Reproducible comparing using sbom json file got fatal: Not a valid object name jdk-21.0.3+6_adopt-266-ge01a50b2cac

[sophia-guo]

Linux_repro_build_compare.sh use sbom jason file to reproduce jdk build got error message fatal: Not a valid object name jdk-21.0.3+6_adopt-266-ge01a50b2cac, which is the value of SCM_Ref in SBOM json file.

[sophia-guo]

@andrew-m-leonard The following value format of SCM Ref in SBOM file is expected?

    {
      "name" : "SCM Ref",
      "value" : "jdk-21.0.3+6_adopt-268-g7e3ae202eaf"
    },

[andrew-m-leonard]

@andrew-m-leonard The following value format of SCM Ref in SBOM file is expected?

    {
      "name" : "SCM Ref",
      "value" : "jdk-21.0.3+6_adopt-268-g7e3ae202eaf"
    },

@sophia-guo
So I think that's because the original build did not specify an SCM_REF, hence building from HEAD, so it's not building from a tag that can be precisely described..? Can you try a build which uses a specific SCM_REF ?

[sophia-guo]

Yes, that happened to build with SCM_REF="".

[sophia-guo]

@andrew-m-leonard SCM_REF="" corresponding sbom file " value" is not null. "value" : "jdk-21.0.3+6_adopt-268-g7e3ae202eaf". In this case reproducible comparison should not be supported? Should this case generate sbom file?

[andrew-m-leonard]

@andrew-m-leonard SCM_REF="" corresponding sbom file " value" is not null. "value" : "jdk-21.0.3+6_adopt-268-g7e3ae202eaf". In this case reproducible comparison should not be supported? Should this case generate sbom file?

@sophia-guo i'm not sure this is quite right, we may need to fix something there...
The "SCM Ref" in the SBOM comes from scmref.txt, which if SCM_REF is specified on the job should be identical, if SCM_REF was not specified, ie.building HEAD, then scmref.txt and thus SBOM->"SCM Ref" comes from a "git describe...", and I think the short SHA at the end, ie."g7e3ae202eaf" should be able to be checked out?