Reproducible builds on Java

[Hervé Boutemy]

OpenJDK issue https://bugs.openjdk.java.net/browse/JDK-8258117

Le lundi 6 septembre 2021, 13:20:44 CEST Hervé Boutemy a écrit :
> Hi,
> 
> It's nice to have such decision and working together on it.
> 
> As you have probably seen from Reproducible Central [1], reproducibility is
> working quite well.
> 
> I personally put a low priority on javadoc, because:
> 1. it's less critical IMHO
> 2. the dependency on external package-list make the process quite fragile in
> real world builds: external sites may disappear, which will make
> reproducing javadoc harder over time
> 
> 
> My first priority is on bytecode: as I said, it works quite well.
> There is one key issue currently: when doing a multi-release jar that
> contains module-info.class, we can't enforce stable timestamp [2].
> I don't know if Robert opened some issue on this.
> 
> Regards,
> 
> Hervé
> 
> 
> [1] https://github.com/jvm-repo-rebuild/reproducible-central
> 
> [2] https://github.com/codehaus-plexus/plexus-languages/issues/59
> 
> Le lundi 6 septembre 2021, 11:17:46 CEST Magnus Ihse Bursie a écrit :
> > Hi,
> > 
> > I'm working for Oracle in the Build Group for OpenJDK [1], which is
> > primary responsible for creating a built artifact of the OpenJDK source
> > code. I also have a general interest in all things about building in
> > general, so I've been lurking on this list for a while. :-)
> > 
> > For the last few years, we have worked on a low-effort, background-style
> > project to make the build of OpenJDK itself building reproducible. We've
> > come far, but there are still issues I'd like to address. (If you have
> > any feedback on building OpenJDK itself reproducible, you're welcome to
> > contact me directly, or on the build-dev at openjdk.java.net mailing list
> > [2]).
> > 
> > But a larger issue than OpenJDK itself is to make sure that the tools
> > from the JDK are creating reproducible builds for all Java projects out
> > there. In general, we're doing good (any noticed nondeterminism in javac
> > is considered a bug and is fixed promptly), but there are other output
> > apart from class files where we've been less good.
> > 
> > There is a current effort to fix the timestamps in .properties files.
> > See the PR here [3], or the preceding discussion on the mailing list
> > [4]. If anyone from the reproducible builds community has something to
> > add to the discussion, now is the time to make your voice heard.
> > 
> > I have recently looked through the tests.reproducible-builds.org site
> > for Java-specific problems listed. Most of them seem to be
> > project-specific, or due to tools outside of the JDK. But one about
> > javadoc caught my eye [5]. I talked to one of the javadoc engineers, and
> > he think that any nondeterminism is due to old versions (prior to JDK
> > 9), which should have been fixed since long. I don't understand how to
> > get any further from this page to get more details on the problem. If
> > someone could help me by pointing to specific bug reports on javadoc
> > generating nondeterministic output, that'd be very helpful.
> > 
> > /Magnus
> > 
> > [1] https://openjdk.java.net/groups/build/
> > [2] https://mail.openjdk.java.net/mailman/listinfo/build-dev
> > [3] https://github.com/openjdk/jdk/pull/5372
> > [4]
> > https://mail.openjdk.java.net/pipermail/core-libs-dev/2021-August/080758.h
> > tm l [5]
> > https://tests.reproducible-builds.org/debian/issues/unstable/random_order_
> > in _documentation_generated_by_javadoc_issue.html