<!DOCTYPE html><html><head><title></title><style type="text/css">#qt p.qt-MsoNormal{margin-top:0cm;margin-right:0cm;margin-bottom:0cm;margin-left:0cm;font-size:11pt;font-family:"Calibri", sans-serif;}
#qt a:link{color:rgb(5, 99, 193);text-decoration-line:underline;text-decoration-style:solid;text-decoration-color:currentcolor;text-decoration-thickness:auto;}
#qt li.qt-MsoListParagraph{margin-top:0cm;margin-right:0cm;margin-bottom:0cm;margin-left:36pt;font-size:11pt;font-family:"Calibri", sans-serif;}
#qt ul{margin-bottom:0cm;}
p.MsoNormal,p.MsoNoSpacing{margin:0}
p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>On Thu, Mar 28, 2024, at 16:41, Railean, Alexander via rb-general wrote:<br></div><blockquote type="cite" id="qt" style="overflow-wrap:break-word;"><div class="qt-WordSection1"><p class="qt-MsoNormal">I am trying to understand how someone can independently verify the reproducibility of Java projects on Maven Central. Having explored the repositories on Maven Central, I could not find examples where the “buildinfo” file was present.<br></p></div></blockquote><div class="qt-WordSection1"><p class="qt-MsoNormal">Publishing a buildinfo to Maven Central is indeed relatively uncommon.<br></p></div><blockquote type="cite" id="qt" style="overflow-wrap:break-word;"><div class="qt-WordSection1"><div>The archives of this mailing list pointed out examples such as <a href="https://repo1.maven.org/maven2/com/typesafe/akka/akka-actor_2.13/2.6.4/akka-actor_2.13-2.6.4.buildinfo"> https://repo1.maven.org/maven2/com/typesafe/akka/akka-actor_2.13/2.6.4/akka-actor_2.13-2.6.4.buildinfo</a>, and yet my understanding is that this is not enough [but why?], hence reproducible-central was created to address some sort of gap.<br></div><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal">So far, my mental model is that:<br></p><ul style="margin-top:0cm;" type="disc"><li class="qt-MsoListParagraph" style="margin-left:0cm;">By including buildinfo in the artifacts on Maven Central, library authors empower users to check for themselves if the build is reproducible or not.<br></li><li class="qt-MsoListParagraph" style="margin-left:0cm;">Reproducible-central takes it a step further and attempts to do a build and then gives you a “yes/no” result.<br></li></ul><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal">Thus, the former makes the problem solvable in principle, whereas the latter actually solves it. Is my understanding is correct? <br></p></div></blockquote><div><br></div><div>Mostly: publishing the buildinfo is optional, it is possible to have a reproducible build without publishing the buildinfo metadata (but you might need some other way to convey the requirements for your build environment). Indeed, reproducible-central has successfully rebuilt many artifacts that haven't published a buildinfo.<br></div><div><br></div><blockquote type="cite" id="qt" style="overflow-wrap:break-word;"><div class="qt-WordSection1"><p class="qt-MsoNormal">Besides that, I have some additional questions:<br></p><p class="qt-MsoNormal">1. Can you provide references to documentation that explains how to make sure buildinfo ends up on Maven Central?<br></p></div></blockquote><div class="qt-WordSection1"><p class="qt-MsoNormal">In the case of Akka, they/we use the <a href="https://github.com/raboof/sbt-reproducible-builds/">https://github.com/raboof/sbt-reproducible-builds/</a> plugin for the sbt build tool that is used to build Akka.<br></p></div><blockquote type="cite" id="qt" style="overflow-wrap:break-word;"><div class="qt-WordSection1"><div>2. Is there a tutorial that describes how to get featured on Reproducible Central?<br></div><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal">I had a look at <a href="https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/doc/BUILDSPEC.md"> https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/doc/BUILDSPEC.md</a>, and my understanding is that this is not working for projects built on Windows, because it relies on rebuild.sh, which implies one has bash. The library I publish on
Maven Central is built on a Windows computer – does this mean that I won’t be able to list it in reproducible-builds?<br></p></div></blockquote><div><br></div><div>Hmm, that sounds tricky. However, my experience with Java/Maven is that it is often possible to achieve reproducibility across operating systems: artifacts built on MacOS can often be rebuilt on Linux and vice-versa, so perhaps the same is also true for Windows?<br></div><div><br></div><div><br></div><div>Kind regards,<br></div><div><br></div><div id="sig124436424"><div class="signature">-- <br></div><div class="signature">Arnout Engelen<br></div><div class="signature">Engelen Open Source<br></div><div class="signature"><a href="https://engelen.eu">https://engelen.eu</a><br></div></div><div><br></div></body></html>