Bug 2196908

Summary:	Base JDK CDS archive (classes.jsa) not unique per JDK build [rhel-8,openjdk-17]
Product:	Red Hat Enterprise Linux 8	Reporter:	Severin Gehwolf <sgehwolf>
Component:	java-17-openjdk	Assignee:	Andrew John Hughes <ahughes>
Status:	MODIFIED ---	QA Contact:	OpenJDK QA <java-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.7	CC:	pmikova
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	java-17-openjdk-17.0.8.0.7-2.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2221655 2221656 2221657 (view as bug list)		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2221656, 2221657, 2221655

Description Severin Gehwolf 2023-05-10 18:41:42 UTC

Description of problem:
Installing java-17-openjdk-headless on two different systems or, for example, in two different containers results in distinct classes.jsa files getting generated. This is because the CDS archive is being generated by a post script action of the java-17-openjdk-headless package. Therefore, the CDS archive is unique per installation (even if it's the same NVRA being installed), not per JDK version. This breaks usages of Application Class Data Sharing which uses the dynamic dump feature. In such a scenario the base CDS archive (and its crc) is encoded in the dynamic archive and if that doesn't match at runtime AppCDS sharing fails with:

An error has occurred while processing the shared archive file.
Dynamic archive cannot be used: static archive header checksum verification failed.
Error occurred during initialization of VM
Unable to use shared archive.

Version-Release number of selected component (if applicable):
java-17-openjdk-headless-17.0.7.0.7-1.el8_7.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. Install java-17-openjdk-headless of the same NVRA multiple times
2. Observe that the classes.jsa is unique per installation (e.g. by 'ls -l' or running 'sha512sum' on the file and compare timestamps/sums)

Actual results:
classes.jsa is unique per installation.

Expected results:
classes.jsa is the same across multiple installations of java-17-openjdk-headless of the *same* NVR (Name Version Release). classes.jsa is being generated during the OpenJDK build and should be unique per build.

Additional Info:
This breaks some AppCDS deployment scenarios on OpenShift when using ubi8/openjdk-17 images.