apache / apache/maven-shade-plugin
[MSHADE-482] ApacheNoticeResourceTransformer uses current year: not Reproducible
- Dominant language
- Java
- Stars
- 188
- Forks
- 103
- Avg merge
- 16h 39m
- Merged PRs (30d)
- 4
Description
**[Hervé Boutemy](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=hboutemy)** opened **[MSHADE-482](https://issues.apache.org/jira/browse/MSHADE-482?redirect=false)** and commented
found while rebuilding Paimon 1.0.0 https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/paimon/README.md
```
├── META-INF/NOTICE
│ @@ -1,14 +1,14 @@
│ // ------------------------------------------------------------------
│ // NOTICE file corresponding to the section 4d of The Apache License,
│ // Version 2.0, in this case for Apache Paimon
│ // ------------------------------------------------------------------
│
│ Apache Paimon
│ -Copyright 2023-2024 The Apache Software Foundation
│ +Copyright 2023-2025 The Apache Software Foundation
```
digging into it, found that it uses ApacheNoticeResourceTransformer, that injects current year:
https://github.com/apache/maven-shade-plugin/blob/maven-shade-plugin-3.6.0/src/main/java/org/apache/maven/plugins/shade/resource/ApacheNoticeResourceTransformer.java#L91
---
**Affects:** 3.6.0
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with src/main/java/org/apache/maven/plugins/shade/resource/ApacheNoticeResourceTransformer.java at the referenced line, and compare its generated META-INF/NOTICE output with the Paimon reproducibility diff. Determine how the notice year should behave without depending on the current year, then verify the result against a reproducible rebuild or an existing transformer test if one is found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100