Hi Erik, Are you going to fix this bug soon?
I am inspired by Martin's words and would like to update GenerateCacerts.java so that as long as the certs and their aliases are unchanged, the output cacerts will always be the same. I can send out a code review today. Thanks, Max > On Jun 12, 2019, at 10:59 AM, Weijun Wang <weijun.w...@oracle.com> wrote: > > Good idea about the creation time. > > --Max > >> On Jun 12, 2019, at 10:53 AM, Martin Buchholz <marti...@google.com> wrote: >> >> Google culture really likes build output determinism, and we recently built >> our own cacerts generator. >> >> To get determinism, we are using cert digest as alias (must have a unique >> alias, but value doesn't seem to matter much), and using cert notBefore >> instead of current (build) timestamp. >> >> On Mon, Jun 10, 2019 at 12:40 PM Erik Joelsson <erik.joels...@oracle.com> >> wrote: >> Since JDK-8193255, when we started generating the cacerts file in the >> build, the build compare baseline builds have started failing. It seems >> the cacerts binary file has some non determinism built in so it doesn't >> get generated exactly the same given the same input. This patch adds >> special handling when comparing that file by comparing the output of >> "keytool -list" on the files instead. >> >> Bug: https://bugs.openjdk.java.net/browse/JDK-8225392 >> >> Webrev: http://cr.openjdk.java.net/~erikj/8225392/webrev.01/ >> >> /Erik >> >
