Reproducible jars

[jlesquembre]

In the long run, it would be nice to generate jars deterministically.

To my knowledge, it is not a Clojure specific issue, the whole JVM ecosystem is affected.

A paper discussing this topic: https://arxiv.org/abs/2202.05906

The authors mention a tool (JavaBEPFix) to post-process the generated jars, making them deterministic in most cases. Unfortunately, I was not able to find any information about JavaBEPFix (I don't think it is open source). Recently I discover byte-buddy, maybe it could be used to generate jars deterministically.

An issue specific to Clojure is non-deterministic AOT function names, more details about it here:
https://github.com/griffinbank/rules_clojure#known-issues

[jlesquembre]

Related project: https://salsa.debian.org/reproducible-builds/strip-nondeterminism

[jlesquembre]

Related:

• https://clojure.atlassian.net/browse/CLJ-1973?focusedCommentId=49503
• https://ask.clojure.org/index.php/12925/why-does-clojure-compiler-give-different-output-same-input

[jlesquembre]

Maven Lockfile:

• https://github.com/chains-project/maven-lockfile
  • Announcement: https://www.reddit.com/r/Maven/comments/12qjr13/mavenlockfile/