How to create a "reproducible build" on a Linux OS

Reproducible builds are currently supported for JDK versions:

• jdk-17.0.4+
• jdk-19+

Linux environment setup

To create a reproducible build you need a Linux OS environment identical to the environment of the build you want to reproduce.

What does "identical" mean?

So the exact environment dependencies is work in-progress, so at the present time the identical envionment can be achieved by building on the same machine as the original build, or build using a docker or podman container that was used for the same original build.

Required build tooling

Your environment should be as specified for building the target JDK version. See: https://openjdk.org/groups/build/doc/building.html

Building a reproducible build using the temurin-build scripts

Commands:

git clone https://github.com/adoptium/temurin-build.git

cd temurin-build

export VARIANT=temurin

export JAVA_TO_BUILD=jdk

export SCM_REF=jdk-20+2_adopt (The build tag you want to build, don't set to build HEAD)

export RELEASE=true

export CONFIGURE_ARGS=--disable-ccache

build-farm/make-adopt-build-farm.sh

Build output:

Once the build has successfully completed the built JDK archive will be available in directory:

JDK Archive: workspace/target/jdk-hotspot.tar.gz

CycloneDX SBOM: workspace/target/jdk-hotspot.sbom

Expected differences:

Currently identical JDK images "may" have the following differences, if building on the same physical machine as the original quite often these will be identical as well:

• jdk-19+
  • lib/server/classes_nocoops.jsa
• jdk-17.0.4+
  • lib/server/classes.jsa
  • lib/server/classes_nocoops.jsa