<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
Hi Erik,</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you for the suggestions. Yes, I agree make -t is not a great solution, and also confirm it’s odd even though the signed dylib’s timestamps are later, they get re-built.. which is probably a bug in itself. We do have a post build “Sign Verification” job
as you mention, which picks up these issues, which as you suggest is very useful and necessary.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
JDK-8350801 I am aware of, I discussed this with Frederic at the time as being useful. However, at the moment the difficulty is calling out from a GNU make file at one of these “exit” points to be able to call a Jenkins Job to do the signing. Unfortunately,
as it stands we have to use an Eclipse Signing Jenkins job running on a secure remote node, so we have to call out to this specific Jenkins job, which is very difficult to do from a GNU make file. There is potential for us to raise an Eclipse feature request
for an alternative API for us, which could be used in this environment.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I am going to do some more investigation into why the dylib’s get rebuilt after signing, as if we could remove the “make -t” hack then that would be ideal. I am guessing maybe there are some “rules” that need a tweak or two.</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Many thanks,</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andrew</div>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div id="ms-outlook-mobile-signature">
<p dir="ltr" style="margin: 0in 0in 0.0001pt; font-family: Aptos, sans-serif; font-size: 12pt;">
Sent from Outlook for Mac </p>
</div>
<div id="mail-editor-reference-message-container">
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing"></div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>Erik Joelsson <erik.joelsson@oracle.com><br>
<b>Date: </b>Friday, 1 August 2025 at 19:25<br>
<b>To: </b>Andrew Leonard <andrew.m.leonard@ibm.com>, build-dev@openjdk.org <build-dev@openjdk.org><br>
<b>Subject: </b>[EXTERNAL] Re: JDK-8363942: Unable to make images after "make -t"<br>
<br>
</div>
<div dir="ltr" lang="en" id="pfptBanner8cvoxw6" style="visibility: visible !important; opacity: 1 !important; max-width: none !important; max-height: none !important; display: block !important; text-align: left !important; margin: 16px 0px !important; padding: 8px 16px !important; border-radius: 4px !important; min-width: 200px !important; background-color: rgb(208, 216, 220); border-top-width: 4px !important; border-top-style: solid !important; border-top-color: rgb(144, 164, 174) !important;">
<div id="pfptBanner8cvoxw6" style="visibility: visible !important; opacity: 1 !important; background-color: rgb(208, 216, 220); max-height: none !important; float: left !important; display: block !important; margin: 0px 0px 1px !important; max-width: 600px !important;">
<div id="pfptBanner8cvoxw6" style="opacity: 1 !important; max-width: none !important; max-height: none !important; display: block !important; visibility: visible !important; background-color: rgb(208, 216, 220); color: rgb(0, 0, 0); font-family: Arial, sans-serif !important; font-weight: bold !important; font-size: 14px !important; line-height: 18px !important;">
This Message Is From an External Sender</div>
<div id="pfptBanner8cvoxw6" style="font-weight: normal; opacity: 1 !important; max-width: none !important; max-height: none !important; display: block !important; visibility: visible !important; background-color: rgb(208, 216, 220); color: rgb(0, 0, 0); font-family: Arial, sans-serif !important; font-size: 12px !important; line-height: 18px !important; margin-top: 2px !important;">
This message came from outside your organization.</div>
</div>
<div id="pfptBanner8cvoxw6" style="visibility: visible !important; opacity: 1 !important; background-color: rgb(208, 216, 220); max-width: none !important; max-height: none !important; float: right !important; display: block !important; margin: 0px 0px 0px 16px !important; text-align: right !important; width: fit-content !important;">
<div class="pfptPrimaryButton8cvoxw6" style="white-space: nowrap; margin: 3px 0px 3px 16px; padding: 7.5px 16px; border-width: 1px; border-style: solid; border-color: rgb(102, 102, 102); border-radius: 2px; width: fit-content; display: inline-block; font-family: Arial, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<span style="background-color: rgb(208, 216, 220);"><a href="https://us-phishalarm-ewt.proofpoint.com/EWT/v1/AdhS1Rd-!99FRstz4eM87H9bZrkThkmJt0DkNhWht5MerKiEHaAwuctiV9aTiMgyU5E2Ls-V383lAHpH2hSPmTTkKwZJSQdvR4C1ktVx9W95NGg$" id="pfptBanner8cvoxw6" data-outlook-id="8bbed6ab-2907-4b7a-b294-fc6f51824ba3" style="text-decoration: none; display: inline-block; background-color: rgb(208, 216, 220); max-width: none; max-height: none;">Report Suspicious</a></span></div>
</div>
<div style="line-height: 0; height: 0px; display: block; font-size: 0.01px;"> </div>
</div>
<div class="moz-cite-prefix">On 7/29/25 08:16, Andrew Leonard wrote:</div>
<blockquote>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,</div>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I’m looking for help on resolving this bug please (<a href="https://bugs.openjdk.org/browse/JDK-8363942" class="moz-txt-link-freetext" data-outlook-id="30e3289e-b6b4-4c1b-b62f-4dceb6ac4208">https://bugs.openjdk.org/browse/JDK-8363942</a>),
that we see building Eclipse Temurin, whereby we build the “exploded image(default)” target, then externally “sign” the binaries, then “touch” the targets using “make -t” so they don’t get re-built, then build the “images”…</div>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
However, after recent jdk-25 changes in idk-25+26 (I think by 8349665), this process fails.</div>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We’ve found a workaround by manually deleting the file “create-main-targets-include” before calling make images, but that doesn’t seem ideal.</div>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</blockquote>
<p class="ms-outlook-mobile-reference-message skipProofing">I've never used `make -t` so I'm not surprised it doesn't work well with the OpenJDK build. We use a lot of meta targets and tricks throughout the build, and I would expect things to behave unexpectedly
when using it. I'm curious why you think you need to run `make -t` after the signing procedure? As long as none of the signing operations are resetting the modification times on the signed binaries to an earlier timestamp than the build produced, and you didn't
touch any other files or source files, then rebuilding shouldn't overwrite any of the already built or signed binaries. There can of course be bugs, and historically I'm sure there have been, causing things to be rebuilt unnecessarily, so with an approach
like this I would definitely recommend adding a verification step after the build that checks all binaries for signatures.</p>
<p class="ms-outlook-mobile-reference-message skipProofing">Related to this, have you looked into
<a href="https://bugs.openjdk.org/browse/JDK-8350801" class="moz-txt-link-freetext" data-outlook-id="28a96352-dc97-47ad-b235-48dd47dd7b29" style="margin-top: 0px; margin-bottom: 0px;">
https://bugs.openjdk.org/browse/JDK-8350801</a>? It was meant to make external signing procedures easier to integrate with the build system.</p>
<p class="ms-outlook-mobile-reference-message skipProofing">/Erik</p>
<blockquote>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Many thanks</div>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andrew</div>
<div class="ms-outlook-mobile-reference-message skipProofing">Unless otherwise stated above:<br>
<br>
IBM United Kingdom Limited<br>
Registered in England and Wales with number 741598<br>
Registered office: Building C, IBM Hursley Office, Hursley Park Road, Winchester, Hampshire SO21 2JN</div>
</blockquote>
</div>
<DIV>
Unless otherwise stated above:<BR>
<BR>
IBM United Kingdom Limited<BR>
Registered in England and Wales with number 741598<BR>
Registered office: Building C, IBM Hursley Office, Hursley Park Road, Winchester, Hampshire SO21 2JN<BR>
</DIV></body>
</html>