Reproducible builds

[arnout....@lightbend.com]

Hi,

I'd like to experiment with generating 'reproducible' builds with sbt (https://reproducible-builds.org/).

One source of nondeterminism in generated artifacts is the fact that JarOutputStream and ZipOutputStream from java.util are used in IO.jar() and will include timestamps in the generated jar file. Also I'm not sure the ordering of the files in the archive is deterministic.

There's generally 2 ways to make builds reproducible: generating the assets in a deterministic way, or post-processing them. I'd say generating the jars in a deterministic way would be the nicest approach and make it easiest to integrate into an sbt project.

Would you be open to accepting such features in sbt, or at least extension points so this can be achieved from e.g. a plugin? What would be a good place to start hooking this in?

Kind regards,

Arnout

[eugene yokota]

Hi,

I think this is a great initiative, and a good fit for the upcoming sbt 1.

Since this is something that all Zinc 1 users can benefit from including Pants,

could you open an issue on https://github.com/sbt/zinc/issues?

-eugene

--
You received this message because you are subscribed to the Google Groups "sbt-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sbt-dev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sbt-dev/93c76163-7bb8-496d-af9a-51cc64a7216f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.