[MARTIFACT-57] Combining artifact:buildinfo and artifact:compare fails

**[Marcono1234](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=marcono1234)** opened **[MARTIFACT-57](https://issues.apache.org/jira/browse/MARTIFACT-57?redirect=false)** and commented

## The issue

When you combine the goals `artifact:buildinfo` and `artifact:compare`, then `compare` fails, claiming the `.buildinfo` file differs.
For my build the `artifact:buildinfo` goal is configured in the `build` section of the `pom.xml` so that it always creates the `.buildinfo` file.

I haven't investigated this in detail, but to me it seems the underlying issue is this:
When running `mvn clean verify artifact:compare` (as suggested by the [Maven guide](https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-to-test-my-maven-build-reproducibility)):
1. It implicitly runs the `artifact:buildinfo` goal during the `verify` phase and attaches the `.buildinfo` artifact.
2. `artifact:compare` itself seems to also generate a `.buildinfo` file which is supposed to include all artifacts, but this (erroneously?) includes the `.buildinfo` file from `artifact:buildinfo`.
And also, because it is currently in the process of overwriting that file, it seems to report `length=0` (\?).

## Reproduction steps

1. Create a `pom.xml` with the following content:

```xml

4.0.0

com.mycompany.app
my-app
1.0-SNAPSHOT

UTF-8
2023-01-01T00:00:00Z

org.apache.maven.plugins
maven-artifact-plugin
3.5.0



buildinfo

```

1. Run

```
mvn clean install
```

1. Run

```
mvn clean verify artifact:compare
```

(x) Bug: It fails, claiming the `.buildinfo` files differ
1. Inspect the `target/my-app-1.0-SNAPSHOT.buildinfo` file
(x) Bug: It contains the following bogus entry

```
outputs.2.groupId=com.mycompany.app
outputs.2.filename=my-app-1.0-SNAPSHOT.buildinfo
outputs.2.length=0
outputs.2.checksums.sha512=cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
```

**Important:** Remember to delete the `/.m2/repository/com/mycompany` directory from your local Maven repository afterwards.

## Workaround

Run `artifact:compare` in combination with `-Dbuildinfo.attach=false`:

```
mvn clean verify artifact:compare -Dbuildinfo.attach=false
```

---

**Affects:** 3.5.0

Start by reproducing the failure with the provided pom.xml and the two Maven commands, then inspect the artifact:compare and artifact:buildinfo interaction around the generated target/*.buildinfo file. Done means the combined command succeeds and the generated buildinfo does not contain itself as an output; verify the existing -Dbuildinfo.attach=false workaround no longer changes the result.

Written by the indexing model from the issue text.