[Reproducibility] Make Maven resource encoding explicit and platform-independent

[seonghobae]

Buyer / reproducibility gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 configures Java compiler encoding as UTF-8 but does not define Maven's project resource encoding. Current hosted builds repeatedly emit:

[WARNING] Using platform encoding (UTF-8 actually) to copy filtered resources, i.e. build is platform dependent!

for etl-service, cdc-service, config-server, eureka-server, zuul-gateway, and test resources. CI #216 run 31365172201, macOS job 93381895015, reproduced this on Java 25.0.3 while the full reactor otherwise succeeded.

Status: known_gap / defer_until_trigger for root-POM mutation while direct-develop security PR #160 actively owns pom.xml. Do not create a competing root-POM writer merely to clear the warning. Re-read active POM owners and exact protected base immediately before implementation.

RCA

• Immediate cause: Maven Resources Plugin has no explicit project/resource encoding and falls back to the platform default.
• Technical root cause: compiler source encoding and resource-copy/filter encoding are separate Maven inputs; configuring <maven-compiler-plugin><encoding>UTF-8</encoding> does not establish ${project.build.sourceEncoding} for Maven resource goals.
• Control failure: repository tests permit a platform-dependent resource pipeline even though release issue [Release/Supply chain] Establish reproducible exact-head artifacts and provenance #165 requires nondeterministic build inputs to be identified and controlled.
• Risk: a different default platform encoding can transform filtered/non-ASCII resource bytes differently from the same source, weakening reproducibility and potentially changing runtime configuration/content without a source diff.

Apache Maven Resources Plugin documents the encoding parameter default as ${project.build.sourceEncoding} and its maintained encoding guidance identifies defining <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> in project properties as the best-practice project-wide contract. Maven's reproducible-build guidance separately defines reproducibility in terms of recreating identical artifacts from the same source/build inputs.

Bounded remediation after the root-POM writer lane is clear

1. Re-read protected root pom.xml, every open PR touching it, and the exact active writer lease.
2. RED first: add a repository/POM contract requiring exact project.build.sourceEncoding=UTF-8 and, where properties-resource semantics require distinction, prove whether project.build.outputTimestamp / propertiesEncoding are separately needed rather than guessing.
3. Observe hosted RED at the Maven configuration/resource boundary; setup/import/fixture failure does not qualify.
4. Apply the smallest supported root-POM property change. Do not duplicate an active fix(security): move Jackson to fixed 2.21.5 baseline #160 POM edit, introduce a competing Maven Resources Plugin version without cause, or rely on runner-wide file.encoding as repository authority.
5. Re-run the full hosted matrix and require the platform-encoding resource warnings to disappear across all reactor modules.
6. Add source-backed reproducibility doctoring/CHANGELOG only after behavior GREEN if a fail-first documentation contract requires it.

Acceptance

• repository source explicitly declares UTF-8 resource/build source encoding;
• resources:resources and resources:testResources no longer report platform-dependent encoding on supported hosted runners;
• non-ASCII main/test resource fixtures survive copying/filtering byte-for-byte according to the declared UTF-8 contract;
• compiler source encoding remains UTF-8 and no divergent child-module encoding is introduced;
• full applicable CI/dependency/SBOM/SAST/security gates regenerate on the exact candidate;
• change is traced to [Release/Supply chain] Establish reproducible exact-head artifacts and provenance #165 release/reproducibility without claiming whole-artifact reproducibility from one encoding fix;
• literal-source evidence, scanner completeness, non-vacuous coverage, licensing/provenance, and independent approval remain separate gates.

Primary references — APA 7

Apache Maven Project. (2026). Specifying a character encoding scheme. Apache Maven Resources Plugin. https://maven.apache.org/plugins/maven-resources-plugin/examples/encoding.html

Apache Maven Project. (2026). resources:resources. Apache Maven Resources Plugin. https://maven.apache.org/plugins/maven-resources-plugin/resources-mojo.html

Apache Maven Project. (2026). Configuring for reproducible builds. https://maven.apache.org/guides/mini/guide-reproducible-builds.html

Relationships: #165 release/reproducibility; #160 active shared root-POM security owner; #159 canonical documentation.