Add ability to disable "generated" timestamp

[nielsvanvelzen]

For the app I'm working on (jellyfin-androidtv) we want to publish builds to F-Droid. Ideally we'd use reproducible builds with that. After the reproducible builds failing for some time I found out this library causes a small issue.

The "res/iz.json" file that is generated contains a timestamp (metadata.generated) which is unique for each build. This makes the build not reproducible.

Would it be possible to add an option to either remove the property / set it to null / hardcode a value?

If you're interested in more reasoning why reproducible builds matter you can read at https://reproducible-builds.org (I'm not the best explainer).

[mikepenz]

Thank you very much for the report @nielsvanvelzen . That's a great suggestion, and makes a lot of sense.

The timestamp was introduced to offer teams who only generate new dependency exports on-demand a tool to verify when the given export was generated (to prevent potential build issues where the generation would no longer work)

I'll have a look into this, but a configuration option for the plugin will most likely make most sense.

[mikepenz]

After a closer look, you can already achieve this right away by excluding the generated field from the target json:

aboutLibraries {
    excludeFields = arrayOf("generated")
}

[nielsvanvelzen]

Awesome, it does indeed remove the field from the generated JSON. Can I expect this functionality to keep working (e.g. the field won't be required in the runtime part of the library in a later release)?

[mikepenz]

There are no plans to use the field as part of the runtime, similarly most other fields are optional and can be dropped to lower size of the meta-data.

[eighthave]

What about making this generated thing an opt-in feature? Sounds like most apps don't use it, and it will always break reproducible builds. These days, most Android apps are reproducible without the dev having to do specific configuration. On f-droid.org, we have at least 60 apps affected.

For example, here is what it looks like when AboutLibraires is the only thing breaking reproducble builds:
https://verification.f-droid.org/de.lukasneugebauer.nextcloudcookbook_37.apk.diffoscope.html

[mikepenz]

It was a means to help integrators identify when the file was generated the last time.

I do agree, though, that most integrating parties might not think about it resulting in non-reproducible builds, and that it is probably best to inverse the default.

---

While not the same simplicity as just dropping in the plugin:
I generally believe people should generate the file on-demand instead of just generating it with the android tasks - so the file is checked in and in full control: https://github.com/mikepenz/AboutLibraries?tab=readme-ov-file#enterprise