rebuilding Maven Central Repository artifacts: welcome reproducible-central

Hervé Boutemy hboutemy at apache.org
Sat Mar 28 17:33:12 UTC 2020


Hi,

I'd like to announce a new important step for Reproducible Builds for the JVM:
reproducible-central.

The intent is to provide easy to run reproducible recipes, to let anyone
rebuild a component from Central Repository that is expected to be
reproducible and check that the result is as expected.

See https://github.com/jvm-repo-rebuild/reproducible-central for the current
list of project releases that are rebuilt and checked (with sometime only
partial success).

When someone publish a new release that is expected to be reproducible, don't
hesitate to provide a PR with the recipe (= a .buildspec file), testing it by
running "./rebuild.sh path-to-recipe.buildspec" (then updating README.md by
running "./update-reproducibility-summary.sh"


In the future, this little Github repository should become something better
than a git repository, but this is a first step: improvement ideas welcome.
If someone is interested also to improve rebuild.sh to support other build 
tools than Maven, don't hesitate.

Regards,

Hervé




More information about the rb-general mailing list