Skip generating checksum files for SBOM artifacts in Solaris build by SehrishHussain · Pull Request #4334 · adoptium/temurin-build

SehrishHussain · 2025-12-09T09:54:20Z

Update Solaris build-simple.sh to handle SBOM checksums

This PR updates the Solaris build-simple.sh script to correctly handle SHA256 checksums for SBOM JSON artifacts. Previously, SBOM files either skipped checksums entirely or left temporary .sha256.txt files behind.
Closes #4316

Changes

The for FILE in OpenJDK* loop now:
- Generates SHA256 for all files, including SBOM JSONs.
- Captures the checksum for SBOM files but removes the temporary .sha256.txt immediately after.
- Ensures metadata filenames for SBOM follow the <name>-metadata.json convention.
Metadata for SBOM files now contains the correct SHA256 value while no leftover checksum files remain.
Checksum generation for other artifacts remains unchanged.

Local Testing

Created a test workspace with dummy artifacts: OpenJDK-fake.tar.gz and OpenJDK-fake.sbom.json.
Verified:
- Non-SBOM files generate .sha256.txt as expected.
- SBOM files include correct SHA256 in metadata and no .sha256.txt remains.
- Script runs without errors.

This ensures Solaris builds behave consistently with other platforms and prevents unnecessary SBOM checksum files from being generated.

github-actions · 2025-12-09T09:54:29Z

Thank you for creating a pull request!
If you have not done so already, please familiarise yourself with our Contributing Guidelines and FAQ, even if you have contributed to the Adoptium project before. GitHub actions will now run a set of jobs against your PR that will lint and unit test your changes. Keep an eye out for the results from these on the latest commit you submitted. For more information, please see our testing documentation.

SehrishHussain · 2025-12-09T09:55:36Z

@andrew-m-leonard and @sxa Please review this clean PR.

andrew-m-leonard

Looks good thanks

sxa · 2025-12-09T14:58:11Z

Looking at a test run of this and it's possible that the Solaris build is currently broken although it's in the freetype section so may have been a result of #4320 making it go down a part which it didn't do before:

SUCCESS: BUILD_CONFIG[TAG] is set. Exporting to /export/home/vagrant/temurin-build/build-farm/workspace/target//metadata/scmref.txt...
jdk8u482-b01_adoptcheckoutRequiredCodeToBuild succeeded
grep: illegal option -- q
Usage: grep -hblcnsviw pattern file . . .
libfreetype/src not found in /export/home/vagrant/temurin-build/build-farm/workspace/./build//src
Non-Linux-based environment detected, skipping download of dependency Alsa.
Checking and downloading FreeType Font dependency
Checking for freetype at /export/home/vagrant/temurin-build/build-farm/workspace/./build/
find: stat() error /export/home/vagrant/temurin-build/build-farm/workspace/./build//installedfreetype/lib/: No such file or directory
Cloning into 'freetype'...
Note: checking out '86bc8a95056c97a810986434a3f268cbe67f2902'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

  git checkout -b new_branch_name

HEAD is now at 86bc8a9... * Version 2.9.1 released. =========================
./autogen.sh: line 102: aclocal: command not found
./autogen.sh: line 55: test: 1: unary operator expected
./autogen.sh: line 59: test: 1: unary operator expected
./autogen.sh: line 67: test: 10: unary operator expected
./autogen.sh: line 71: test: 10: unary operator expected
./autogen.sh: line 102: libtoolize: command not found
./autogen.sh: line 55: test: 2: unary operator expected
./autogen.sh: line 59: test: 2: unary operator expected
./autogen.sh: line 67: test: 2: unary operator expected
./autogen.sh: line 71: test: 2: unary operator expected
generating `configure.ac'
running `aclocal -I . --force'
error while running `aclocal -I . --force'
./autogen.sh: line 15: aclocal: command not found
+ mkdir -p workspace/target
+ scp -prP 24322 -o PubkeyAcceptedKeyTypes=ssh-rsa -o HostKeyAlgorithms=ssh-rsa -i /home/solarisbuild/.vagrant/machines/adoptopenjdkSol10/virtualbox/private_key 'vagrant@cloud.siteox.com:temurin-build/build-farm/workspace/target/*' workspace/target
+ cd workspace/target

