This issue is being opened in response to this thread.
I want to have reproducible artifacts output from scalac and sbt so that I can:
- Have multiple, independent CI servers generate a build, sign it, and require multiple signatures for any artifact to be valid later in a pipeline
- Have independent sources be able to compile and verify that the output JAR / class files are identical to what they compiled locally
Because this could be complicated by faffing about too much with a build.scala like embedding the current time somewhere, let's assume that not all builds will be reproducible and that doing so might require minimal tweaking.
It would be a stretch to require incremental compilation to be reproducible, so what would be sufficient is that any sbt clean compile outputs the exact same things.
This issue is being opened in response to this thread.
I want to have reproducible artifacts output from
scalacandsbtso that I can:Because this could be complicated by faffing about too much with a
build.scalalike embedding the current time somewhere, let's assume that not all builds will be reproducible and that doing so might require minimal tweaking.It would be a stretch to require incremental compilation to be reproducible, so what would be sufficient is that any
sbt clean compileoutputs the exact same things.