On 19/10/2023 03:17, Christopher Schultz wrote: <snip/>
But Mark, if you missed my message from the 13th, you'll see that the problem is I'm running a slightly different version of Java than you are, and the exact spelling of the version string is causing the problem -- mostly in MANIFEST.MF files because the whole JRE's version string is present in there and not just the version number.
I did see that but filed it under the known issue that JARs that don't get passed through BND end up with the Ant and Java version numbers in the manifest. Fixing that is on my TODO list.
A recent commit of mine adds the release version number (only) to the build.properties.release file so it can be checked for a match in verify-release. I wonder if we should check the full version string to ensure the verifier and releaser are using the exact same versions. That's really the only way to prevent someone from attempting to verify a release and claiming it's not reproducible for not-relevant reasons.
With the current build process, I agree with you that we need to check the exact Java version used. I'm hopeful that with the manifest fix, we could create repeatable builds with different Java/Ant versions. How different I'm not sure. Hopefully within a major Java version. If we are lucky, across major Java versions.
And I'd very much like to make it next-to-trivial for anyone to verify a release build.
+1 Mark --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
