Creating new Jar, same code different MD5 ?

[swebb99]

Hi,

If I compile some code and create a jar and related md5 file using ANT
the checksum in the md5 file is different everytime even though the
code hasn't changed. Any idea's why this is so how it can circumvented
? I suspect there is some timestamp information coming in somewhere.

Im trying to use the md5 info to decide if the jars need downloading to
the apache server ready of webstart access. If its the same checksum as
in the last build I won't download the jar.

Cheers

Steve

 

[Adam Maass]

Hi,

If I compile some code and create a jar and related md5 file using ANT
the checksum in the md5 file is different everytime even though the
code hasn't changed. Any idea's why this is so how it can circumvented
? I suspect there is some timestamp information coming in somewhere.

Im trying to use the md5 info to decide if the jars need downloading to
the apache server ready of webstart access. If its the same checksum as
in the last build I won't download the jar.

Timestamp differences or a different order of the files contained in the jar
will cause a different MD5 sum, even if the jars are functionally identical.

-- Adam Maass

 

[Chris Uppal]

If I compile some code and create a jar and related md5 file using ANT
the checksum in the md5 file is different everytime even though the
code hasn't changed.

If you're taking the checksum of the entire JAR file, then that will (or
should) include file timestamps for the .class files therein. So the checksum
should change.

Im trying to use the md5 info to decide if the jars need downloading to
the apache server ready of webstart access. If its the same checksum as
in the last build I won't download the jar.

A few suggestions, I don't know how sensible any of them would be in your
situation. One is to change the timestamps of the .class files to be the same
as that of their source .java files (before putting them in the JAR), or to
some other fixed value. Another is to take a checksum of the Java source files
instead. A third would be to take a checksum of the classfiles' contents (in
some standard order) instead of that of the JAR.

-- chris

 

[Shane Petroff]

Im trying to use the md5 info to decide if the jars need downloading to
the apache server ready of webstart access. If its the same checksum as
in the last build I won't download the jar.

I tried to achieve a similar result for validating escrowed code. The
only 'solution' I came up with (but did not implement) was to use the
code itself, not the jars. Once could decompile, then cat everything
into one glob then assess checksums, but that seems like a hack.

 

[swebb99]

Thanks for the replies.

I've decided to tackle the problem for the 3rd party jars first. The
MD5 only changes on these if they are actually changed.

So far the ant script generates the md5 files for all the jars in a
specific directory and then downloads this directory onto the server
with the jars. The script also uploads the md5 files from the server.
The idea is now to extend it so that it compares the md5 on a jar with
the md5 file that was uploaded. If they are different we know we have
to download the jar and its md5 otherwise it hasn't changed and we can
forget about it.

I now have a problem. How on earth can I loop through all jar files in
a directory and check the md5 value for each with the associated md5
files in the upload directory. fileset doesn't seem to offer filtering
based on checksum and checksum itself only seems to process one file or
all files.

I've noticed there is a none standard ant mechanism called foreach that
I may be able to use but it there any other way ? Maybe using
selectors, or macrodefs ?

Thanks for any response.

Steve