From 34ce16ba48268dfe2c4421dbc97949c99453524f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20L=C3=A4ubrich?= <christoph@laeubi-soft.de>
Date: Tue, 30 Jan 2024 09:19:27 +0100
Subject: [PATCH] Use a TreeSet instead of HashSet to get consistent ordering
 of results

Currently a HashSet is used to collect the source files, this means that
the order returned is unspecified and in the worst case even random
across machines/jvms. In some rare cases it could happen that this even
has a slight influence on the produced class files if sources are
processed in different order and therefore threat reproducible builds.

This now uses a TreeSet instead of a HashSet so the results are always
in a deterministic order using the String#compare contract.
---
 .../codehaus/plexus/compiler/AbstractCompiler.java   | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/plexus-compiler-api/src/main/java/org/codehaus/plexus/compiler/AbstractCompiler.java b/plexus-compiler-api/src/main/java/org/codehaus/plexus/compiler/AbstractCompiler.java
index 13f5b47b..7a3a4a52 100644
--- a/plexus-compiler-api/src/main/java/org/codehaus/plexus/compiler/AbstractCompiler.java
+++ b/plexus-compiler-api/src/main/java/org/codehaus/plexus/compiler/AbstractCompiler.java
@@ -26,9 +26,9 @@
 import java.io.File;
 import java.io.IOException;
 import java.util.Collections;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
+import java.util.TreeSet;
 
 import org.codehaus.plexus.util.DirectoryScanner;
 import org.slf4j.Logger;
@@ -99,18 +99,22 @@ protected org.codehaus.plexus.logging.Logger getLogger() {
 
     public abstract String getCompilerId();
 
+    @Override
     public CompilerResult performCompile(CompilerConfiguration configuration) throws CompilerException {
         throw new CompilerNotImplementedException("The performCompile method has not been implemented.");
     }
 
+    @Override
     public CompilerOutputStyle getCompilerOutputStyle() {
         return compilerOutputStyle;
     }
 
+    @Override
     public String getInputFileEnding(CompilerConfiguration configuration) throws CompilerException {
         return inputFileEnding;
     }
 
+    @Override
     public String getOutputFileEnding(CompilerConfiguration configuration) throws CompilerException {
         if (compilerOutputStyle != CompilerOutputStyle.ONE_OUTPUT_FILE_PER_INPUT_FILE) {
             throw new RuntimeException("This compiler implementation doesn't have one output file per input file.");
@@ -119,6 +123,7 @@ public String getOutputFileEnding(CompilerConfiguration configuration) throws Co
         return outputFileEnding;
     }
 
+    @Override
     public String getOutputFile(CompilerConfiguration configuration) throws CompilerException {
         if (compilerOutputStyle != CompilerOutputStyle.ONE_OUTPUT_FILE_FOR_ALL_INPUT_FILES) {
             throw new RuntimeException("This compiler implementation doesn't have one output file for all files.");
@@ -127,6 +132,7 @@ public String getOutputFile(CompilerConfiguration configuration) throws Compiler
         return outputFile;
     }
 
+    @Override
     public boolean canUpdateTarget(CompilerConfiguration configuration) throws CompilerException {
         return true;
     }
@@ -174,7 +180,7 @@ protected static Set<String> getSourceFilesForSourceRoot(CompilerConfiguration c
 
         String[] sourceDirectorySources = scanner.getIncludedFiles();
 
-        Set<String> sources = new HashSet<>();
+        Set<String> sources = new TreeSet<>();
 
         for (String sourceDirectorySource : sourceDirectorySources) {
             File f = new File(sourceLocation, sourceDirectorySource);
@@ -186,7 +192,7 @@ protected static Set<String> getSourceFilesForSourceRoot(CompilerConfiguration c
     }
 
     protected static String[] getSourceFiles(CompilerConfiguration config) {
-        Set<String> sources = new HashSet<>();
+        Set<String> sources = new TreeSet<>();
 
         Set<File> sourceFiles = config.getSourceFiles();