Trip Report: Reproducible Builds Summit

I was at the 5th Reproducible Builds Summit this past week, representing mostly Android topics. I attended the first two, so it was nice to see that there has been some real progress in the past few years of work. My main focus was working with an Apache/Maven developer on implementing the “buildinfo” spec for publishing reproducible Java JAR builds to Maven Central and other Maven repositories. Maven repositories are central to the whole Android and Java ecosystems as the primary means of getting libraries. We used the jtorctl library to prototype how this system will look when using the Maven, Gradle, and Bazel buildsystems.

Given the results of our brief work, we should have something working and deployed this year. And there is already a Maven plugin for publishing the “buildinfo” files. So it should be easy to start getting libraries to publish these to Maven Central and other Maven repositories. Then the Apache/Maven Developer plans to push Apache Software Foundation to require reproducible builds for all its official Java releases.

If you want to help with this effort, you can start publishing buildinfo files with your library, or try rebuilding libraries based on published buildinfo files to test whether there is enough information to reproduce the builds.

2 Likes

Which one is that? I know of http://zlika.github.io/reproducible-build-maven-plugin/ but that one doesn’t generate a buildinfo, and some searching only produced projects that record ‘build info’ but not really in the reproducible-builds sense.

Wow, that’s great!

I’ve been publishing .buildinfo metadata to Maven Central for a while using https://github.com/raboof/sbt-reproducible-builds , e.g. http://repo1.maven.org/maven2/com/typesafe/akka/akka-actor_2.13/2.6.1/. Our builds can be reproduced by third-party rebuilders, though unfortunately the infrastructure for such rebuilders to share attestations among each other is in its infancy.

There is a snapshot version of a new official maven-buildinfo-plugin:

https://gitbox.apache.org/repos/asf?p=maven-studies.git;a=shortlog;h=refs/heads/maven-buildinfo-plugin

I’ve been publishing .buildinfo metadata to Maven Central for a while using https://github.com/raboof/sbt-reproducible-builds , e.g. http://repo1.maven.org/maven2/com/typesafe/akka/akka-actor_2.13/2.6.1/. Our builds can be reproduced by third-party rebuilders, though unfortunately the infrastructure for such rebuilders to share attestations among each other is in its infancy.

This is great! We’re discussing buildinfo for Maven Repositories in the
rb-general list. Are you there? It would be good to sync up.

Cool!

We’re discussing buildinfo for Maven Repositories in the
rb-general list. Are you there? It would be good to sync up.

Yes, I’m also participating there (and worked together with Hervé to construct https://reproducible-builds.org/docs/jvm/).

2 Likes
Mastodon