make build Reproducible (mostly)

[hboutemy]

following Maven's guide https://maven.apache.org/guides/mini/guide-reproducible-builds.html

I could not check that the result was fully reproducible, because I can't run rpm
but if you follow instruction to check a rebuild against initial build, I'm pretty sure that most of the output content is reproducible: I'm interested to know what remains not reproducible (I suppose the rpm/deb files...)

[CLAassistant]

All committers have signed the CLA.

[hengyunabc]

Thanks for the PR, but arthas using the git-commit-id-maven-plugin: git-commit-id/git-commit-id-maven-plugin#472 .

May have to wait for the new version of the git-commit-id-maven-plugin.

[hboutemy]

maybe you won't have 100% reproducible artifacts yet, but are really all binary artifacts impacted by this?
isn't it worth improving now what can be improved to be listed on Reproducible Central https://github.com/jvm-repo-rebuild/reproducible-central with partial reproducibility, and working on next steps after?

[kylixs]

@hboutemy Could you update git-commit-id-plugin to the latest version (4.0.1)? Seems to be ready for reproducible builds.
https://github.com/git-commit-id/git-commit-id-maven-plugin/releases/tag/v4.0.1
Also please resolve code conflicts.

[hboutemy]

@kylixs done

[kylixs]

Add configuration <injectAllReactorProjects>true</injectAllReactorProjects> to git-commit-id-plugin, make all subprojects use the same git.build.time.
But there is still a problem, there is no way to use project.build.outputTimestamp for the initial value of git.build.time,
it is always initialized to the current time of the system:

  // git-commit-id-plugin-core : pl.project13.core.cibuild.BuildServerDataProvider
  private void loadBuildVersionAndTimeData(@Nonnull Properties properties) {
    Supplier<String> buildTimeSupplier = () -> {
      Date buildDate = new Date();
      SimpleDateFormat smf = new SimpleDateFormat(dateFormat);
      if (dateFormatTimeZone != null) {
        smf.setTimeZone(TimeZone.getTimeZone(dateFormatTimeZone));
      }
      return smf.format(buildDate);
    };
    maybePut(properties, GitCommitPropertyConstant.BUILD_TIME, buildTimeSupplier);

[kylixs]

add issue to git-commit-id-maven-plugin : Allow initial git.build.time from project.build.outputTimestamp to support reproducible builds

[hboutemy]

FYI, I added Arthas 3.3.7 release evaluation to reproducible-central jvm-repo-rebuild/reproducible-central#27
the arthas-git.properties file generated by git-commit-id-maven-plugin is not reproducible at all

[hengyunabc]

@hboutemy Thanks, the next release will be reproducible.