Reproducible builds on Java

[Hervé Boutemy]

Hi,

It's nice to have such decision and working together on it.

As you have probably seen from Reproducible Central [1], reproducibility is 
working quite well.

I personally put a low priority on javadoc, because:
1. it's less critical IMHO
2. the dependency on external package-list make the process quite fragile in 
real world builds: external sites may disappear, which will make reproducing 
javadoc harder over time


My first priority is on bytecode: as I said, it works quite well.
There is one key issue currently: when doing a multi-release jar that contains 
module-info.class, we can't enforce stable timestamp [2].
I don't know if Robert opened some issue on this.

Regards,

Hervé


[1] https://github.com/jvm-repo-rebuild/reproducible-central

[2] https://github.com/codehaus-plexus/plexus-languages/issues/59

Le lundi 6 septembre 2021, 11:17:46 CEST Magnus Ihse Bursie a écrit :
> Hi,
> 
> I'm working for Oracle in the Build Group for OpenJDK [1], which is
> primary responsible for creating a built artifact of the OpenJDK source
> code. I also have a general interest in all things about building in
> general, so I've been lurking on this list for a while. :-)
> 
> For the last few years, we have worked on a low-effort, background-style
> project to make the build of OpenJDK itself building reproducible. We've
> come far, but there are still issues I'd like to address. (If you have
> any feedback on building OpenJDK itself reproducible, you're welcome to
> contact me directly, or on the build-dev at openjdk.java.net mailing list [2]).
> 
> But a larger issue than OpenJDK itself is to make sure that the tools
> from the JDK are creating reproducible builds for all Java projects out
> there. In general, we're doing good (any noticed nondeterminism in javac
> is considered a bug and is fixed promptly), but there are other output
> apart from class files where we've been less good.
> 
> There is a current effort to fix the timestamps in .properties files.
> See the PR here [3], or the preceding discussion on the mailing list
> [4]. If anyone from the reproducible builds community has something to
> add to the discussion, now is the time to make your voice heard.
> 
> I have recently looked through the tests.reproducible-builds.org site
> for Java-specific problems listed. Most of them seem to be
> project-specific, or due to tools outside of the JDK. But one about
> javadoc caught my eye [5]. I talked to one of the javadoc engineers, and
> he think that any nondeterminism is due to old versions (prior to JDK
> 9), which should have been fixed since long. I don't understand how to
> get any further from this page to get more details on the problem. If
> someone could help me by pointing to specific bug reports on javadoc
> generating nondeterministic output, that'd be very helpful.
> 
> /Magnus
> 
> [1] https://openjdk.java.net/groups/build/
> [2] https://mail.openjdk.java.net/mailman/listinfo/build-dev
> [3] https://github.com/openjdk/jdk/pull/5372
> [4]
> https://mail.openjdk.java.net/pipermail/core-libs-dev/2021-August/080758.htm
> l [5]
> https://tests.reproducible-builds.org/debian/issues/unstable/random_order_in
> _documentation_generated_by_javadoc_issue.html