RFR: 8327389: Remove use of HOTSPOT_BUILD_USER

[Magnus Ihse Bursie]

On Wed, 6 Mar 2024 11:57:27 GMT, Andrew John Hughes <andrew at openjdk.org> wrote:

> The HotSpot code has inserted the value of `HOTSPOT_BUILD_USER` into the internal version string since before the JDK was open-sourced, so the reasoning for this is not in the public history. See https://github.com/openjdk/jdk/blob/master/src/hotspot/share/runtime/abstract_vm_version.cpp#L284
> 
> ~~~
> $ /usr/lib/jvm/java-21-openjdk/bin/java -Xinternalversion
> OpenJDK 64-Bit Server VM (21.0.2+13) for linux-amd64 JRE (21.0.2+13), built on 2024-01-19T16:39:52Z by "mockbuild" with gcc 8.5.0 20210514 (Red Hat 8.5.0-20)
> ~~~
> 
> It is not clear what value this provides. By default, the value is set to the system username, but it can be set to a static value using `--with-build-user`.
> 
> In trying to compare builds, this is a source of difference if the builds are produced under different usernames and `--with-build-user` is not set to the same value.
> 
> It may also be a source of information leakage from the host system. It is not clear what value it provides to the end user of the build.
> 
> This patch proposes removing it altogether, but at least knowing why it needs to be there would be progress from where we are now. We could also consider a middle ground of only setting it for "adhoc" builds, those without set version information, as is the case with the overall version output. 
> 
> With this patch:
> 
> ~~~
> $ ~/builder/23/images/jdk/bin/java -Xinternalversion
> OpenJDK 64-Bit Server VM (fastdebug 23-internal-adhoc.andrew.jdk) for linux-amd64 JRE (23-internal-adhoc.andrew.jdk), built on 2024-03-06T00:23:37Z with gcc 13.2.1 20230826
> 
> $ ~/builder/23/images/jdk/bin/java -XX:ErrorHandlerTest=1
> <vm crashes>
> $ grep '^vm_info' /localhome/andrew/projects/openjdk/upstream/jdk/hs_err_pid1119824.log
> vm_info: OpenJDK 64-Bit Server VM (fastdebug 23-internal-adhoc.andrew.jdk) for linux-amd64 JRE (23-internal-adhoc.andrew.jdk), built on 2024-03-06T00:23:37Z with gcc 13.2.1 20230826
> ~~~
> 
> The above are from a fastdebug build but I also built a product build with no issues.

Also, it might be worth repeating one of my long-standing wishes: that the version string should not be hard-coded into the build, but e.g. stored as a string in the `release` file, and read from there. If we did that, the cost of changing the version string would be negligible, and we wouldn't need to worry as much about it. It would also be simple to compare different builds which end up with the same bits since they are built from the same sources, but by different version flags (e.g. -ea vs GA). (In fact, we'd turn a -ea build into a GA just by updating the version string, so we'd know for sure we are publishing what we tested.)

-------------

PR Comment: https://git.openjdk.org/jdk/pull/18136#issuecomment-1984028842