For reproducible Temurin Windows builds, we specify our MS VS version in our SBOM, basically as soon as you use a slightly different VS compiler, the native PE code is different... which I think is as expected really. For our Linux builds of OpenJDK we use what's termed a "DevKit", which is a specific version level of the gcc compiler, a "user" can independently re-create the DevKit Toolchain from source "identically", and then use that to identically build OpenJDK. Ref: https://htmlpreview.github.io/?https://raw.githubusercontent.com/openjdk/jdk/master/doc/building.html#cross-compiling-the-easy-way
On Mon, Dec 2, 2024 at 7:34 AM Chris Lamb <[email protected]> wrote: > Danilo wrote: > > > One aspect that I cannot get rid of is the embedded toolchain > > information, as well as differing behavior between toolchain versions. > […] > > From what I could gather, there is no way to really solve this issue. > > The approach that we currently plan to implement is to simply declare > > the toolchain version we used, and let the user deal with the effort to > > get it installed. > > I can't solve your specific problem with the embedded MSVC versions, > but your alternative plan to simply declare the version out-of-band is > the general approach taken in most non-Windows environments. As in, > you would not be doing anything dramatically different from other > platforms. > > The claim that "X is reproducible" carries an implicit "given the same > build environment". Most projects declare the toolchain versions by > recording the build environment programmatically and distributing that > info in some way: see [0] for some concrete examples. > > For instance, Debian tooling generates a .buildinfo file that > includes the build dependencies along with the versions used. Users > must indeed "deal with the effort" to match that if they want to > reproduce the package. > > However, the scriptable packaging tools for Debian and friends make it > relatively straightforward (in theory!!) to programmatically install a > whole bunch of dependencies with specific versions. That might not be > the case under Windows and with VC components. > > Intriguingly, the way you couch your "alternative" solution with some > hesitation might suggest asking users to install a specific version > goes against the social norms for that technical platform/community. > I'd be interested to learn about that, as its the kind of "we don't > tend to do that.." thing that does not end up in technical > documentation. :) > > > [0] https://reproducible-builds.org/docs/recording/ > > > Best wishes, > > -- > o > ⬋ ⬊ Chris Lamb > o o reproducible-builds.org 💠 > ⬊ ⬋ > o > > >
