Reproducibility for Java -> technical details

[John Gilmore]

Roland Clobus <rclobus at rclobus.nl> wrote:
> My proposed change would be:
> * At startup of Java, check if SOURCE_DATE_EPOCH is set. If so, create
> a Clock.fixed with the timestamp from SOURCE_DATE_EPOCH
> * In java.util.Date replace System.currentTimeMillis() with
> Clock.getInstance().currentTimeMillis() (as suggested at [4] and other
> sources)

The clock functions in Java shouldn't stop working because somebody set
a common environment variable.  This is hitting a fly with a
sledgehammer.

> It should be noted that regular user _will not_ and _should not_ set
> SOURCE_DATE_EPOCH [6]. That environment variable it typically used for
> rebuilds.

Certainly many programmers will set the variable, particularly during
development or debugging sessions.  And they will and should expect the
ordinary programs that they run in that shell to keep working -- whether
they are written in Java or not.

A much less intrusive fix would be to provide a date option on
ca-certificates-java that would override the current date with
a date specified on the command line.

	John