Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable 3rd party reproducible Temurin Windows x64 builds by compiling using Microsoft VS "Build-Tools" Edition #3787

Open
andrew-m-leonard opened this issue May 2, 2024 · 4 comments
Labels
enhancement Issues that enhance the code or documentation of the repo in any way testing Issues that enhance or fix our test suites

Comments

@andrew-m-leonard
Copy link
Contributor

andrew-m-leonard commented May 2, 2024

Currently Temurin Windows x64 is built using a bespoke Adoptium VS2022 VS_Community Edition Installer image, which we can then use locally to reproducibly re-build.
This setup however, does not allow 3rd parties/users to re-build as a trusted reproducible verification, and since VS_Community edition is only ever available as the "Current"/Latest version, older archived versions are not available, it is not possible to recreate builds by obtaining the same VS_Community version.

Microsoft have introduced the "Build-Tools" license edition, which does provide versioned releases, and is also licenses for open source and enterprise "open source" building, see: https://devblogs.microsoft.com/cppblog/updates-to-visual-studio-build-tools-license-for-c-and-cpp-open-source-projects/

Temurin could move to building using VS "Build-Tools" edition (subject to PMC and Eclipse License review), and thus enable 3rd party reproducible builds, thus providing a more secure development production.

Version downloads: https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-history#fixed-version-bootstrappers

@andrew-m-leonard andrew-m-leonard added enhancement Issues that enhance the code or documentation of the repo in any way PMC-agenda For the PMC to review labels May 2, 2024
@github-actions github-actions bot added the testing Issues that enhance or fix our test suites label May 2, 2024
@andrew-m-leonard
Copy link
Contributor Author

I have confirmed I can identically build Temurin jdk-21.0.3+9 using VS2022 "Build Tools" version 17.7.3, which is identical to the VS2022 VS_Community layout we use to build with.

@tellison
Copy link
Contributor

The PMC discussed this on 8th May, and agreed to moving to this build tool chain, on the understanding that the license is acceptable.

@tellison tellison removed the PMC-agenda For the PMC to review label May 15, 2024
@github-actions github-actions bot added the PMC-agenda For the PMC to review label May 15, 2024
@andrew-m-leonard andrew-m-leonard removed the PMC-agenda For the PMC to review label Jul 3, 2024
@sxa
Copy link
Member

sxa commented Aug 6, 2024

References:

Our current VS2022 compiler from the layout identifies itself as * C Compiler: Version 19.37.32822 using a compiler path of /cygdrive/c/progra~1/micros~3/2022/commun~1/vc/tools/msvc/1437~1.328/bin/hostx64/x64/cl.exe. The 1437 in there would likely indicate that it is Toolchain 14.37 which, extrapolating from the table in the first link, would suggest it is 17.7, although the second link has links for 17.7.0 through 17.7.7. I have confirmed that the 17.7.3 download is a version which identifies the compiler version as 19.37.32822.

Note that for install issues check %TEMP%\dd_installer_<timestamp>.log

@sxa
Copy link
Member

sxa commented Nov 13, 2024

Noting that I have verified the GA builds are identical to the ones produced by the VS build tools as part of the work on enabling windows containers for building adoptium/infrastructure#3286

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Issues that enhance the code or documentation of the repo in any way testing Issues that enhance or fix our test suites
Projects
Status: Todo
Development

No branches or pull requests

3 participants