[MARTIFACT-57] Combining artifact:buildinfo and artifact:compare fails

[jira-importer]

Marcono1234 opened MARTIFACT-57 and commented

The issue

When you combine the goals artifact:buildinfo and artifact:compare, then compare fails, claiming the .buildinfo file differs.
For my build the artifact:buildinfo goal is configured in the build section of the pom.xml so that it always creates the .buildinfo file.

I haven't investigated this in detail, but to me it seems the underlying issue is this:
When running mvn clean verify artifact:compare (as suggested by the Maven guide):

1. It implicitly runs the artifact:buildinfo goal during the verify phase and attaches the .buildinfo artifact.
2. artifact:compare itself seems to also generate a .buildinfo file which is supposed to include all artifacts, but this (erroneously?) includes the .buildinfo file from artifact:buildinfo.
   And also, because it is currently in the process of overwriting that file, it seems to report length=0 (?).

Reproduction steps

1. Create a pom.xml with the following content:

<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.mycompany.app</groupId>
  <artifactId>my-app</artifactId>
  <version>1.0-SNAPSHOT</version>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.build.outputTimestamp>2023-01-01T00:00:00Z</project.build.outputTimestamp>
  </properties>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-artifact-plugin</artifactId>
        <version>3.5.0</version>
        <executions>
          <execution>
            <goals>
              <goal>buildinfo</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
</project>

1. Run

mvn clean install

1. Run

mvn clean verify artifact:compare

(x) Bug: It fails, claiming the .buildinfo files differ

1. Inspect the target/my-app-1.0-SNAPSHOT.buildinfo file
   (x) Bug: It contains the following bogus entry

outputs.2.groupId=com.mycompany.app
outputs.2.filename=my-app-1.0-SNAPSHOT.buildinfo
outputs.2.length=0
outputs.2.checksums.sha512=cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Important: Remember to delete the <user-home>/.m2/repository/com/mycompany directory from your local Maven repository afterwards.

Workaround

Run artifact:compare in combination with -Dbuildinfo.attach=false:

mvn clean verify artifact:compare -Dbuildinfo.attach=false

---

Affects: 3.5.0

[jira-importer]

Marcono1234 commented

This comment suggests there is no point in attaching the .buildinfo file in the first place.

But to me it looks like it does have an advantage: As mentioned in the wiki (section "Out of scope"), there are aspects which can still make a build non-reproducible, such as OS and Maven and JDK version. And as mentioned in the section "Rebuilding", the MANIFEST.MF in the JAR might not contain all this information. So to me it looks like attaching the .buildinfo does provide an advantage.
Otherwise you can only reproduce a build if you have access to the environment where it was performed, or if you can guess its setup.

[jira-importer]

Hervé Boutemy commented

guessing environment is not that hard, without requiring buildinfo storage
see https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/bin/wip.sh and https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/bin/add-new-release.sh

and experience has proven that storing buildinfo to Maven Central cause issues when data stored has been generated with an old plugin, and compare is run with newer that has changed format

definitively, storing buildinfo in Maven Central has been a bad idea when I started, 5 years ago

[jira-importer]

Marcono1234 commented

Guessing the environment is certainly a good start, better than wasting effort trying to exactly recreate the build environment from the beginning.
But if guessing fails, having detailed build information might be quite valuable.

With the large number of different JDK distributions, which might apply different patches, and with LTS versions which receive patches for quite a long time, I think it is conceivable that cases can occur where recreating the build environment just by guessing will be difficult if a certain distribution or patch version causes build differences.

and experience has proven that storing buildinfo to Maven Central cause issues when data stored has been generated with an old plugin, and compare is run with newer that has changed format

But that is only an issue when comparing these buildinfo files (which are separate artifacts and not part of the JAR), right? Can't these files just be ignored during comparison? They are not the artifacts which are consumed by users anyways, so it does not really matter whether they differ.
In case you meant that in the context of automatically extracting information from the buildinfo file: At least you can still extract the information manually then, and maybe it would be possible to write extraction logic which can handle all previous formats.