not because environments are different, but even on the same env, 2 builds give different results: if you look at the jdo issue for 3.2 release, it's not because of environment https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/jdo/jdo-3.2.diffoscope .

Should the second line be mvn clean verify artifact:compare?

as you wish: output is expected to be done at package stage, verify is not expected to add anything. But you can and should customize the command to match your build expectations

At what point in the release process is this best executed?

it is not expected to be executed during the release process: it's expected to be executed when you develop.
Once the release is done, people outside your project will try to rebuild (obviously with different environment) and check they can get the same output as you: if they find an issue, it's too late for the release, it will have to be fixed for the next release, so during the development phase before the next release: hence the provided test commands to run during development

Once you have a release that was reproducible, in general, next ones are also reproducible, because build structure does not change often.

[tzaeschke]

@hboutemy I forgot: thanks for the info!