Thanks for the quick and useful response! It was indeed the stripping of native debug symbols that was the cause (due to different versions of objcopy on the build machines). I would suggest those creating reproducible builds use only --strip-java-debug-attributes, which (as I understand it) should be platform-independent.
Craig On Fri, Aug 5, 2022 at 12:55 PM Alan Bateman <[email protected]> wrote: > On 05/08/2022 11:18, Craig Raw wrote: > > I am having an issue concerning the reproducibility of the JVM > > libraries produced by JLink. When running the same build script across > > different machines with the same JDK, sometimes the binaries and libs > > in the lib/runtime/bin and lib/runtime/lib folders are different. If > > one of the *.so files is different, they all are. However, the > > lib/runtime/lib/modules file produced by JLink is consistently > > identical. The machines running the builds are all Linux running > > flavours of Ubuntu. > > > > On examining the issue more closely, I notice that sometimes the files > > are identical to the ones in the JDK installation, and sometimes they > > are not. They are not significantly different, for example: > > JDK: > > -rw-rw-r-- 1 xxx xxx 16560 Aug 4 18:08 libjsig.so > > > > JLink: > > -rw-rw-r-- 1 xxx xxx 17136 Aug 4 19:23 libjsig.so > > > > Further, I've tried running the java binaries in each, and they differ > > in that one is 'sharing' and the other not: > > > > xxx@yyy:~$ ~/.sdkman/candidates/java/18.0.1-tem/bin/java --version > > openjdk 18.0.1 2022-04-19 > > OpenJDK Runtime Environment Temurin-18.0.1+10 (build 18.0.1+10) > > OpenJDK 64-Bit Server VM Temurin-18.0.1+10 (build 18.0.1+10, mixed > > mode, sharing) > > > > xxx@yyy:~$ ~/project/build/image/bin/java --version > > openjdk 18.0.1 2022-04-19 > > OpenJDK Runtime Environment Temurin-18.0.1+10 (build 18.0.1+10) > > OpenJDK 64-Bit Server VM Temurin-18.0.1+10 (build 18.0.1+10, mixed mode) > > > > What would cause JLink to modify the JVM itself? Is there a way I can > > achieve a consistently reproducible JVM image? > > > > I assume the jlink command used to generate project/build/image doesn't > specify --generate-cds-archive so that will explain why you don't see > "sharing" in the java -version output. You can use > project/build/image/bin/java -Xshare:dump to do the generate it too. > > For the .so file it is possible that your jlink command specifies > -strip-debug or --strip-native-debug-symbols? That might explain why the > sizes are different to the initial image. The stripping of debug symbols > from shared objects runs the objcopy command. Off-hand I don't know if > this is reproducible but maybe there are different versions on the > Ubuntu systems? If you aren't stripping debug symbols then another > possibility is that that the package modules (jmod files) used on the > different versions are identical - this is something you can quickly check. > > -Alan. > > > >
