Reproducible Builds with Apache Maven
summary
Demonstrates that byte-for-byte reproducible Java builds with Apache Maven are practical now: over 2,000 releases from ~500 Maven Central projects are verifiable using an open-source harness called reproducible-central and an automated rebuild.sh + Docker workflow that rebuilds and compares artifacts. Describes concrete tools and checks—diphoscope for archive diffs and bytecode inspection, Maven plugins such as artifact:check-build-plan—and reports real findings (some projects achieve 100% reproducibility, while others expose issues like timestamps, file-permission differences, JDK variants, leaked usernames, or even a PGP passphrase).
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:26Reproducible builds theory
- 9:51Binary reproducibility principle
- 10:11Demo with Maven Central
- 17:16Rebuild with automated scripts
- 19:25Maven config for reproducibility
- 23:55Quiz and results
- 28:12Conclusion
