How would you configure a Maven or Gradle build to produce a reproducible build (bit-for-bit identical output given the same source), and why does this matter for supply chain security?

Reproducible builds require eliminating all non-deterministic elements from the build process: fixing file timestamps in the packaged JAR (Maven's <project.build.outputTimestamp> property, tied to a specific commit's timestamp rather than build-time), ensuring consistent file ordering within the archive, pinning exact dependency versions (avoiding version ranges), and using a consistent JDK version -- reproducibility matters for supply chain security because it lets independent third parties verify that a published artifact genuinely corresponds to its claimed source code, detecting any tampering or compromised build infrastructure that might otherwise inject malicious code undetected.

<!-- pom.xml -- enabling reproducible builds -->
<properties>
    <project.build.outputTimestamp>2024-01-15T10:00:00Z</project.build.outputTimestamp>
</properties>

# Verify reproducibility by building twice and comparing checksums
mvn clean package
sha256sum target/myapp.jar > build1.sha256
mvn clean package
sha256sum target/myapp.jar > build2.sha256
diff build1.sha256 build2.sha256  # should be identical