enable Reproducible Builds

[hboutemy]

minimum work done based on https://maven.apache.org/guides/mini/guide-reproducible-builds.html

this gives a good first step, even if not perfect as jaxb-tools uses jaxb-tools, that currently does not easily permit users to get reproducible generated content: see jvm-repo-rebuild/reproducible-central#139 and #572

so this implements first step of #642

#572 will be also required to have jaxb-tools itself fully reproducible (or same workarounds as https://github.com/apache/santuario-xml-security-java/blob/main/pom.xml#L399

[hboutemy]

quite good result for now: Reproducible Build output summary: 65 files ok, 4 different

and the 4 differences are simply a timestamp in generated content META-INF/sun-jaxb.episode
= what the diffoscope analysis shows when looking at

[ERROR] sha512 mismatch hyperjaxb3-ejb-schemas-persistence-4.0.10-SNAPSHOT.jar: investigate with diffoscope target/reference/org.jvnet.jaxb/hyperjaxb3-ejb-schemas-persistence-4.0.10-SNAPSHOT.jar hyperjaxb/ejb/schemas/persistence/target/hyperjaxb3-ejb-schemas-persistence-4.0.10-SNAPSHOT.jar
[ERROR] sha512 mismatch hyperjaxb3-ejb-schemas-persistence-4.0.10-SNAPSHOT-sources.jar: investigate with diffoscope target/reference/org.jvnet.jaxb/hyperjaxb3-ejb-schemas-persistence-4.0.10-SNAPSHOT-sources.jar hyperjaxb/ejb/schemas/persistence/target/hyperjaxb3-ejb-schemas-persistence-4.0.10-SNAPSHOT-sources.jar
[ERROR] sha512 mismatch hyperjaxb3-ejb-schemas-customizations-4.0.10-SNAPSHOT.jar: investigate with diffoscope target/reference/org.jvnet.jaxb/hyperjaxb3-ejb-schemas-customizations-4.0.10-SNAPSHOT.jar hyperjaxb/ejb/schemas/customizations/target/hyperjaxb3-ejb-schemas-customizations-4.0.10-SNAPSHOT.jar
[ERROR] sha512 mismatch hyperjaxb3-ejb-schemas-customizations-4.0.10-SNAPSHOT-sources.jar: investigate with diffoscope target/reference/org.jvnet.jaxb/hyperjaxb3-ejb-schemas-customizations-4.0.10-SNAPSHOT-sources.jar hyperjaxb/ejb/schemas/customizations/target/hyperjaxb3-ejb-schemas-customizations-4.0.10-SNAPSHOT-sources.jar

[laurentschoelens]

LGTM

[laurentschoelens]

@hboutemy thanks for PR

That was quite what I was doing but not knowing if right or wrong.
Diff should be fixed after jaxb-xjc bug being fixed too I guess.

Did you try running with -P all maven profile ?

[hboutemy]

I tested with >sonatype-oss-release profile, which add source and javadoc = the interesting aspects
I see that all profile adds a documentation: is it really published to Maven Central?

[hboutemy]

notice: active check on every commit is

1. not efficient: every build requires 2 builds
2. done too ealry: it has a chance to work only adter xjc is fixed

don't go too fast, or it will go against you