judovana · 2025-12-10T11:51:42Z

HEAD is now at 86bc8a9... * Version 2.9.1 released. =========================
./autogen.sh: line 102: aclocal: command not found
./autogen.sh: line 55: test: 1: unary operator expected
./autogen.sh: line 59: test: 1: unary operator expected
./autogen.sh: line 67: test: 10: unary operator expected
./autogen.sh: line 71: test: 10: unary operator expected
./autogen.sh: line 102: libtoolize: command not found
./autogen.sh: line 55: test: 2: unary operator expected
./autogen.sh: line 59: test: 2: unary operator expected
./autogen.sh: line 67: test: 2: unary operator expected
./autogen.sh: line 71: test: 2: unary operator expected
generating configure.ac' running aclocal -I . --force'
error while running `aclocal -I . --force'
./autogen.sh: line 15: aclocal: command not found

mkdir -p workspace/target

scp -prP 24322 -o PubkeyAcceptedKeyTypes=ssh-rsa -o HostKeyAlgorithms=ssh-rsa -i /home/solarisbuild/.vagrant/machines/adoptopenjdkSol10/virtualbox/private_key 'vagrant@cloud.siteox.com:temurin-build/build-farm/workspace/target/*' workspace/target

cd workspace/target

I hit it too. I think this ws the reason, why solaris needed one special version of external freetype. Was 50to50 "sure", that when moved to intree freetype the issue will disappear, because it was coming from different, external version then the original "perfect one". I can not find full trace after the merges of #4306 (comment). Do you have one handy?

@andrew-m-leonard and @sxa Please review this clean PR.

Error: File:[/github/workspace/sbin/solaris/build-simple.sh] is not executable

@SehrishHussain Please fix this last linter issue! Chmod it please. 755 I guess...

judovana · 2025-12-10T12:08:17Z

Looking at a test run of this and it's possible that the Solaris build is currently broken although it's in the freetype section so may have been a result of #4320 making it go down a part which it didn't do before:

AS it is from yesterday, then it seems I was still pulling in tree 2.9,but today it should be already pulling usptream's 2.13. Worthy to rerun. If it will still be pulling some freetype, then I overlooked some external switch.

sxa · 2025-12-15T16:00:39Z

Solaris issue should be fixed by #4342 so we can aim to get that one in, rebase this PR on top of it, and then run the test again.

karianna · 2025-12-15T19:33:40Z

lint items like:

In /github/workspace/sbin/solaris/build-simple.sh line 53:
build_trim=$(echo $build | sed 's/^0*//')
^-------------------------^ SC2001 (style): See if you can use ${variable//search/replace} instead.

sxa · 2025-12-16T12:02:54Z

@judovana Hmmm it's not linking properly on Solaris :'( Looks like it's not correctly pulling in the C libraries when linking the built freetype:

Undefined			first referenced
 symbol  			    in file
free                                /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
fopen                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
fread                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
fseek                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
ftell                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
qsort                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/afmparse.o
longjmp                             /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftgrays.o
memmove                             /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/cffobjs.o

I'm tempted to suggest we just leave freetype using the original mechanism for now if this is going to be problematic and can't be fixed without an upstream patch.

judovana · 2025-12-16T12:34:32Z

@judovana Hmmm it's not linking properly on Solaris :'( Looks like it's not correctly pulling in the C libraries when linking the built freetype:

Undefined			first referenced
 symbol  			    in file
free                                /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
fopen                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
fread                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
fseek                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
ftell                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftsystem.o
qsort                               /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/afmparse.o
longjmp                             /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/ftgrays.o
memmove                             /export/home/vagrant/temurin-build/build-farm/workspace/build/src/build/solaris-sparcv9-normal-server-release/jdk/objs/libfreetype/cffobjs.o

I'm tempted to suggest we just leave freetype using the original mechanism for now if this is going to be problematic and can't be fixed without an upstream patch.

Wou. @sxa ; How that is possible?
It is not that easy to roll properly back. The jdk build now supports only intree and system-dynamic. No more external freetype possible. To have the system dynamic linking seems to be the only way.

soemthing like

--- a/build-farm/platform-specific-configurations/solaris.sh
+++ b/build-farm/platform-specific-configurations/solaris.sh
@@ -17,7 +17,7 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # shellcheck source=sbin/common/constants.sh
 source "$SCRIPT_DIR/../../sbin/common/constants.sh"
 
-export BUILD_ARGS="${BUILD_ARGS} --make-args SHELL=/bin/bash"
+export BUILD_ARGS="${BUILD_ARGS} --make-args SHELL=/bin/bash --skip-freetype"
 
 if [ "${ARCHITECTURE}" == "x64" ]; then
   export CUPS="--with-cups=/opt/sfw/cups"

Should do the job then (not tested)

sxa · 2025-12-19T12:46:11Z

I had a quick try and patching in -lc to the Awt2dLibraries.gmk file but that didn't have the desired result (Different build failure).

