Skip to content

Build kotlin package reproducibly

Currently, when kotlin package is built in stage one, it uses kotlin binaries from upstream. After that in stage two, it can use the Debian-build kotlin for building again. If kotlin package can be built in a reproducible manner in the later stages, it provides us with additional confidence about the correspondence of the source with the binaries and alleviates concerns of using the non-Debian binary in stage one.

Furthermore, as more software is built with Kotlin, that software needs to be reproducible too. As Kotlin is written in Kotlin, if Kotlin itself can be built reproducibly, there is a good chance that we will have found and fixed any issues with building other kotlin software reproducibly (as far as compiler is concerned).

As of current understanding, code generated by Kotlin compiler is mostly reproducible expect for what seems to be two minor instabilities in order of code generation. These can be seen in the diffoscope output available here: https://www.emorrp1.name/kotlin/ . It is best to start by filing upstream bugs for these issues (if they are still relevant).