## page was renamed from ReproducibleBuilds/TimestampInJarFiles
jar files contain aspects that vary when they are created. This prevents build to be reproducible and capture an uninteresting details. 

 * timestamps with a [[http://ant.apache.org/manual/Tasks/zip.html|time resolution of 2 seconds]]
 * a "magic byte" marker added by [[http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/7-b147/java/util/jar/JarOutputStream.java|JarOutputStream]] but not [[http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/7u40-b43/java/util/zip/ZipOutputStream.java#ZipOutputStream|ZipOutputStream]]
 * the files are listed the order that they were added

[[https://reproducible.debian.net/issues/timestamps_in_jar_issue.html|Known affected Java packages]], [[https://reproducible.debian.net/issues/xpi_pack_saves_extra_attributes_in_jar_issue.html|known affected Mozilla extensions]]

= Detection =

[[attachment:flute_1.1.6-3.debbindiff.html|Example debbindiff output]]

`zipinfo -lv` displays the detailed metadata of the content of the archive, suitable for this work.  Careful with `unzip -l`, it does not display the seconds in the timestamps even though the zip format stores them.

= Work-around =

This is taken care by DebianPts:strip-nondeterminism.

= Solution =

== Java jar ==

None yet.

== mozilla-devscripts ==

[[https://anonscm.debian.org/cgit/pkg-mozext/mozilla-devscripts.git/commit/?id=bc9f279909ac9c7e47f2b4599630565fe03230ec|Patch has been applied in mozilla-devscripts]].

= References =

 * http://imperceptiblethoughts.com/post/70592053189/reproducible-multi-project-gradle-builds-part-2
 * [[https://lists.mayfirst.org/pipermail/guardian-dev/2014-April/003420.html|guardian-dev: deterministic, repeatable build of LilDebi]]
 * http://code.briarproject.org/akwizgran/sortjar
 *A [[http://www.redhat.com/archives/fedora-devel-java-list/2008-September/msg00042.html|thread from 2008 on a Fedora mailing list]] seems to be on point; they suggest a [[http://sourceforge.net/p/infozip/patches/6/|patch]] to the [[http://info-zip.org/mans/zipnote.html|zipnote]] command which allows timestamps to be updated in zip files without unpacking. AFAICT, this now five-year-old patch hasn't made it into upstream Infozip, let alone Debian.
 * [[ReproducibleBuilds/MysteryByteIncrementInJarFiles|Mystery byte increment in jar files]]