Bug#785719: glassfish: toplink-essentials package embeds current timestamp in manifest via ant <tstamp> task in build.xml

[Daniel Kahn Gillmor]

Package: glassfish
Version: 1:2.1.1-b31g+dfsg1-2
Severity: wishlist
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: timestamps

glassfish is currently not a reproducible backage because of an embedded
datestamp in a couple places in toplink-essentials.  See:

  https://reproducible.debian.net/rb-pkg/unstable/amd64/glassfish.html

Below is a diagnosis and a patch.

entity-persistence/build.xml contains the following use of the ant
<tstamp> task (https://ant.apache.org/manual/Tasks/tstamp.html), which
ends up populating the properties build_number_string and
full_version_string:

--------------
    <tstamp>
       <format property="build_date" pattern="MM/dd/yyyy"/>
    </tstamp>
    <condition property="build_number" value="${build_id}">
        <not>
            <or>
                <equals arg1="${build_id}" arg2="" trim="true"/>
                <equals arg1="${build_id}" arg2="local" trim="true"/>
            </or>
        </not>
    </condition>
    <property name="build_number" value="SNAPSHOT"/>
    <property name="build_number_string" value="${build_number} (${build_date})"/>
    <property name="full_version" value="${release.version}-${build_number}"/>
    <property name="full_version_string" value="${full_version} (${build_date})"/>
--------------


those two properties are used in replacements during the build:

--------------
    <!-- prepare manifest files for jars -->
    <target name="cook-manifest" depends="init"
            description="Generate MANIFEST.MF files">
        <mkdir dir="${build.dir}/manifest"/>
        <copy todir="${build.dir}/manifest">
            <fileset dir="." includes="*.mf" />
            <filterset>
                <filter token="VERSION" value="${full_version_string}"/>
            </filterset>
        </copy>
    </target>
---------------

---------------
    <target name="compile" depends="init, antlr-generate"
            description="Compile TopLink Essentials sources">  
        <copy file="${src.dir}/oracle/toplink/essentials/Version.java" 
              tofile="${component.classes.dir}/oracle/toplink/essentials/Version.java"/>
        <replace file="${component.classes.dir}/oracle/toplink/essentials/Version.java">
            <replacefilter token="@VERSION@" value="${release.version}"/>
            <replacefilter token="@BUILD_NUMBER@" value="${build_number_string}"/>
        </replace>

---------------

As a result, "VERSION" in the .mf files and @BUILD_NUMBER@ in the rest
of the code end up including the datestamp:

0 dkg at alice:~/src/glassfish/glassfish/entity-persistence$ find . -name '*.mf' -print0 | xargs -0 grep VERSION
./toplink-essentials-agent.mf:Implementation-Version: @VERSION@
./toplink-essentials.mf:Implementation-Version: @VERSION@
0 dkg at alice:~/src/glassfish/glassfish/entity-persistence$ git grep '@BUILD_NUMBER@'
build.xml:            <replacefilter token="@BUILD_NUMBER@" value="${build_number_string}"/>
src/java/oracle/toplink/essentials/Version.java:    private static final String buildNumber = "@BUILD_NUMBER@";
0 dkg at alice:~/src/glassfish/glassfish/entity-persistence$



The attached patch should make it possible to use an environment
variable $BUILD_DATE instead of the timestamp gathered by ant, if that
environment variable is set.  It also sets the environment variable in
debian/rules.

I am not an ant guru.  If you see a better way to do this, please
improve upon my patch!

        --dkg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-make-build-reproducible.patch
Type: text/x-diff
Size: 2788 bytes
Desc: make glassfish reproducible
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20150519/76925cc1/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 948 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20150519/76925cc1/attachment.sig>