I'm testing with --skip-freetype and we'll see if it goes through ok. If so we can stick with that for now if the system freetype isn't too old ...

sxa · 2025-12-19T15:50:42Z

I'm testing with --skip-freetype and we'll see if it goes through ok. If so we can stick with that for now if the system freetype isn't too old ...

Needed some extra parameters on our machines which I've added into https://github.com/adoptium/temurin-build/pull/4345/changes - @SehrishHussain I'll let you decide if you want me to push that forward and then you rebase on it, or you can just make those same changes to solaris.sh in this PR (which will probably be quicker) :-)

sxa · 2025-12-22T11:22:19Z

Looks like #4304 has introduced several constructs which break the Solaris build due to the use of non-standard UNIX command parameters :-(
FYI @adamfarley

SehrishHussain · 2025-12-28T15:03:48Z

Hey @sxa ,
Just checking if it’s still okay for me to take on adding those extra parameters to solaris.sh in this PR. I had held off earlier due to WSL uncertainties, but I’m ready to do it now if that works.
Also, I’ll continue with the “generate then clean up” approach for SBOM checksums, generate the SHA256 for the metadata and remove the .sha256.txt file afterward, so we have correct hashes without leftover files.

sxa · 2025-12-29T13:58:53Z

Hey @sxa , Just checking if it’s still okay for me to take on adding those extra parameters to solaris.sh in this PR. I had held off earlier due to WSL uncertainties, but I’m ready to do it now if that works. Also, I’ll continue with the “generate then clean up” approach for SBOM checksums, generate the SHA256 for the metadata and remove the .sha256.txt file afterward, so we have correct hashes without leftover files.

Yep - please go ahead with those changes :-)

SehrishHussain · 2025-12-30T04:19:16Z

@sxa Can you confirm the changes.

sxa · 2025-12-30T17:31:54Z

We'll need the changes from #4345 in - I've tagged @andrew-m-leonard so hopefully he can approve and so you can rebase on those changes. If not, you can just make those changes in your PR so I can test it properly - it doesn't get as far as trying to create the SBoM without those other changes unfortunately.

andrew-m-leonard · 2025-12-31T09:19:48Z

We'll need the changes from #4345 in - I've tagged @andrew-m-leonard so hopefully he can approve and so you can rebase on those changes. If not, you can just make those changes in your PR so I can test it properly - it doesn't get as far as trying to create the SBoM without those other changes unfortunately.

@SehrishHussain I've approved and merged #4345 so you can rebase your PR now

SehrishHussain · 2025-12-31T13:56:40Z

@andrew-m-leonard Thank you! I’ve rebased this PR onto the latest main now that #4345 is merged.

sxa · 2026-01-03T19:35:04Z

https://ci.adoptium.net/job/build-scripts/job/jobs/job/jdk8u/job/sxa-sehrish-solaris/15/console seemed to have left the sha256.txt files around. I'll see if I can check if I've missed anything with that job on Monday :-)

sxa · 2026-01-05T12:52:50Z

Noting that the "Skip SBOM" change went in under PR4330 and this PR now removes those changes and adds an rm -f instead.

Build 15 here was with the current changes in this PR (so it looks like the rm -f may not have worked there) and Build 16 is with the current master code (although that seems to have produced the sha256 too).

Looks like the pattern is incorrect as the sbom is not at the end before .json - here's part of t he log from build 15:

+ echo Creating metadata for OpenJDK8U-sbom_sparcv9_solaris_hotspot_8u482b05-ea.json
Creating metadata for OpenJDK8U-sbom_sparcv9_solaris_hotspot_8u482b05-ea.json
+ [[ OpenJDK8U-sbom_sparcv9_solaris_hotspot_8u482b05-ea.json == *sbom.json ]]
+ sha256sum OpenJDK8U-sbom_sparcv9_solaris_hotspot_8u482b05-ea.json

SehrishHussain · 2026-01-05T15:56:56Z

@sxa Thank you for your patience with my work. I'm wondering is it possible that the SBOM checksum may already be generated upstream (e.g. during temurin-build, SBOM tooling, or in make-adopt-build-farm.sh) and then copied locally via scp, so skipping checksum generation here does not remove an existing .sha256.txt file.

Thank you for pointing out the SBOM file name conventions, i.e. OpenJDK*-sbom_* pattern rather than ending in sbom.json, do you think updating the cleanup logic to match *-sbom_* would make the rm -f to remove the files?

sxa · 2026-01-05T17:17:11Z

do you think updating the cleanup logic to match -sbom_ would make the rm -f to remove the files?

