Refactor Maven and the mostly used plugins to be reproducible builds

[hendrikebbers]

We need to check if Maven and the mostly used plugins are support reproducible builds. If not we should refactor the project (and maven its dependencies if needed) to support reproducible builds. Best would be to have an automatic check as one of the release steps for Maven.

[khmarbaise]

Some references:

• https://reproducible-builds.org/
• https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=74682318

[aalmiray]

There is also https://github.com/jvm-repo-rebuild/reproducible-central

[hendrikebbers]

Nice. Missed that one

[hboutemy]

Best would be to have an automatic check as one of the release steps for Maven.

see command at the end of "Call the vote" section https://maven.apache.org/developers/release/maven-project-release-procedure.html#call-the-vote

notice that Reproducible Central detects staged Apache releases (of already tested projects) and proposes a staging rebuild https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/doc/add.md#apache-release-candidate-in-staging

[khmarbaise]

That is related to #27 to handle that in an automated way...

[hboutemy]

FYI, 4 years ago, I did such checks on SNAPSHOTs of "everything Maven": https://github.com/jvm-repo-rebuild/reproducible-maven-HEAD
I just archived it as every Maven-related release is checked for a few years now: this repository is just a view on how I did the global preparation