Reproducible build backports to jdk17u-dev ?

[Andrew Leonard]

Thanks Severin,
Good idea, here's the list I would propose backporting:
8276743: Make openjdk build Zip Archive generation "reproducible"
<https://github.com/openjdk/jdk/pull/6311> :
https://github.com/openjdk/jdk/pull/6311
8276764: Enable deterministic file content ordering for Jar and Jmod
<https://github.com/openjdk/jdk/pull/6395> :
https://github.com/openjdk/jdk/pull/6395
8276766: Enable jar and jmod to produce deterministic timestamped content
<https://github.com/openjdk/jdk/pull/6481> :
https://github.com/openjdk/jdk/pull/6481
8277762: Allow configuration of HOTSPOT_BUILD_USER
<https://github.com/openjdk/jdk/pull/6542> :
https://github.com/openjdk/jdk/pull/6542
8278080: Add --with-cacerts-src='user cacerts folder' to enable
deterministic cacerts generation <https://github.com/openjdk/jdk/pull/6647>
: https://github.com/openjdk/jdk/pull/6647
8278163: --with-cacerts-src variable resolved after GenerateCacerts recipe
setup <https://github.com/openjdk/jdk/pull/6680> :
https://github.com/openjdk/jdk/pull/6680
8278766: Enable OpenJDK build support for reproducible jars and jmods using
--date <https://github.com/openjdk/jdk/pull/6878> :
https://github.com/openjdk/jdk/pull/6878
8279182: MakeZipReproducible ZipEntry timestamps not localized to UTC
<https://github.com/openjdk/jdk/pull/6926> :
https://github.com/openjdk/jdk/pull/6926

So this essentially comes down to whether we see jdk-17.0.. being
"reproducible" given it's an LTS it would seem sensible?

Thanks
Andrew




On Tue, Jan 11, 2022 at 11:25 AM Severin Gehwolf <sgehwolf at redhat.com>
wrote:

> Hi Andrew,
>
> On Tue, 2022-01-11 at 10:50 +0000, Andrew Leonard wrote:
> > Hi,
> >
> > I'm looking to backport some recent reproducible build fixes & features
> to
> > jdk-17.0.3+, for example the new jar & jmod --date option:
> >
> >
> https://github.com/openjdk/jdk/commit/214f98f6b07e312e6f4ded5364a94277114784e7
> > Before I get too far down this road, does anyone see any blockers to
> > approval for such backports? The guidance (
> > https://wiki.openjdk.java.net/display/JDKUpdates/JDK+17u) mentions
> > "reproducibility" as an accepted approval. The above PR for example
> > involves a CSR for the new --date option.
>
> It will depend on the invasiveness of individual changes. A list of
> candidate bugs would be good to have. Some might be fine, some not so
> much.
>
> I see that JDK-8276766 required a CSR so a backport will need a CSR
> targetting JDK 17 too.
>
> So the short answer: It depends ;-)
>
> Thanks,
> Severin
>
>