I expect so yeah

…er .sha256.txt

SehrishHussain · 2026-01-06T14:03:02Z

@sxa can you check if the code is doing intended job!

sxa · 2026-01-07T00:25:22Z

@sxa can you check if the code is doing intended job!

The testing is taking a lot longer at the moment as it's being incredibly slow to copy the resulting builds off the Solaris machine (When I say incredibly slow it's been running for about ten hours when it should complete in about one, but isn't far away now!)

sxa · 2026-01-07T11:14:35Z

I'm pretty sure the code is ok now, but I'll try one final test before merging.

SehrishHussain · 2026-01-07T12:16:59Z

@sxa Yes please to be on safe side run one more test. Appreciate your patience!

sxa · 2026-01-08T10:47:36Z

Looks good now!

sxa

Tested and seems to be working well so I'll merge this - thanks @SehrishHussain for getting these fixes in!

SehrishHussain · 2026-01-08T11:06:29Z

@sxa the purpose of grouping echo statement into a single {...} >> file block was to remove the ShellCheck warning SC2129. Which warns about repeatedly appending to the same file using multiple >> redirections.

github-actions Bot added the testing Issues that enhance or fix our test suites label Dec 9, 2025

andrew-m-leonard approved these changes Dec 9, 2025

View reviewed changes

sxa mentioned this pull request Dec 15, 2025

Fix solaris build after move to in-tree freetype #4342

Merged

SehrishHussain force-pushed the skip-checksum-solaris-clean2 branch from c2bf4b0 to 0a003d2 Compare December 17, 2025 11:46

SehrishHussain force-pushed the skip-checksum-solaris-clean2 branch from 0a003d2 to e3c0d03 Compare December 30, 2025 04:12

SehrishHussain force-pushed the skip-checksum-solaris-clean2 branch from e3c0d03 to 166e51d Compare December 31, 2025 13:52

SehrishHussain added 2 commits January 6, 2026 18:43

fix(solaris): ensure SBOM metadata gets correct SHA256 without leftov…

3d3d8dd

…er .sha256.txt

Improved the rm command to cover the naming convention of sbom files

4f6afcb

SehrishHussain force-pushed the skip-checksum-solaris-clean2 branch from 166e51d to 4f6afcb Compare January 6, 2026 13:54

karianna approved these changes Jan 6, 2026

View reviewed changes

sxa approved these changes Jan 8, 2026

View reviewed changes

sxa merged commit 9ca299c into adoptium:master Jan 8, 2026
10 checks passed

Conversation

SehrishHussain commented Dec 9, 2025

Update Solaris build-simple.sh to handle SBOM checksums

Changes

Local Testing

Uh oh!

github-actions Bot commented Dec 9, 2025

Uh oh!

SehrishHussain commented Dec 9, 2025

Uh oh!

andrew-m-leonard left a comment

Choose a reason for hiding this comment

Uh oh!

sxa commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

judovana commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

judovana commented Dec 10, 2025

Uh oh!

sxa commented Dec 15, 2025

Uh oh!

karianna commented Dec 15, 2025

Uh oh!

sxa commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

judovana commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sxa commented Dec 19, 2025

Uh oh!

sxa commented Dec 19, 2025

Uh oh!

sxa commented Dec 22, 2025

Uh oh!

SehrishHussain commented Dec 28, 2025

Uh oh!

sxa commented Dec 29, 2025

Uh oh!

SehrishHussain commented Dec 30, 2025

Uh oh!

sxa commented Dec 30, 2025

Uh oh!

andrew-m-leonard commented Dec 31, 2025

Uh oh!

SehrishHussain commented Dec 31, 2025

Uh oh!

sxa commented Jan 3, 2026

Uh oh!

sxa commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SehrishHussain commented Jan 5, 2026

Uh oh!

sxa commented Jan 5, 2026

Uh oh!

SehrishHussain commented Jan 6, 2026

Uh oh!

sxa commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sxa commented Jan 7, 2026

Uh oh!

SehrishHussain commented Jan 7, 2026

Uh oh!

sxa commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sxa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SehrishHussain commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

sxa commented Dec 9, 2025 •

edited

Loading

judovana commented Dec 10, 2025 •

edited

Loading

sxa commented Dec 16, 2025 •

edited

Loading

judovana commented Dec 16, 2025 •

edited

Loading

sxa commented Jan 5, 2026 •

edited

Loading

sxa commented Jan 7, 2026 •

edited

Loading

sxa commented Jan 8, 2026 •

edited

Loading