JLink image libraries are not consistently reproducible

[Craig Raw]

Thanks for the quick and useful response!

It was indeed the stripping of native debug symbols that was the cause (due
to different versions of objcopy on the build machines). I would suggest
those creating reproducible builds use only --strip-java-debug-attributes,
which (as I understand it) should be platform-independent.

Craig

On Fri, Aug 5, 2022 at 12:55 PM Alan Bateman <Alan.Bateman at oracle.com>
wrote:

> On 05/08/2022 11:18, Craig Raw wrote:
> > I am having an issue concerning the reproducibility of the JVM
> > libraries produced by JLink. When running the same build script across
> > different machines with the same JDK, sometimes the binaries and libs
> > in the lib/runtime/bin and lib/runtime/lib folders are different. If
> > one of the *.so files is different, they all are. However, the
> > lib/runtime/lib/modules file produced by JLink is consistently
> > identical. The machines running the builds are all Linux running
> > flavours of Ubuntu.
> >
> > On examining the issue more closely, I notice that sometimes the files
> > are identical to the ones in the JDK installation, and sometimes they
> > are not. They are not significantly different, for example:
> > JDK:
> > -rw-rw-r-- 1 xxx xxx  16560 Aug  4 18:08 libjsig.so
> >
> > JLink:
> > -rw-rw-r-- 1 xxx xxx  17136 Aug  4 19:23 libjsig.so
> >
> > Further, I've tried running the java binaries in each, and they differ
> > in that one is 'sharing' and the other not:
> >
> > xxx at yyy:~$ ~/.sdkman/candidates/java/18.0.1-tem/bin/java --version
> > openjdk 18.0.1 2022-04-19
> > OpenJDK Runtime Environment Temurin-18.0.1+10 (build 18.0.1+10)
> > OpenJDK 64-Bit Server VM Temurin-18.0.1+10 (build 18.0.1+10, mixed
> > mode, sharing)
> >
> > xxx at yyy:~$ ~/project/build/image/bin/java --version
> > openjdk 18.0.1 2022-04-19
> > OpenJDK Runtime Environment Temurin-18.0.1+10 (build 18.0.1+10)
> > OpenJDK 64-Bit Server VM Temurin-18.0.1+10 (build 18.0.1+10, mixed mode)
> >
> > What would cause JLink to modify the JVM itself? Is there a way I can
> > achieve a consistently reproducible JVM image?
> >
>
> I assume the jlink command used to generate project/build/image doesn't
> specify --generate-cds-archive so that will explain why you don't see
> "sharing" in the java -version output. You can use
> project/build/image/bin/java -Xshare:dump to do the generate it too.
>
> For the .so file it is possible that your jlink command specifies
> -strip-debug or --strip-native-debug-symbols? That might explain why the
> sizes are different to the initial image. The stripping of debug symbols
> from shared objects runs the objcopy command. Off-hand I don't know if
> this is reproducible but maybe there are different versions on the
> Ubuntu systems? If you aren't stripping debug symbols then another
> possibility is that that the package modules (jmod files) used on the
> different versions are identical - this is something you can quickly check.
>
> -Alan.
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/jigsaw-dev/attachments/20220808/ebf9bea1/attachment.htm>