JLink image libraries are not consistently reproducible

[Alan Bateman]

On 05/08/2022 11:18, Craig Raw wrote:
> I am having an issue concerning the reproducibility of the JVM 
> libraries produced by JLink. When running the same build script across 
> different machines with the same JDK, sometimes the binaries and libs 
> in the lib/runtime/bin and lib/runtime/lib folders are different. If 
> one of the *.so files is different, they all are. However, the 
> lib/runtime/lib/modules file produced by JLink is consistently 
> identical. The machines running the builds are all Linux running 
> flavours of Ubuntu.
>
> On examining the issue more closely, I notice that sometimes the files 
> are identical to the ones in the JDK installation, and sometimes they 
> are not. They are not significantly different, for example:
> JDK:
> -rw-rw-r-- 1 xxx xxx  16560 Aug  4 18:08 libjsig.so
>
> JLink:
> -rw-rw-r-- 1 xxx xxx  17136 Aug  4 19:23 libjsig.so
>
> Further, I've tried running the java binaries in each, and they differ 
> in that one is 'sharing' and the other not:
>
> xxx at yyy:~$ ~/.sdkman/candidates/java/18.0.1-tem/bin/java --version
> openjdk 18.0.1 2022-04-19
> OpenJDK Runtime Environment Temurin-18.0.1+10 (build 18.0.1+10)
> OpenJDK 64-Bit Server VM Temurin-18.0.1+10 (build 18.0.1+10, mixed 
> mode, sharing)
>
> xxx at yyy:~$ ~/project/build/image/bin/java --version
> openjdk 18.0.1 2022-04-19
> OpenJDK Runtime Environment Temurin-18.0.1+10 (build 18.0.1+10)
> OpenJDK 64-Bit Server VM Temurin-18.0.1+10 (build 18.0.1+10, mixed mode)
>
> What would cause JLink to modify the JVM itself? Is there a way I can 
> achieve a consistently reproducible JVM image?
>

I assume the jlink command used to generate project/build/image doesn't 
specify --generate-cds-archive so that will explain why you don't see 
"sharing" in the java -version output. You can use 
project/build/image/bin/java -Xshare:dump to do the generate it too.

For the .so file it is possible that your jlink command specifies 
-strip-debug or --strip-native-debug-symbols? That might explain why the 
sizes are different to the initial image. The stripping of debug symbols 
from shared objects runs the objcopy command. Off-hand I don't know if 
this is reproducible but maybe there are different versions on the 
Ubuntu systems? If you aren't stripping debug symbols then another 
possibility is that that the package modules (jmod files) used on the 
different versions are identical - this is something you can quickly check.

-Alan.