lib/jrt-fs.jar MANIFEST is non-determinstic if built with different BootJDK

[andrew-m-leonard]

jrt-fs.jar is built by the BootJDK, which has a consequence that the MANIFEST gets tagged with Created-By: (), where jdk-version and vendor are from the bootJDK.
eg.

Manifest-Version: 1.0
Specification-Title: Java Platform API Specification
Specification-Version: 20
Specification-Vendor: Oracle Corporation
Implementation-Title: Java Runtime Environment
Implementation-Version: 20
Implementation-Vendor: Eclipse Adoptium
Created-By: 19.0.1 (Eclipse Adoptium)

Manifest-Version: 1.0
Specification-Title: Java Platform API Specification
Specification-Version: 20
Specification-Vendor: Oracle Corporation
Implementation-Title: Java Runtime Environment
Implementation-Version: 20
Implementation-Vendor: Eclipse Adoptium
Created-By: 19-beta (Eclipse Adoptium)

[zdtsw]

is this Jrtfs.jar for certain OS? I could not find it from a x64 linux tarball

[andrew-m-leonard]

Sorry my shorthand, it's: lib/jrt-fs.jar

[zdtsw]

Now i found it in linux, mac and windows.
should it be added into exclude list with classes_nocoops.jsa for now ?

probably this wont need to be exclude in comparision job, because all our agents are supposed to have the same bootjdk.

but maybe we need to add this bootjdk version into sbom? currently it is only the boot_jdk_dir point to the path on build agent, but not detail minor/patch version number

[andrew-m-leonard]

@zdtsw not an exclude, we can build with same bootjdk version.
And yes +1 to updating SBOM bootjdk details please..

[zdtsw]

Ref Capture all findings for reproducible