Vendored Maven jar rebuild is not byte-reproducible across OSes (Windows differs) #275

[agent] Filed by Claude Code on behalf of Mikola Lysenko (@mikolalysenko) while adding Maven patch SBOM annotations to depscan.

Summary

The vendored Maven jar that socket-patch rebuilds locally is not byte-reproducible across operating systems. From the same inputs, Windows writes a jar with the same size but different bytes than Linux and macOS. The different jar sha256 lands in .socket/vendor/state.json (artifact.sha256) and in the committed .jar.sha1. A project vendored on Windows and re-vendored on Linux therefore churns its committed tree.

Evidence

depscan run https://github.com/SocketDev/depscan/actions/runs/36261631322 used the same socket-patch revision 3efdc31d built per OS, the same patch records, the same Maven Central upstream jars and a JDK 17 runner. It covered 13 Maven lines on ubuntu-latest, 9 on windows-latest and 3 on macos-latest. Each PASS cell's committed tree was compared with the macOS arm64 capture of the same (Maven version, shape, mode):

All 327 Windows cells are in the local-rebuild vendored modes: get --mode vendored --vendor-source build, scan --mode vendored --detached --vendor-source build, and get --save-only followed by vendor --offline. The --vendor-source service cells, which use the prebuilt jar, are identical. Hosted trees are identical on every OS.

The rebuilt jar was not uploaded, so which zip fields differ is not verified. Likely candidates are the per-entry "version made by" host byte, the external file attributes (Unix mode bits versus DOS attributes), or entry-name normalization of \ separators.

Expected

vendor/maven_repo.rs describes the rebuild as a deterministic re-zip. The same inputs should give the same jar bytes on every OS, so that committed vendored trees are stable across a team's machines.

Repro

Run socket-patch get <uuid> --mode vendored --vendor-source build on the same Maven project, with the same ~/.m2 jar, on Windows and on Linux, then compare sha256sum .socket/vendor/maven/<uuid>/**/*.jar. The depscan harness workspaces/pipeline/src/test/integration/socket-patch-sbom/maven-compatibility/capture-maven.py on PR SocketDev/depscan#26855 automates this per OS.

Note: the open perf PR #257 replaces the on-disk rebuild with an in-memory repack (stage_local_jar / MemoryRepack), so a fix may belong there.