jar files contain aspects that vary when they are created. This prevents build to be reproducible and capture an uninteresting details.

Known affected Java packages, known affected Mozilla extensions

Detection

Example debbindiff output

zipinfo -lv displays the detailed metadata of the content of the archive, suitable for this work. Careful with unzip -l, it does not display the seconds in the timestamps even though the zip format stores them.

Work-around

This is taken care by strip-nondeterminism.

Solution

Java jar

None yet.

mozilla-devscripts

Patch has been applied in mozilla-devscripts.

References