Skip to content

Generate reproducible jars #49018

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Generate reproducible jars #49018

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bc6774c
Propagate project.build.outputTimestamp to our packaging
gsmet Jul 8, 2025
245cf9d
Add generated classes and resources in order
gsmet Jul 21, 2025
be405f3
Generate transformed jar in order
gsmet Jul 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions core/deployment/src/main/java/io/quarkus/deployment/pkg/PackageConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package io.quarkus.deployment.pkg;

import java.nio.file.Path;
import java.time.Instant;
import java.util.List;
import java.util.Map;
import java.util.Optional;
Expand Down Expand Up @@ -49,6 +50,13 @@ public interface PackageConfig {
*/
Optional<String> outputName();

/**
* The timestamp used as a reference for generating the packages (e.g. for the creation timestamp of ZIP entries).
* <p>
* The approach is similar to what is done by the maven-jar-plugin with `project.build.outputTimestamp`.
*/
Optional<Instant> outputTimestamp();

/**
* Setting this switch to {@code true} will cause Quarkus to write the transformed application bytecode
* to the build tool's output directory.
Expand Down
45 changes: 28 additions & 17 deletions core/deployment/src/main/java/io/quarkus/deployment/pkg/steps/JarResultBuildStep.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Optional;
import java.util.Set;
import java.util.function.BiPredicate;
Expand Down Expand Up @@ -64,6 +65,7 @@
import io.quarkus.deployment.builditem.MainClassBuildItem;
import io.quarkus.deployment.builditem.QuarkusBuildCloseablesBuildItem;
import io.quarkus.deployment.builditem.TransformedClassesBuildItem;
import io.quarkus.deployment.builditem.TransformedClassesBuildItem.TransformedClass;
import io.quarkus.deployment.configuration.ClassLoadingConfig;
import io.quarkus.deployment.pkg.JarUnsigner;
import io.quarkus.deployment.pkg.PackageConfig;
Expand Down Expand Up @@ -350,7 +352,7 @@ private void buildUberJar0(CurateOutcomeBuildItem curateOutcomeBuildItem,
MainClassBuildItem mainClassBuildItem,
ClassLoadingConfig classLoadingConfig,
Path runnerJar) throws Exception {
try (FileSystem runnerZipFs = createNewZip(runnerJar, packageConfig)) {
try (FileSystem runnerZipFs = createNewReproducibleZipFileSystem(runnerJar, packageConfig)) {

log.info("Building uber jar: " + runnerJar);

Expand Down Expand Up @@ -549,7 +551,7 @@ private JarBuildItem buildLegacyThinJar(CurateOutcomeBuildItem curateOutcomeBuil
Files.deleteIfExists(runnerJar);
IoUtils.createOrEmptyDir(libDir);

try (FileSystem runnerZipFs = createNewZip(runnerJar, packageConfig)) {
try (FileSystem runnerZipFs = createNewReproducibleZipFileSystem(runnerJar, packageConfig)) {

log.info("Building thin jar: " + runnerJar);

Expand Down Expand Up @@ -647,10 +649,14 @@ private JarBuildItem buildThinJar(CurateOutcomeBuildItem curateOutcomeBuildItem,
if (!transformedClasses.getTransformedClassesByJar().isEmpty()) {
Path transformedZip = quarkus.resolve(TRANSFORMED_BYTECODE_JAR);
fastJarJarsBuilder.setTransformed(transformedZip);
try (FileSystem out = createNewZip(transformedZip, packageConfig)) {
for (Set<TransformedClassesBuildItem.TransformedClass> transformedSet : transformedClasses
.getTransformedClassesByJar().values()) {
for (TransformedClassesBuildItem.TransformedClass transformed : transformedSet) {
try (FileSystem out = createNewReproducibleZipFileSystem(transformedZip, packageConfig)) {
// we make sure the entries are added in a reproducible order
// we use Path#toString() to get a reproducible order on both Unix-based OSes and Windows
for (Entry<Path, Set<TransformedClass>> transformedClassEntry : transformedClasses
.getTransformedClassesByJar().entrySet().stream()
.sorted(Comparator.comparing(e -> e.getKey().toString())).toList()) {
for (TransformedClass transformed : transformedClassEntry.getValue().stream()
.sorted(Comparator.comparing(TransformedClass::getFileName)).toList()) {
Path target = out.getPath(transformed.getFileName());
if (transformed.getData() != null) {
if (target.getParent() != null) {
Expand All @@ -668,17 +674,21 @@ private JarBuildItem buildThinJar(CurateOutcomeBuildItem curateOutcomeBuildItem,
//now generated classes and resources
Path generatedZip = quarkus.resolve(GENERATED_BYTECODE_JAR);
fastJarJarsBuilder.setGenerated(generatedZip);
try (FileSystem out = createNewZip(generatedZip, packageConfig)) {
for (GeneratedClassBuildItem i : generatedClasses) {
String fileName = fromClassNameToResourceName(i.getName());
try (FileSystem out = createNewReproducibleZipFileSystem(generatedZip, packageConfig)) {
// make sure we write the elements in order
for (GeneratedClassBuildItem i : generatedClasses.stream()
.sorted(Comparator.comparing(GeneratedClassBuildItem::binaryName)).toList()) {
String fileName = fromClassNameToResourceName(i.internalName());
Path target = out.getPath(fileName);
if (target.getParent() != null) {
Files.createDirectories(target.getParent());
}
Files.write(target, i.getClassData());
}

