release 1.0.6 is not reproducible

[hboutemy]

timestamp of META-INF/versions/9/module-info.class is not reproducible

https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/codehaus/plexus/plexus-languages/plexus-languages-1.0.6.diffoscope

[rfscholte]

I guess a bug in plexus archiver, right?

[hboutemy]

I guess Maven JAR Plugin, on its calls to archive version-specific classes
but I need to investigate to be sure

[rfscholte]

Now I remember, it is caused by https://github.com/codehaus-plexus/plexus-archiver/blob/master/src/main/java/org/codehaus/plexus/archiver/jar/JarToolModularJarArchiver.java

[hboutemy]

oh nice: yes, this looks like the right location. Thank you for pointing out before I loose time looking at wrong location :)

is there a chance that we inject a timestamp to this process?
IIUC https://github.com/codehaus-plexus/plexus-archiver/blob/master/src/main/java/org/codehaus/plexus/archiver/jar/JarToolModularJarArchiver.java#L162 , it uses jar in-process CLI tool, and I don't see any parameter to define timestamp: would that mean that the only option is to modify timestamp on disk? (I don't like that idea...)

[hboutemy]

notice: this discussion would probably be better done in plexus-archiver...
need to create an issue: I'll do it tonight if you don't beat me at it

[olamy]

@hboutemy I guess we can close this one?

[hboutemy]

@olamy sadly I'm not sure at all: this one is tricky given how it is done

[rfscholte]

This one needs to be crosslinked with the ticket of plexus-archiver

[slachiewicz]

codehaus-plexus/plexus-archiver#164

[rfscholte]

Let's keep it open until it is reproducible, otherwise it looks it is fixed (even though the fix is somewhere else)

[andpab]

The crosslinked issue codehaus-plexus/plexus-archiver#164 was apparently fixed by #205 and closed a few months ago. I think that means this one can be closed as well.

On a side note: How about spinning a new release of plexus-languages? The asm version updates would bring Java 19 and Java 20 bytecode support.

On another side note: The label "depdendency upgrade" has a typo in it.