RFR: 8276400: openjdk image Jars, Zips and Jmods built from the same source are not reproducible

[Lance Andersen]

On Thu, 4 Nov 2021 20:56:45 GMT, Andrew Leonard <aleonard at openjdk.org> wrote:

> This PR enables reproducible Jars, Jmods and openjdk image zip files (eg.src.zip).
> It provides support for SOURCE_DATE_EPOCH for Jar, Jmod and underlying ZipOutputStream's.
> It fixes the following keys issues relating to reproducibility:
> - Jar and ZipOutputStream are not SOURCE_DATE_EPOCH aware
>   - Jar and ZipOutputStream now detect SOURCE_DATE_EPOCH environment setting
> - Jar and Jmod file content ordering was non-determinsitic
>   - Fixes to Jar and Jmod main's to ensure sorted classes content ordering
> - openjdk image zip file generation used "zip" which is non-determinsitic
>   - New openjdk build tool "GenerateZip" which produces the final determinsitic zip files as part of the build and also detects SOURCE_DATE_EPOCH
> 
> Signed-off-by: Andrew Leonard <anleonar at redhat.com>

Thank you for your contribution Andrew.

Thank you for your efforts here Andrew.

A few comments in addition to what have already been mentioned by others on a very quick scan.

For new tests, please consider using TestNG.

src/jdk.jartool/share/classes/sun/tools/jar/Main.java line 795:

> 793:         // Ensure files list is sorted for reproducible jar content
> 794:         Arrays.sort(files);
> 795: 

Have you had a chance to measure the performance with a large number of Zip entries with this change?

test/jdk/java/util/zip/TestZipSourceDateEpoch.sh line 1:

> 1: #!/bin/sh

Unless there is a specific reason to use a shell script, it would be better to convert this to java.  We have been trying to reduce the usage of shell scripts

-------------

PR: https://git.openjdk.java.net/jdk/pull/6268