Reproducible builds on Java

Bernhard M. Wiedemann bernhardout at
Mon Sep 6 10:20:39 UTC 2021

On 06/09/2021 11.17, Magnus Ihse Bursie wrote:
> I'm working for Oracle in the Build Group for OpenJDK [1], which is
> primary responsible for creating a built artifact of the OpenJDK source
> code. I also have a general interest in all things about building in
> general, so I've been lurking on this list for a while. :-)

I highly appreciate your efforts to move Java/OpenJDK in the right

> I have recently looked through the site
> for Java-specific problems listed. Most of them seem to be
> project-specific, or due to tools outside of the JDK. But one about
> javadoc caught my eye [5]. I talked to one of the javadoc engineers, and
> he think that any nondeterminism is due to old versions (prior to JDK
> 9), which should have been fixed since long. I don't understand how to
> get any further from this page to get more details on the problem. If
> someone could help me by pointing to specific bug reports on javadoc
> generating nondeterministic output, that'd be very helpful.

I checked my javadoc-related bugreports and there are 2 atm marked as fixed in
2021-05 still open about
readdir-order-related non-determinism [1]
was built with java-11-openjdk-
and has at least 2 different issues, but some of them are filtered out
by our build-compare tool.

The visible diff there might be the same cause as

One invisible diff is

-<!-- Generated by javadoc (11.0.11) on Thu Jul 08 23:20:27 GMT 2021 -->
+<!-- Generated by javadoc (11.0.11) on Sun Aug 10 12:37:15 GMT 2036 -->
 <title>Uses of Class org.fusesource.jansi.Ansi.Attribute (jansi API
Reference (1.17.1))</title>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-<meta name="dc.created" content="2021-07-08">
+<meta name="dc.created" content="2036-08-10">

I guess, there are already ways to override the date, but it does not
(yet) use SOURCE_DATE_EPOCH for that and we cannot manage to patch 200
java packages to use the right overrides.
Experience has shown that doing individual patches is an infinite effort
because any number of software can still be written.

I also tried to build jansi with openJDK-17 (and 13+15), but that failed
[javac] error: Source option 6 is no longer supported. Use 7 or later.

other javadoc-affected packages:

So I guess, we should find one among those that can be built with
openJDK-17 and check how it behaves then.

Bernhard M.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <>

More information about the rb-general mailing list