From 87ca30aac974f19d5014883ebbe0081218a3e2f6 Mon Sep 17 00:00:00 2001
From: Sergey Ponomarev <stokito@gmail.com>
Date: Sun, 22 Sep 2024 20:25:11 +0300
Subject: [PATCH] OF-2877 Reproducible builds

Pin the build timestamp and disable Built-By, Created-By and Build-Jdk-Spec fields from generated manifest.
The Maven JAR plugin is updated to latest version that has the new option addDefaultEntries
---
 i18n/pom.xml       |  4 ++++
 plugins/pom.xml    | 10 +++++++++-
 pom.xml            |  6 +++++-
 starter/pom.xml    |  2 ++
 xmppserver/pom.xml |  4 ++++
 5 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/i18n/pom.xml b/i18n/pom.xml
index 87e5ed8779..a105700f2d 100644
--- a/i18n/pom.xml
+++ b/i18n/pom.xml
@@ -9,6 +9,10 @@
     <artifactId>i18n</artifactId>
     <name>Internationalization files for Openfire</name>
     <description>These files are shared among the starter and xmppserver modules</description>
+    <properties>
+        <!-- Use static build timestamp for reproducible builds -->
+        <project.build.outputTimestamp>2024-01-01T00:00:00Z</project.build.outputTimestamp>
+    </properties>
     <build>
         <resources>
             <resource>
diff --git a/plugins/pom.xml b/plugins/pom.xml
index 1ce4a3c6df..e899ad9b27 100644
--- a/plugins/pom.xml
+++ b/plugins/pom.xml
@@ -110,6 +110,8 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <!-- Use static build timestamp for reproducible builds -->
+        <project.build.outputTimestamp>2024-01-01T00:00:00Z</project.build.outputTimestamp>
 
         <!-- The name of the Openfire plugin (defaults to ${project.artifactId}. This value is somewhat particular:
            - * It is used as a Java package name (and thus, cannot contain characters like dashes and dots.
@@ -280,8 +282,14 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.1.1</version>
+                    <version>3.4.2</version>
                     <configuration>
+                        <archive>
+                            <manifest>
+                                <!-- Don't add Created-By and Build-Jdk-Spec fields to manifest for reproducible builds -->
+                                <addDefaultEntries>false</addDefaultEntries>
+                            </manifest>
+                        </archive>
                         <excludes>
                             <exclude>**/*_jsp.java</exclude>
                         </excludes>
diff --git a/pom.xml b/pom.xml
index 1f1f176e61..4da6f10a42 100644
--- a/pom.xml
+++ b/pom.xml
@@ -115,6 +115,8 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <!-- Use static build timestamp for reproducible builds -->
+        <project.build.outputTimestamp>2024-01-01T00:00:00Z</project.build.outputTimestamp>
 
         <!-- Versions -->
         <!-- Note; the following jetty.version should be identical to the jetty.version in plugins/pom.xml -->
@@ -225,12 +227,14 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.1.1</version>
+                    <version>3.4.2</version>
                     <configuration>
                         <archive>
                             <manifest>
                                 <addClasspath>false</addClasspath>
                                 <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
+                                <!-- Don't add Created-By and Build-Jdk-Spec fields to manifest for reproducible builds -->
+                                <addDefaultEntries>false</addDefaultEntries>
                             </manifest>
                             <manifestEntries>
                                 <Built-By>Jive Software (www.igniterealtime.org)</Built-By>
diff --git a/starter/pom.xml b/starter/pom.xml
index 8e73dacf29..a7286403b5 100644
--- a/starter/pom.xml
+++ b/starter/pom.xml
@@ -10,6 +10,8 @@
     <name>Starter for Openfire</name>
     <description>Starts Openfire and also launches the web admin interface in a web browser</description>
     <properties>
+        <!-- Use static build timestamp for reproducible builds -->
+        <project.build.outputTimestamp>2024-01-01T00:00:00Z</project.build.outputTimestamp>
     </properties>
     <build>
         <plugins>
diff --git a/xmppserver/pom.xml b/xmppserver/pom.xml
index 285195d2e2..b23c006b42 100644
--- a/xmppserver/pom.xml
+++ b/xmppserver/pom.xml
@@ -10,6 +10,8 @@
     <name>Core XMPP Server</name>
 
     <properties>
+        <!-- Use static build timestamp for reproducible builds -->
+        <project.build.outputTimestamp>2024-01-01T00:00:00Z</project.build.outputTimestamp>
         <warSourceDirectory>${basedir}/src/main/webapp</warSourceDirectory>
     </properties>
 
@@ -106,6 +108,8 @@
                     <archive>
                         <manifest>
                             <addClasspath>true</addClasspath>
+                            <!-- Don't add Created-By and Build-Jdk-Spec fields to manifest for reproducible builds -->
+                            <addDefaultEntries>false</addDefaultEntries>
                         </manifest>
                     </archive>
                     <excludes>