rebuilding Maven Central Repository artifacts: welcome reproducible-central

Julien Lepiller julien at lepiller.eu
Sun Mar 29 11:41:25 UTC 2020


Le 29 mars 2020 05:00:45 GMT-04:00, "Hervé Boutemy" <hboutemy at apache.org> a écrit :
>Le samedi 28 mars 2020, 19:31:07 CEST Holger Levsen a écrit :
>> HiHervé,
>> 
>> On Sat, Mar 28, 2020 at 06:33:12PM +0100, Hervé Boutemy wrote:
>> > I'd like to announce a new important step for Reproducible Builds
>for the
>> > JVM: reproducible-central.
>> > 
>> > The intent is to provide easy to run reproducible recipes, to let
>anyone
>> > rebuild a component from Central Repository that is expected to be
>> > reproducible and check that the result is as expected.
>> 
>> wow, neato!
>> 
>> > See https://github.com/jvm-repo-rebuild/reproducible-central for
>the
>> > current list of project releases that are rebuilt and checked (with
>> > sometime only partial success).
>> :
>> :) I expect this list to grow quite a bit :)
>yes, it takes time: even when projects update their build, the result
>is 
>visible only on next release, which may take time.
>But with the new visibility this reproducible central table gives, I
>hope 
>interest in being integrated in the table will rise 
>
>> 
>> Thanks for sharing and looking forward for more great news like this!
>I'll need community here to define what can be done next and how (and I
>mean 
>done, not dream: I have a lot of dreams that seem inaccessible...)

Maybe not too difficult: track reproducibility accross dependencies. As a developer it's nice if my package is reproducible, but if my dependencies are not, it's a bit of a wasted effort.


More information about the rb-general mailing list