[KARAF-7367] add Reproducible Builds support

apache · Feb 21, 2022 · d0a115b · d0a115b
1 parent df43daf
commit d0a115b
Show file tree

Hide file tree

Showing 4 changed files with 44 additions and 7 deletions.
diff --git a/tooling/karaf-maven-plugin/pom.xml b/tooling/karaf-maven-plugin/pom.xml
@@ -165,12 +165,12 @@
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-archiver</artifactId>
-            <version>2.6</version>
+            <version>3.5.2</version>
         </dependency>
         <dependency>
             <groupId>org.codehaus.plexus</groupId>
             <artifactId>plexus-archiver</artifactId>
-            <version>3.6.0</version>
+            <version>4.2.7</version>
         </dependency>
         <dependency>
             <groupId>org.apache.felix</groupId>

diff --git a/tooling/karaf-maven-plugin/src/it/test-kar-packaging/pom.xml b/tooling/karaf-maven-plugin/src/it/test-kar-packaging/pom.xml
@@ -26,6 +26,10 @@
     <version>1.0-SNAPSHOT</version>
     <packaging>kar</packaging>
 
+    <properties>
+        <project.build.outputTimestamp>12</project.build.outputTimestamp>
+    </properties>
+
     <build>
         <plugins>
             <plugin>

diff --git a/tooling/karaf-maven-plugin/src/it/test-kar-packaging/verify.bsh b/tooling/karaf-maven-plugin/src/it/test-kar-packaging/verify.bsh
@@ -19,11 +19,31 @@
 
 import java.io.*;
 import java.lang.*;
+import java.util.*;
+import java.util.zip.*;
 
 // check if the kar archive has been pushed to the repository
 File generated = new File(basedir, "target/test-kar-packaging-1.0-SNAPSHOT.kar");
-if (generated.exists()) {
-    return true;
+if (!generated.exists()) {
+    return false;
 }
 
-return false;
+// check Reproducible Builds outputTimestamp
+ZipFile zipFile = new ZipFile(generated);
+Enumeration entries = zipFile.entries();
+long timestamp = -1;
+
+while(entries.hasMoreElements()) {
+    ZipEntry entry = entries.nextElement();
+    long t = entry.getTime();
+    if (timestamp == -1) {
+        timestamp = t;
+    }
+    if (t != timestamp) {
+        System.out.println(entry.getName() + " entry last modified = " + t + ", expected " + timestamp);
+        return false;
+    }
+}
+zipFile.close();
+
+return true;
diff --git a/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/KarMojo.java b/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/KarMojo.java
@@ -124,6 +124,16 @@ public class KarMojo extends MojoSupport {
     @Parameter(defaultValue = "${repositoryPath}")
     private String repositoryPath = "repository/";
 
+    /**
+     * Timestamp for reproducible output archive entries, either formatted as ISO 8601
+     * <code>yyyy-MM-dd'T'HH:mm:ssXXX</code> or as an int representing seconds since the epoch (like
+     * <a href="https://reproducible-builds.org/docs/source-date-epoch/">SOURCE_DATE_EPOCH</a>).
+     *
+     * @since 4.4.0
+     */
+    @Parameter(defaultValue = "${project.build.outputTimestamp}")
+    private String outputTimestamp;
+
     private static final Pattern mvnPattern = Pattern.compile("mvn:([^/ ]+)/([^/ ]+)/([^/ ]*)(/([^/ ]+)(/([^/ ]+))?)?");
 
 
@@ -246,10 +256,13 @@ private File createArchive(List<Artifact> bundles, File featuresFile, String gro
         File archiveFile = getArchiveFile(outputDirectory, finalName, classifier);
 
         MavenArchiver archiver = new MavenArchiver();
+        archiver.setCreatedBy("Kar Maven Plugin", "org.apache.karaf.tooling", "karaf-maven-plugin");
         MavenArchiveConfiguration configuration = new MavenArchiveConfiguration();
         configuration.addManifestEntries(archive.getManifestEntries());
         archiver.setArchiver(jarArchiver);
         archiver.setOutputFile(archiveFile);
+        // configure for Reproducible Builds based on outputTimestamp value
+        archiver.configureReproducible(outputTimestamp);
 
         try {
             //TODO should .kar be a bundle?
@@ -270,7 +283,7 @@ private File createArchive(List<Artifact> bundles, File featuresFile, String gro
 //            archive.addManifestEntry(Constants.BUNDLE_SYMBOLICNAME, project.getArtifactId());
 
             //include the feature.xml
-			Artifact featureArtifact = factory.createArtifactWithClassifier(groupId, artifactId, version, "xml", KarArtifactInstaller.FEATURE_CLASSIFIER);
+            Artifact featureArtifact = factory.createArtifactWithClassifier(groupId, artifactId, version, "xml", KarArtifactInstaller.FEATURE_CLASSIFIER);
             jarArchiver.addFile(featuresFile, repositoryPath + layout.pathOf(featureArtifact));
 
             if (featureArtifact.isSnapshot()) {
@@ -347,7 +360,7 @@ private File createArchive(List<Artifact> bundles, File featuresFile, String gro
             if (resourcesDir.isDirectory()) {
                 archiver.getArchiver().addDirectory(resourcesDir);
             }
-            archiver.createArchive(project, archive);
+            archiver.createArchive(mavenSession, project, archive);
 
             return archiveFile;
         } catch (Exception e) {