Reproducible builds on Java
Bernhard M. Wiedemann
bernhardout at lsmod.de
Mon Sep 6 10:20:39 UTC 2021
On 06/09/2021 11.17, Magnus Ihse Bursie wrote:
> I'm working for Oracle in the Build Group for OpenJDK , which is
> primary responsible for creating a built artifact of the OpenJDK source
> code. I also have a general interest in all things about building in
> general, so I've been lurking on this list for a while. :-)
I highly appreciate your efforts to move Java/OpenJDK in the right
> I have recently looked through the tests.reproducible-builds.org site
> for Java-specific problems listed. Most of them seem to be
> project-specific, or due to tools outside of the JDK. But one about
> javadoc caught my eye . I talked to one of the javadoc engineers, and
> he think that any nondeterminism is due to old versions (prior to JDK
> 9), which should have been fixed since long. I don't understand how to
> get any further from this page to get more details on the problem. If
> someone could help me by pointing to specific bug reports on javadoc
> generating nondeterministic output, that'd be very helpful.
I checked my javadoc-related bugreports and there are 2 atm
https://issues.apache.org/jira/browse/MJAVADOC-619 marked as fixed in
https://bugzilla.opensuse.org/show_bug.cgi?id=1174795 still open about
readdir-order-related non-determinism 
was built with java-11-openjdk-18.104.22.168
and has at least 2 different issues, but some of them are filtered out
by our build-compare tool.
The visible diff there might be the same cause as
One invisible diff is
-<!-- Generated by javadoc (11.0.11) on Thu Jul 08 23:20:27 GMT 2021 -->
+<!-- Generated by javadoc (11.0.11) on Sun Aug 10 12:37:15 GMT 2036 -->
<title>Uses of Class org.fusesource.jansi.Ansi.Attribute (jansi API
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-<meta name="dc.created" content="2021-07-08">
+<meta name="dc.created" content="2036-08-10">
I guess, there are already ways to override the date, but it does not
(yet) use SOURCE_DATE_EPOCH for that and we cannot manage to patch 200
java packages to use the right overrides.
Experience has shown that doing individual patches is an infinite effort
because any number of software can still be written.
I also tried to build jansi with openJDK-17 (and 13+15), but that failed
[javac] error: Source option 6 is no longer supported. Use 7 or later.
other javadoc-affected packages:
So I guess, we should find one among those that can be built with
openJDK-17 and check how it behaves then.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 236 bytes
Desc: OpenPGP digital signature
More information about the rb-general