|
| Summary: |
Extension descriptors in the WAR record the builder aren ' s Maven repository list t fully reproducible |
| Description: |
The .xed extension descriptors in the WAR contain the repository list at build time, which makes the build not really reproducible. Further, {{user.name}} leaks in via third-party POM interpolation: Grizzly's scm URL is {{ssh://${user.name}@git.java.net/…}} which is replaced at build time, so 3 {{.xed}} files in the XIP say contain the current user's name. These differences then also affect the XIP and Debian packages. |
|
