RFR: 8264449: Enable reproducible builds with SOURCE_DATE_EPOCH [v7]

[John Neffenger]

On Mon, 20 Jun 2022 20:19:01 GMT, Johan Vos <jvos at openjdk.org> wrote:

> Unless you restrict a number of configurations, there is afaik no stock distribution that allows this.

That's why Red Hat has Flatpak and Ubuntu has Snaps (and they each grudingly support the other's solution). Their approach is to let the JavaFX application include its minimal Java runtime (using `jlink`) along with the complete set of its dependencies. That packaging allows it to run as a self-contained application on any Linux system. I'm not aware of projects trying to solve this at the SDK level.

> The "lots of work" I'm talking about is the reproducible and automated way to create those devkits so that they support a reasonable number of {build/host/target} triplets.

One main goal of this pull request was to allow Linux distribution to be able to create reproducible builds of JavaFX, and they already have automated ways to create their build environments.

If you're looking for a more general way to automate the process of reproducing any build and its environment, there are groups working on that, but I think it's still very early days. See, for example, the section "New SPDX team to incorporate build metadata in Software Bill of Materials" in the [Reproducible Builds in May 2022][1] newsletter. Also see the `.buildspec` rebuild instructions used by the [Reproducible Central][2] project.

[1]: https://urldefense.com/v3/__https://reproducible-builds.org/reports/2022-05/__;!!ACWV5N9M2RV99hQ!PzSQevdniZYY4SQeqTsfU31VccS_s_gotFwbwL5zfEI5HqItrayeELKq7yC6fgsMSpcOR0Is9LUTMQqhOV1pHig$ 
[2]: https://urldefense.com/v3/__https://github.com/jvm-repo-rebuild/reproducible-central__;!!ACWV5N9M2RV99hQ!PzSQevdniZYY4SQeqTsfU31VccS_s_gotFwbwL5zfEI5HqItrayeELKq7yC6fgsMSpcOR0Is9LUTMQqhztYK4k4$ 

-------------

PR: https://git.openjdk.org/jfx/pull/446