for (GeneratedResourceBuildItem i : generatedResources) {
// make sure we write the elements in order
for (GeneratedResourceBuildItem i : generatedResources.stream()
.sorted(Comparator.comparing(GeneratedResourceBuildItem::getName)).toList()) {
Path target = out.getPath(i.getName());
if (target.getParent() != null) {
Files.createDirectories(target.getParent());
Expand All @@ -703,7 +713,7 @@ private JarBuildItem buildThinJar(CurateOutcomeBuildItem curateOutcomeBuildItem,
.setResolvedDependency(applicationArchivesBuildItem.getRootArchive().getResolvedDependency())
.setPath(runnerJar));
Predicate<String> ignoredEntriesPredicate = getThinJarIgnoredEntriesPredicate(packageConfig);
try (FileSystem runnerZipFs = createNewZip(runnerJar, packageConfig)) {
try (FileSystem runnerZipFs = createNewReproducibleZipFileSystem(runnerJar, packageConfig)) {
copyFiles(applicationArchivesBuildItem.getRootArchive(), runnerZipFs, null, ignoredEntriesPredicate);
}
}
Expand Down Expand Up @@ -793,7 +803,7 @@ private JarBuildItem buildThinJar(CurateOutcomeBuildItem curateOutcomeBuildItem,
}
}
if (!rebuild) {
try (FileSystem runnerZipFs = createNewZip(initJar, packageConfig)) {
try (FileSystem runnerZipFs = createNewReproducibleZipFileSystem(initJar, packageConfig)) {
ResolvedDependency appArtifact = curateOutcomeBuildItem.getApplicationModel().getAppArtifact();
generateManifest(runnerZipFs, classPath.toString(), packageConfig, appArtifact,
QuarkusEntryPoint.class.getName(),
Expand Down Expand Up @@ -997,7 +1007,7 @@ public static String getJarFileName(ResolvedDependency dep, Path resolvedPath) {
}

private void packageClasses(Path resolvedDep, final Path targetPath, PackageConfig packageConfig) throws IOException {
try (FileSystem runnerZipFs = createNewZip(targetPath, packageConfig)) {
try (FileSystem runnerZipFs = createNewReproducibleZipFileSystem(targetPath, packageConfig)) {
Files.walkFileTree(resolvedDep, EnumSet.of(FileVisitOption.FOLLOW_LINKS), Integer.MAX_VALUE,
new SimpleFileVisitor<Path>() {
@Override
Expand Down Expand Up @@ -1063,7 +1073,7 @@ private NativeImageSourceJarBuildItem buildNativeImageThinJar(CurateOutcomeBuild
Path libDir = targetDirectory.resolve(LIB);
Files.createDirectories(libDir);

try (FileSystem runnerZipFs = ZipUtils.newZip(runnerJar)) {
try (FileSystem runnerZipFs = createNewReproducibleZipFileSystem(runnerJar, packageConfig)) {

log.info("Building native image source jar: " + runnerJar);

Expand Down Expand Up @@ -1657,12 +1667,13 @@ public boolean decompile(Path jarToDecompile) {
}
}

private static FileSystem createNewZip(Path runnerJar, PackageConfig config) throws IOException {
private static FileSystem createNewReproducibleZipFileSystem(Path runnerJar, PackageConfig config) throws IOException {
boolean useUncompressedJar = !config.jar().compress();
if (useUncompressedJar) {
return ZipUtils.newZip(runnerJar, Map.of("compressionMethod", "STORED"));
return ZipUtils.createNewReproducibleZipFileSystem(runnerJar, Map.of("compressionMethod", "STORED"),
config.outputTimestamp().orElse(null));
}
return ZipUtils.newZip(runnerJar);
return ZipUtils.createNewReproducibleZipFileSystem(runnerJar, config.outputTimestamp().orElse(null));
}

}
5 changes: 5 additions & 0 deletions devtools/maven/src/main/java/io/quarkus/maven/QuarkusBootstrapProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,6 +348,11 @@ public Properties getBuildSystemProperties(QuarkusBootstrapMojo mojo, boolean qu

effectiveProperties.putIfAbsent("quarkus.application.name", mojo.mavenProject().getArtifactId());
effectiveProperties.putIfAbsent("quarkus.application.version", mojo.mavenProject().getVersion());
// pass the project.build.outputTimestamp to Quarkus packaging subsystem
if (mojo.mavenProject().getProperties().containsKey("project.build.outputTimestamp")) {
effectiveProperties.putIfAbsent("quarkus.package.output-timestamp",
mojo.mavenProject().getProperties().getProperty("project.build.outputTimestamp"));
}

for (Map.Entry<String, String> attribute : mojo.manifestEntries().entrySet()) {
if (attribute.getValue() == null) {
Expand Down
Loading