apache / apache/maven-build-cache-extension

Locally built transitive snapshot artifacts don't cause checksum change of a dependent module

Open
#407 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
163
Forks
77
Avg merge
1d 2h
Merged PRs (30d)
4

Description

### Affected version

1.2.1

### Bug description

Our setup might be a bit unique.
We have 2 maven multi module projects one libs and one apps (they share a parent multi module but it's irrelevant).

We compile the libs first and then the apps. All libs versions are snapshot versions.

When a change is made to one of the libs module, If the an app module does not directly reference said lib module its checksum is unchanged, as the effective pom is unchanged and looking the the buildinfo.xml for the app module it only includes the direct snapshot dependencies and not all transitive snapshots dependencies.

There is a contributing factor, we also set the jar plugin outputTimestamp for a reproducible build but it can also be set globally with the project.build.outputTimestamp property as defined in the [maven reproducible builds documentation](https://maven.apache.org/guides/mini/guide-reproducible-builds.html) , I can go into details why it's necessary if needed.

In cases where the direct snapshot dependency of the app module doesn't change any bytecode during its triggered build while having the same timestamps in the jar entries (due to reproducible build) it will have the same checksum and will not trigger a build of the app module.

Thanks!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the two-project Maven multi-module setup with reproducible jar timestamps, then inspect the dependent app's buildinfo.xml and checksum inputs. Done means a change in a locally built transitive snapshot dependency causes the dependent app's checksum and cache decision to update, even when its direct dependency is byte-for-byte unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.