Currently Temurin Windows x64 is built using a bespoke Adoptium VS2022 VS_Community Edition Installer image, which we can then use locally to reproducibly re-build.
This setup however, does not allow 3rd parties/users to re-build as a trusted reproducible verification, and since VS_Community edition is only ever available as the "Current"/Latest version, older archived versions are not available, it is not possible to recreate builds by obtaining the same VS_Community version.
Microsoft have introduced the "Build-Tools" license edition, which does provide versioned releases, and is also licenses for open source and enterprise "open source" building, see: https://devblogs.microsoft.com/cppblog/updates-to-visual-studio-build-tools-license-for-c-and-cpp-open-source-projects/
Temurin could move to building using VS "Build-Tools" edition (subject to PMC and Eclipse License review), and thus enable 3rd party reproducible builds, thus providing a more secure development production.
Version downloads: https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-history#fixed-version-bootstrappers
Currently Temurin Windows x64 is built using a bespoke Adoptium VS2022 VS_Community Edition Installer image, which we can then use locally to reproducibly re-build.
This setup however, does not allow 3rd parties/users to re-build as a trusted reproducible verification, and since VS_Community edition is only ever available as the "Current"/Latest version, older archived versions are not available, it is not possible to recreate builds by obtaining the same VS_Community version.
Microsoft have introduced the "Build-Tools" license edition, which does provide versioned releases, and is also licenses for open source and enterprise "open source" building, see: https://devblogs.microsoft.com/cppblog/updates-to-visual-studio-build-tools-license-for-c-and-cpp-open-source-projects/
Temurin could move to building using VS "Build-Tools" edition (subject to PMC and Eclipse License review), and thus enable 3rd party reproducible builds, thus providing a more secure development production.
Version downloads: https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-history#fixed-version-bootstrappers