RFR: 8276400: openjdk image Jars, Zips and Jmods built from the same source are not reproducible

Magnus Ihse Bursie ihse at openjdk.java.net
Fri Nov 5 13:22:13 UTC 2021


On Thu, 4 Nov 2021 20:56:45 GMT, Andrew Leonard <aleonard at openjdk.org> wrote:

> This PR enables reproducible Jars, Jmods and openjdk image zip files (eg.src.zip).
> It provides support for SOURCE_DATE_EPOCH for Jar, Jmod and underlying ZipOutputStream's.
> It fixes the following keys issues relating to reproducibility:
> - Jar and ZipOutputStream are not SOURCE_DATE_EPOCH aware
>   - Jar and ZipOutputStream now detect SOURCE_DATE_EPOCH environment setting
> - Jar and Jmod file content ordering was non-determinsitic
>   - Fixes to Jar and Jmod main's to ensure sorted classes content ordering
> - openjdk image zip file generation used "zip" which is non-determinsitic
>   - New openjdk build tool "GenerateZip" which produces the final determinsitic zip files as part of the build and also detects SOURCE_DATE_EPOCH
> 
> Signed-off-by: Andrew Leonard <anleonar at redhat.com>

Sounds like a good plan. As for the build part ("GenerateZip"), this is not as important in the build as it used to be. Back in the days, before Jigsaw, we had a huge rt.jar that needed updating each time an incremental build was done. Hence the elaborate system for updating existing zip files. (Because recompressing the entire rt.jar was prohibitively slow.)

Now we instead have jmod/jlink which do not support incremental updates and are almost as slow as before (that's a bit underprioritized, as well...) but due to the modularization, all modules except java.base are fairly quick to link anyway.

So the old zip generation is only used for src.zip, afaik. (We might be using it in closed Oracle code as well for some side artifacts, but that is not relevant to the OpenJDK story, and to be honest, I'm not sure anymore.) This has no need to be quick to update incrementally. If it turns out to be too slow, we can move it out of the normal "jdk-image" target and add a "image-srczip" or whatever. 

So, another way of stating this is that GenerateZip has as its main goal to facilitate creation of src.zip. And most of the logic in CreateZipArchive.gmk can basically just be thrown out.

-------------

PR: https://git.openjdk.java.net/jdk/pull/6268



More information about the build-dev mailing list