Reproducible builds on Java

[John Neffenger]

On 9/6/21 2:17 AM, Magnus Ihse Bursie wrote:
> But a larger issue than OpenJDK itself is to make sure that the tools 
> from the JDK are creating reproducible builds for all Java projects out 
> there.

> If anyone from the reproducible builds community has something to add to the discussion, now is the time to make your voice heard. 

The only remaining issue in the JDK tools preventing reproducible builds 
of JavaFX are the non-deterministic JMOD archives. See here for details:

8264449: Enable reproducible builds with SOURCE_DATE_EPOCH
https://github.com/openjdk/jfx/pull/446

For now, the JMOD archives are normalized with 'strip-nondeterminism' as 
follows:

$ strip-nondeterminism -v -T $SOURCE_DATE_EPOCH build/jmods/*.jmod

When the creation of the JMOD files are deterministic, we won't need 
this extra step. Furthermore, the build environment I use doesn't have 
the most recent version of 'strip-nondeterminism' with the JMOD support, 
so getting the change into the 'jmod' tool would help a lot.

Note that JavaFX uses Gradle to build the other JAR and ZIP archives, so 
we bypass any non-determinism that might still be present in the 'jar' 
tool. Gradle cannot yet build the JMOD archives, though, so we depend on 
the 'jmod' tool directly. See:

Reproducible builds
https://docs.gradle.org/current/userguide/working_with_files.html#sec:reproducible_archives

Thanks,
John