Reproducible builds

[charphi]

I'm trying to make my builds reproducible but it is not currently possible with .nbm files.
More specifically, the Maven property project.build.outputTimestamp is not used by the nbm-maven-plugin plugin.

I've tried to find a way in the plugin code but that didn't work.

Any idea?

[ebarboni]

Hi, the plugin use some Apache NetBeans harness make the nbm. So maybe the issue is in this file (ant task).
I'm not very aware of reproducible build technical parts so I may be wrong

Here is the file
https://github.com/apache/netbeans/blob/d30134f8f7d34f29a0c418f49015cbd1f9f7e71a/nbbuild/antsrc/org/netbeans/nbbuild/MakeNBM.java

[charphi]

Most if not all of the problems come from the timestamps. MakeNBM.java seems to be the file to fix, but digging into the NetBeans source code is a bit overwhelming for me.

[charphi]

I'm using the https://diffoscope.org/ tool to see the difference between to builds and I've found the following problems:

1. the manifest entry OpenIDE-Module-Build-Version is set to creation time both in .jar and .nbm
2. the files in .nbm have the modification time set to the .nbm archive creation time

All these timestamps should use the value defined in the Maven property project.build.outputTimestamp.

[charphi]

Problem 1 is simplier since it is located in the nbm plugin at

netbeans-mavenutils-nbm-maven-plugin/nbm-maven-plugin/src/main/java/org/apache/netbeans/nbm/NetBeansManifestUpdateMojo.java

Line 617 in aa10338

private static String createTimestamp( Date date )

[ebarboni]

@charphi feel free to propose a PR. maybe setting up the timestamp via outputTimestamp or the current date for backward compatibility if the outputTimestamp is not set.

[ebarboni]

for problem 2, could be nice to talk into the dev mailing list. Because you will have more feedback than on this "side project"

[hboutemy]

FYI https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/netbeans/utilities/README.md
does not solve anything on the output of the plugin, but the plugin itself is reproducible :)

I'll have a look at helping on making output of the plugin reproducible: any pointer to existing discussion welcome

[hboutemy]

after first research, it seems the nbm jar creation is done in https://github.com/apache/netbeans/blob/master/nbbuild/antsrc/org/netbeans/nbbuild/MakeNBM.java using a jar Ant task
jar Ant task can force entries modification time since Ant 1.10.2 https://ant.apache.org/manual/Tasks/jar.html

based on this first analysis, can Netbeans experts take next steps, please?