From a8ef18d5f2d865a59cbdb779cabd11b20ee8d2ff Mon Sep 17 00:00:00 2001
From: Ryan Baxter <ryan.baxter@broadcom.com>
Date: Fri, 4 Sep 2026 13:17:48 -0400
Subject: [PATCH] Make Spring Cloud builds reproducible

---
 pom.xml                                  | 14 ++++++++++++++
 spring-cloud-build-dependencies/pom.xml  |  3 +++
 spring-cloud-dependencies-parent/pom.xml |  3 +++
 3 files changed, 20 insertions(+)

diff --git a/pom.xml b/pom.xml
index c2fe13e6..b95d9f2e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -24,6 +24,10 @@
 		<resource.delimiter>@</resource.delimiter>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+		<!-- Reproducible builds. Inherited by every project that uses spring-cloud-build
+			 as its parent, so it does not need to be repeated downstream.
+			 Fixed constant, deliberately not tied to release time: it never needs to change. -->
+		<project.build.outputTimestamp>1980-02-01T00:00:00Z</project.build.outputTimestamp>
 		<maven.compiler.source>${java.version}</maven.compiler.source>
 		<maven.compiler.target>${java.version}</maven.compiler.target>
 		<main.basedir>${basedir}</main.basedir>
@@ -580,6 +584,16 @@
 					<configuration>
 						<verbose>true</verbose>
 						<dateFormat>yyyy-MM-dd'T'HH:mm:ssZ</dateFormat>
+						<!-- Reproducible builds: render all timestamps in UTC, otherwise git.properties
+							 differs between build machines in different timezones. -->
+						<dateFormatTimeZone>UTC</dateFormatTimeZone>
+						<!-- Reproducible builds: these vary by build machine and user, and nothing
+							 reads them. Keeping them would leak the builder's identity into the jar. -->
+						<excludeProperties>
+							<excludeProperty>git.build.host</excludeProperty>
+							<excludeProperty>git.build.user.name</excludeProperty>
+							<excludeProperty>git.build.user.email</excludeProperty>
+						</excludeProperties>
 						<generateGitPropertiesFile>true</generateGitPropertiesFile>
 						<generateGitPropertiesFilename>
 							${project.build.outputDirectory}/git.properties
diff --git a/spring-cloud-build-dependencies/pom.xml b/spring-cloud-build-dependencies/pom.xml
index d33f6a1a..8cf06376 100644
--- a/spring-cloud-build-dependencies/pom.xml
+++ b/spring-cloud-build-dependencies/pom.xml
@@ -20,6 +20,9 @@
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<spring-boot.version>4.2.0-SNAPSHOT</spring-boot.version>
+		<!-- Reproducible builds. This module does not inherit from spring-cloud-build,
+	 so the property has to be repeated here. Keep in sync with the parent pom. -->
+		<project.build.outputTimestamp>1980-02-01T00:00:00Z</project.build.outputTimestamp>
 		<okhttp.version>4.12.0</okhttp.version>
 		<maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
 		<central-publishing-maven-plugin.version>0.9.0</central-publishing-maven-plugin.version>
diff --git a/spring-cloud-dependencies-parent/pom.xml b/spring-cloud-dependencies-parent/pom.xml
index 0ddb3828..24a0ad36 100644
--- a/spring-cloud-dependencies-parent/pom.xml
+++ b/spring-cloud-dependencies-parent/pom.xml
@@ -72,6 +72,9 @@
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<central-publishing-maven-plugin.version>0.9.0</central-publishing-maven-plugin.version>
 		<maven-deploy-plugin.version>3.1.4</maven-deploy-plugin.version>
+		<!-- Reproducible builds. This module does not inherit from spring-cloud-build,
+			 so the property has to be repeated here. Keep in sync with the parent pom. -->
+		<project.build.outputTimestamp>1980-02-01T00:00:00Z</project.build.outputTimestamp>
 	</properties>
 	<distributionManagement>
 		<downloadUrl>https://github.com/spring-cloud</downloadUrl>