Reproducible builds on Java

Mon Sep 6 10:20:39 UTC 2021

On 06/09/2021 11.17, Magnus Ihse Bursie wrote:
> I'm working for Oracle in the Build Group for OpenJDK [1], which is
> primary responsible for creating a built artifact of the OpenJDK source
> code. I also have a general interest in all things about building in
> general, so I've been lurking on this list for a while. :-)

I highly appreciate your efforts to move Java/OpenJDK in the right
direction.

> I have recently looked through the tests.reproducible-builds.org site
> for Java-specific problems listed. Most of them seem to be
> project-specific, or due to tools outside of the JDK. But one about
> javadoc caught my eye [5]. I talked to one of the javadoc engineers, and
> he think that any nondeterminism is due to old versions (prior to JDK
> 9), which should have been fixed since long. I don't understand how to
> get any further from this page to get more details on the problem. If
> someone could help me by pointing to specific bug reports on javadoc
> generating nondeterministic output, that'd be very helpful.

I checked my javadoc-related bugreports and there are 2 atm
https://issues.apache.org/jira/browse/MJAVADOC-619 marked as fixed in
2021-05

https://bugzilla.opensuse.org/show_bug.cgi?id=1174795 still open about
readdir-order-related non-determinism [1]

https://rb.zq1.de/compare.factory-20210830/diffs/jansi-compare.out
was built with java-11-openjdk-11.0.11.0
and has at least 2 different issues, but some of them are filtered out
by our build-compare tool.

The visible diff there might be the same cause as
https://bugzilla.opensuse.org/show_bug.cgi?id=1174795

One invisible diff is

/usr/share/javadoc/jansi/org/fusesource/jansi/class-use/Ansi.Attribute.html
-<!-- Generated by javadoc (11.0.11) on Thu Jul 08 23:20:27 GMT 2021 -->
+<!-- Generated by javadoc (11.0.11) on Sun Aug 10 12:37:15 GMT 2036 -->
 <title>Uses of Class org.fusesource.jansi.Ansi.Attribute (jansi API
Reference (1.17.1))</title>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-<meta name="dc.created" content="2021-07-08">
+<meta name="dc.created" content="2036-08-10">

I guess, there are already ways to override the date, but it does not
(yet) use SOURCE_DATE_EPOCH for that and we cannot manage to patch 200
java packages to use the right overrides.
Experience has shown that doing individual patches is an infinite effort
because any number of software can still be written.

I also tried to build jansi with openJDK-17 (and 13+15), but that failed
with
[javac] error: Source option 6 is no longer supported. Use 7 or later.

other javadoc-affected packages:
apache-commons-compress
maven-common-artifact-filters
jansi
jchardet
jdeparser
jnr-a64asm
jnr-process
mysql-connector-java
jnr-unixsocket
docker-client-java

So I guess, we should find one among those that can be built with
openJDK-17 and check how it behaves then.

Ciao
Bernhard M.

[1]
https://github.com/bmwiedemann/theunreproduciblepackage/tree/master/readdir

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20210906/1d979d66/attachment.sig>