Details
-
Improvement
-
Status: Open
-
Major
-
Resolution: Unresolved
-
None
-
None
-
None
Description
With SLING-9307 and SLING-8951 all builds relying Parent 39 or newer should be reproducible. Still some parts are missing:
- buildinfo files should be uploaded along with the artifacts (https://maven.apache.org/guides/mini/guide-reproducible-builds.html) which allows to easily reproduce build (as they contain info about linebreaks and major JDK versions).
- The check-staged-release.sh should be updated accordingly to optionally try rebuilding and comparing with the given checksums.
- https://sling.apache.org/documentation/development/release-management.html should be extended with how to properly check a release after a vote.
- There should be some documentation covering how end-users could reproduce builds.
- On the downloads page (https://sling.apache.org/downloads.cgi) there should be a link to the buildinfo files for new/reproducible releases pointing to downloads.apache.org.
Attachments
Issue Links
- is related to
-
SLING-9307 Make build fully reproducible
- Closed