Configured reproducible builds

[gioelemella]

List of Changes

• Added MD5 checksum generation on eng-lollipop-consumer-sdk jar build
• Defined fixed java source and target compatibility to version 11
• Added reproducible build settings in all subprojects build.gradle files
• Configured artifact sharing between subprojects in order to allow reproducible builds. Project configured by using the following documentation https://docs.gradle.org/current/userguide/working_with_files.html#sec:reproducible_archives, https://docs.gradle.org/7.3/userguide/cross_project_publications.html#sec:variant-aware-sharing
• Introduced plugin to produce .buildinfo (https://kordamp.org/kordamp-gradle-plugins/#_org_kordamp_gradle_reproducible)
• Executed and pushed initial version of verification-metadata.xml calling gradle --write-verification-metadata sha256 help

Motivation and Context

Initial project configuration in order to allow reproducible builds.

How Has This Been Tested?

Project builded with success and compared the generated checksum of subsequent builds

Executed verification-metadata file production, changed lombok dependency from 8.0.0 to 8.0.1 and executed gradle build command. Result:

• What went wrong:
  A problem occurred configuring project ':http-verifier'.

Dependency verification failed for configuration ':http-verifier:classpath'
3 artifacts failed verification:
- io.freefair.lombok.gradle.plugin-8.0.1.pom (io.freefair.lombok:io.freefair.lombok.gradle.plugin:8.0.1) from repository MavenRepo
- lombok-plugin-8.0.1.jar (io.freefair.gradle:lombok-plugin:8.0.1) from repository MavenRepo
- lombok-plugin-8.0.1.module (io.freefair.gradle:lombok-plugin:8.0.1) from repository MavenRepo

---

Executed verification-metadata file production, tampered commons-codec-1.15.jar checksum on build test

• What went wrong:
  A problem occurred configuring root project 'eng-lollipop-consumer-java-sdk'.

Dependency verification failed for configuration ':classpath'
One artifact failed verification: commons-codec-1.15.jar (commons-codec:commons-codec:1.15) from repository MavenRepo
This can indicate that a dependency has been compromised. Please carefully verify the checksums.

Screenshots (if appropriate):

---

• What went wrong:
  A problem occurred configuring root project 'eng-lollipop-consumer-java-sdk'.

Dependency verification failed for configuration ':classpath'
One artifact failed verification: commons-codec-1.15.jar (commons-codec:commons-codec:1.15) from repository MavenRepo
This can indicate that a dependency has been compromised. Please carefully verify the checksums.

Types of changes

• Chore (nothing changes by a user perspective)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.

[pp-ps]

Lgtm for now, needs more testing but it can be deferred, as it is non-blocking.