Paradaux
Issues

PAR-267

0

Gate mavenLocal() behind a dev flag so builds are reproducible

Pending ReleaseUnassignedTreasury

treasury, business, and chestshop list mavenLocal() first in their repositories, so a stale or tampered locally-published artifact silently wins over the declared remotes — a non-reproducible, machine-dependent build (AUDIT.md §2, HIGH).

hibernia-framework (the only reason mavenLocal was first) is published to repo.paradaux.io/snapshots, so normal/CI builds resolve it remotely without mavenLocal.

Fix: only add mavenLocal() when -PuseMavenLocal is set (added first, preserving "local wins" semantics for devs iterating on the hibernia-framework submodule). Default off → reproducible builds.

Resources

Comments

No comments yet.

Activity

  • ParadauxIO linked a pull request — PR #2 open — Last major release
  • ParadauxIO linked a pull request — PR #2 open — Last major release
  • ParadauxIO linked a pull request — PR #2 open — Last major release
  • ParadauxIO linked a pull request — PR #2 open — Last major release
  • ParadauxIO linked a pull request — PR #2 open — Last major release
  • ParadauxIO linked a pull request — PR #2 open — Last major release
  • ParadauxIO linked a pull request — PR #2 open — Last major release
  • ParadauxIO linked a commit — Commit 1da15be — Gate mavenLocal() behind -PuseMavenLocal for reproducible builds (PAR-267)
  • tesks changed status to Status → Pending Release
  • tesks created the issue