Make all generated archives reproducible

[snazy]

To be able to validate a release artifact (jar, tarball, zip, etc) against the state of the source tree, the artifacts need to be generated in a reproducible way.

There are a few, totally build related differences as of today:

1. jar files: META-INF/MANIFEST.MF have different attributes (fixed)
   • Apache-Polaris-Is-Release (depends on the -Prelease vs just -PjarWithGitinfo property)
   • Apache-Polaris-Build-Git-Describe (same as above)
   • Apache-Polaris-Build-Timestamp - could be changed to the Git commit timestamp using UTC
   • Apache-Polaris-Build-System - remove this one
   • Apache-Polaris-Build-Java-Version - remove this one
2. jar files: META-INF/jandex.idx are reported to be different (fixed)
3. jar files: mtime of META-INF/MANIFEST.MF and META-INF/jandex.idx vary (fixed)
4. ..../quarkus/generated-bytecode.jar class files differ. Since Quarkus 3.28.2, the generated bytecode is often the same, but there is still no guarantee.
5. varying order of entries in Quarkus re-assembled .../app/polaris-*.jar archives (Reproducible order of enties in app/<project-name>.jar quarkusio/quarkus#50578)
6. "group write" POSIX permission varies between platforms for zip/tar archive entries (fixed via Reproducible builds: ensure unix permissions are reproducible #2819)
   With all mentioned issues addressed, it should be possible to build distribution artifacts that match binary, leading to the same sha512.
7. source tarballs have entries with "current mtime". The source tarballs should use a fixed mtime (fixed via Reproducible builds: use a fixed mtime for all entries in the source tarball #2823)
8. "Top level POM" is not reproducible, because the POM <developers> and <contributors> elements are dynamically populated at build time (fixed via Reproducible builds: make parent pom content reproducible #2826).
9. Helm chart package tarball (generated via helm package) is not reproducible, helm package has no options to "fix" entries' mtime and POSIX attributes.

[jbonofre]

Thanks for this issue, good point indeed.

[snazy]

For reference, opened a Jandex issue smallrye/jandex#568

[snazy]

For posterity, there's active work going on to address the reproducibility of Jandex indexes and Quarkus generated code.