fix: make module attribute string encoding deterministic - #127
Conversation
This value makes it into the `pom.xml`'s `extraDependencyAttributes` property at least for SBT, and it'd be good to have this be deterministic: aside from general hygiene, generating them bit-by-bit reproducibly helps validating no malware was sneaked into the artifacts. This is also called 'Reproducible Builds' (https://reproducible-builds.org/)
|
I'm really not opposed to making things more deterministic, although Ivy and Ant itself probably have a long way to go to make reproducible builds easier. But I currently fail to make the connection between the code you changed and Please note the SBT fork of Ivy is based on a pretty old version of Ivy. |
|
https://github.com/sbt/librarymanagement/blob/2b23ada9ab5ae2615823d44c82a18cd325e567e6/ivy/src/main/scala/sbt/internal/librarymanagement/mavenint/PomExtraDependencyAttributes.scala#L127 likely is the connection I was missing. Regardless of whether we merge the PR or not, you will need to ensure the SBT folks pick it up as well. |
|
Jep, that's the place
I'm aware I'll have to propose it to sbt/ivy separately, but it seemed neatest to first submit it here 'upstream' before 'backporting' it to their fork
…On July 9, 2026 9:47:59 PM GMT+02:00, Stefan Bodewig ***@***.***> wrote:
bodewig left a comment (apache/ant-ivy#127)
https://github.com/sbt/librarymanagement/blob/2b23ada9ab5ae2615823d44c82a18cd325e567e6/ivy/src/main/scala/sbt/internal/librarymanagement/mavenint/PomExtraDependencyAttributes.scala#L127 likely is the connection I was missing.
Regardless of whether we merge the PR or not, you will need to ensure the SBT folks pick it up as well.
--
Reply to this email directly or view it on GitHub:
#127 (comment)
You are receiving this because you authored the thread.
Message ID: ***@***.***>
|
|
We mention people who have contributed in the release notes. Is this fine with you and is "Arnout Engelen" the name I shall use? |
|
Yes - thanks for the fast review!
…On 10 July 2026 07:52:56 CEST, Stefan Bodewig ***@***.***> wrote:
bodewig left a comment (apache/ant-ivy#127)
We mention people who have contributed in the release notes. Is this fine with you and is "Arnout Engelen" the name I shall use?
--
Reply to this email directly or view it on GitHub:
#127 (comment)
You are receiving this because you authored the thread.
Message ID: ***@***.***>
|
|
thank you |
|
@raboof if you talk to the SBT Ivy people. you may want them to pick up 8644f1b as well because of CVE-2026-26032 |
2 participants
This value makes it into the
pom.xml'sextraDependencyAttributesproperty at least for SBT, and it'd be good to have this be deterministic: aside from general hygiene, generating them bit-by-bit reproducibly helps validating no malware was sneaked into the artifacts. This is also called 'Reproducible Builds' (https://reproducible-builds.org/)