On Fri, 22 Sep 2023 12:38:03 GMT, Andrew Leonard <aleon...@openjdk.org> wrote:
> jrt-fs.jar classes are currently compiled with the BootJDK being used, this > has a couple of issues: > - The classes are not reproducible between a standard and bootcycle build > image, since the first is compiled by jdk-N-1 and the later jdk-N > - The jrt-fs classes in a standard product image are compiled by the BootJDK > (typically jdk-N-1), which means from a "secure dev" perspective they are not > compiled with the latest and greatest compiler with all the latest > vulnerability fixes. > > The jrt-fs classes are required to be built targeting jdk-8 compatible, there > is no reason they cannot be compiled with the jdk-N "interim" compiler as > part of the standard build. > This then makes the jrt-fs classes reproducible regardless of which bootjdk > is used. This pull request has now been integrated. Changeset: 0f0c5b2d Author: Andrew Leonard <aleon...@openjdk.org> URL: https://git.openjdk.org/jdk/commit/0f0c5b2d71e6dec442a5105ba305043cb59b99fc Stats: 4 lines in 1 file changed: 2 ins; 0 del; 2 mod 8316648: jrt-fs.jar classes not reproducible between standard and bootcycle builds Reviewed-by: erikj ------------- PR: https://git.openjdk.org/jdk/pull/15888
