This CSR relates to enhancement https://bugs.openjdk.java.net/browse/JDK-8276400 (openjdk image Jars, Zips and Jmods built from the same source are not reproducible). The essence to resolving the issue of reproducibility for Jar and Jmod's is provided by PR: https://github.com/openjdk/jdk/pull/6268, and involves supporting a "Behavioral change to Jar, Jmod and ZipOutputStream" and "Dependence on an environment variable". The behavioral changes are as follows:

• Jar and Jmod currently produce "zips" whose contents are in a non-deterministic file order. This CSR will ensure the Jar files are stored in sorted order, and for Jmods each "Section" (eg.classes) is sorted.
• Both Jar and Jmod use the underlying ZipOutputStream to write the "zip" content. The current implementation writes new ZipEntry "last modified" times as the System.currentTimeMillis(). This CSR will extend this behavior to detect if the standardized SOURCE_DATE_EPOCH environment variable is set, and if it is use that time in milliseconds as the new ZipEntry "last modified" time. If the SOURCE_DATE_EPOCH environment variable is not set, then the behavior is unchanged.