Reproducible Arch Linux in 2024/Q1 (irregular status update)

[Jelle van der Waa]

Hi!

On 13/03/2024 16:48, John Neffenger wrote:
> On 3/12/24 4:04 PM, kpcyrd wrote:
>> 3) Timestamps embedded in .jar files (unreproducible zip files are a 
>> big thing for some reason).
> 
> Many of you may already know this, but just in case ... there is now 
> support in Apache Maven, Gradle, and the JDK itself to normalize the 
> timestamps in JAR files
> MAVEN
> ==========

That is new to me!

> GRADLE

Some of our package maintainers in Arch have submitted patches for 
OpenSearch to fix this. For plantuml I would have to add a new 
tasks.withType() for every build.gradle.kts file in the repository I assume?

https://github.com/plantuml/plantuml/blob/master/plantuml-bsd/build.gradle.kts

> JDK
> ==========
> Builds of OpenJDK version 18 or later support the following new option 
> in the 'jar' and 'jmod' commands:
> 
>    --date=TIMESTAMP
>        The timestamp in ISO-8601 extended offset date-time with optional
>        time-zone format, to use for the timestamp of the entries,
>        e.g. "2022-02-12T12:30:00-05:00".

This is new to me and great to see! How would that work for for example 
java-atk-wrapper:

https://reproducible.archlinux.org/api/v0/builds/584412/diffoscope

I couldn't find a jar invocation call here:
https://gitlab.gnome.org/GNOME/java-atk-wrapper/-/blob/master/configure.ac?ref_type=heads

Went digging some more:

libbluray - uses ant
libjpeg-turbo - uses a CMAKE helper, so I assume that needs to be patched?

https://cmake.org/cmake/help/latest/module/UseJava.html#command:add_jar

After a while I realized you said openjdk 18 which isn't packaged in the 
Arch repositories yet :) So I'll continue this quest later :) But at 
least everything gradle could be patched upstream to become 
reproducible. (it's only 14 packages which use gradle for building)

Would it make sense to add these excellent examples to the reproducible 
builds website. There already is a JVM section:

https://reproducible-builds.org/docs/jvm/