This will require stripping out or otherwise dealing with file timestamps, etc. The end condition here is that if two different computers both execute a build of a java package (like meta_tools.release), with the exact same JDK version, then they should produce identical output (sha1s match).