(This is a retroactive CSR to document a change in JDK 15 with compatibility impact. The compatibility impact has recently come to light while investigating an interop issue between Oracle JDK 11u and builds from the OpenJDK 11u repo. The interop issue arises because this change was back ported to the OpenJDK 11u repo, thus changing how the hashes are computed for standard / JDK modules, and breaking jlink cross-linking. Note that cross linking is restricted to same feature release, the change in JDK 15 does not impact cross linking with standard or JDK modules).

Summary

The jar and jmod tools support the command line option --hash-modules to compute and record the hashes of modules that depend upon directly or indirectly on a module in a modular JAR or JMOD file.

Change the computation of the hash so that it's reproducible, meaning it is independent of the ordering of entries in the JAR or JMOD file and independent of the timestamps on entries.

Problem

The hash computed by jar --hash-modules and jmod --hash-modules is hostile to reproducible builds. This is primarily an issue for JDK builds as there has been a lot of interest in having the JDK build be reproducible.

Solution

Change the computation of the hash so it is independent of the ordering of entries in the JAR or JMOD file and independent on the timestamps on entries.

Specification

There are no specification changes or changes to command line options.