Feature: Locally reproducible builds (#108)

Author: infeo

CHANGELOG.md

@@ -12,6 +12,7 @@ Changes to prior versions can be found on the [Github release page](https://gith
 ### Added
 - Changelog file
 - Maven wrapper script ([#103](https://github.com/cryptomator/cryptolib/pull/103))
+- Locally reproducible builds ([#106](https://github.com/cryptomator/cryptolib/pull/106))
 
 ### Changed
 - Pin CI actions

pom.xml

@@ -16,6 +16,7 @@
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<maven.compiler.release>8</maven.compiler.release>
+		<project.build.outputTimestamp>2026-01-28T08:00:00Z</project.build.outputTimestamp>
 
 		<!-- dependencies -->
 		<gson.version>2.12.1</gson.version>
@@ -31,9 +32,22 @@
 		<jmh.version>1.37</jmh.version>
 
 		<!-- build plugin dependencies -->
+		<central-publishing.version>0.10.0</central-publishing.version>
 		<dependency-check.version>12.1.9</dependency-check.version>
+		<exec-maven.version>3.6.2</exec-maven.version>
 		<jacoco.version>0.8.14</jacoco.version>
-		<central-publishing.version>0.7.0</central-publishing.version>
+		<mvn-compiler.version>3.14.1</mvn-compiler.version>
+		<mvn-clean.version>3.5.0</mvn-clean.version>
+		<mvn-deploy.version>3.1.4</mvn-deploy.version>
+		<mvn-enforcer.version>3.6.2</mvn-enforcer.version>
+		<mvn-install.version>3.1.4</mvn-install.version>
+		<mvn-javadoc.version>3.12.0</mvn-javadoc.version>
+		<mvn-jar.version>3.5.0</mvn-jar.version>
+		<mvn-gpg.version>3.2.8</mvn-gpg.version>
+		<mvn-resources.version>3.3.1</mvn-resources.version>
+		<mvn-shade.version>3.6.1</mvn-shade.version>
+		<mvn-source.version>3.4.0</mvn-source.version>
+		<mvn-surefire.version>3.5.4</mvn-surefire.version>
 
 		<!-- Property used by surefire to determine jacoco engine -->
 		<surefire.jacoco.args />
@@ -134,7 +148,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-enforcer-plugin</artifactId>
-				<version>3.6.2</version>
+				<version>${mvn-enforcer.version}</version>
 				<executions>
 					<execution>
 						<id>enforce-java</id>
@@ -154,7 +168,7 @@
 			</plugin>
 			<plugin>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.14.1</version>
+				<version>${mvn-compiler.version}</version>
 				<configuration>
 					<encoding>UTF-8</encoding>
 					<showWarnings>true</showWarnings>
@@ -192,7 +206,7 @@
 			</plugin>
 			<plugin>
 				<artifactId>maven-shade-plugin</artifactId>
-				<version>3.6.1</version>
+				<version>${mvn-shade.version}</version>
 				<executions>
 					<execution>
 						<phase>package</phase>
@@ -230,7 +244,7 @@
 			<plugin>
 				<groupId>org.codehaus.mojo</groupId>
 				<artifactId>exec-maven-plugin</artifactId>
-				<version>3.6.2</version>
+				<version>${exec-maven.version}</version>
 				<executions>
 					<execution>
 						<phase>package</phase>
@@ -243,6 +257,7 @@
 							<arguments>
 								<argument>--verbose</argument>
 								<argument>--update</argument>
+								<argument>--date=${project.build.outputTimestamp}</argument>
 								<argument>--file=${project.build.directory}/${project.build.finalName}.jar</argument>
 								<argument>META-INF/versions/9/module-info.class</argument>
 								<argument>META-INF/versions/22/module-info.class</argument>
@@ -254,15 +269,15 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-surefire-plugin</artifactId>
-				<version>3.5.4</version>
+				<version>${mvn-surefire.version}</version>
 				<configuration>
 					<argLine>@{surefire.jacoco.args} -Dnet.bytebuddy.experimental=true</argLine>
 				</configuration>
 			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-jar-plugin</artifactId>
-				<version>3.5.0</version>
+				<version>${mvn-jar.version}</version>
 				<configuration>
 					<archive>
 						<manifestEntries>
@@ -274,7 +289,7 @@
 			</plugin>
 			<plugin>
 				<artifactId>maven-source-plugin</artifactId>
-				<version>3.4.0</version>
+				<version>${mvn-source.version}</version>
 				<executions>
 					<execution>
 						<id>attach-sources</id>
@@ -286,7 +301,7 @@
 			</plugin>
 			<plugin>
 				<artifactId>maven-javadoc-plugin</artifactId>
-				<version>3.12.0</version>
+				<version>${mvn-javadoc.version}</version>
 				<executions>
 					<execution>
 						<id>attach-javadocs</id>
@@ -325,6 +340,28 @@
 					</tags>
 				</configuration>
 			</plugin>
+
+			<!-- for reproducible builds, fix version for plugins bound in built-in jar lifecycle -->
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-clean-plugin</artifactId>
+				<version>${mvn-clean.version}</version>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-install-plugin</artifactId>
+				<version>${mvn-install.version}</version>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-deploy-plugin</artifactId>
+				<version>${mvn-deploy.version}</version>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-resources-plugin</artifactId>
+				<version>${mvn-resources.version}</version>
+			</plugin>
 		</plugins>
 	</build>
 
@@ -394,7 +431,7 @@
 				<plugins>
 					<plugin>
 						<artifactId>maven-gpg-plugin</artifactId>
-						<version>3.2.8</version>
+						<version>${mvn-gpg.version}</version>
 						<executions>
 							<execution>
 								<id>sign-artifacts</id>