Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve wording on artifact:compare introducing false positives #489

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Improve wording on artifact:compare introducing false positives #489

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions content/apt/guides/mini/guide-reproducible-builds.apt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,8 @@ mvn artifact:check-buildplan

* How to test my Maven build reproducibility?

Using {{{/plugins/maven-artifact-plugin/compare-mojo.html}<<<maven-artifact-plugin>>>'s <<<compare>>> goal}},
you can easily check that the second build of your project produce the same output than an initial build:
A preliminary check to start with is this task {{{/plugins/maven-artifact-plugin/compare-mojo.html}<<<maven-artifact-plugin>>>'s <<<compare>>> goal}}.
You can easily check that the second build of your project produce the same output than an initial build:

[[1]] build and <<<install>>> your project (don't hesitate to customize arguments to better match your project):

Expand All @@ -78,7 +78,10 @@ mvn clean verify artifact:compare

[]

Notice that this does NOT really prove that your build is yet reproducible, because your build may still suffer from environment leaks (username, current directory, ...). But it is easy to do, and prevents basic non-reproducible issues like timestamps.
Notice that this does NOT really prove that your build is yet reproducible, because your build may still suffer from environment leaks (username, current directory, ...).
Also not that it might suffer from false positives. Libraries included in your build might not support reproducible builds themselves but at the same time produce reproducible artifacts.
Copy link

@yurloc yurloc Jan 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my opinion, this is inaccurate and adds more confusion than it removes. The false positive check result we've seen in OptaPlanner didn't come from the artifact:compare check that this paragraph is about but from artifact:check-buildplan which is mentioned in the next section.

@hboutemy I'd like to check with you first, before we try to polish this up and go into perhaps unnecessary details about false positives and the optionality of some checks... Do you think we could remove the jaxb2 plugin from the issue list since it turned out that using that plugin doesn't make the project build non-reproducible (only the plugin's build is not reproducible)?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If that is true and we could remove it then the false-positive failure of artifact:check-buildplan would disappear and so would the confusion and this paragraph wouldn't need any update.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the previous section you mean.

Besides you're right, I forgot which task triggered the problem and changed the wrong section but for check-build plan that still holds right?

This means the output of this check might be a failure, but your build can be reproducible.
This task is easy to do, and prevents basic non-reproducible issues like timestamps.
Really checking reproducibility requires to rebuild from a completely different setup: this is harder to do, even if containers may ease the task.

* How to fix my Maven build reproducibility?
Expand Down