title: How to check if binaries are built from particular sources
body: <p>The legacy project I am working on includes some external library in a form of set of binary jar files. We decided that for analysis and potential patching, we want to receive sources of this library, use them to build new binaries and after detailed and long enough regression testing switch to these binaries.</p>
  
  <p>Assume that we have already retrieved and built the sources (I am actually in planning phase). Before real testing, I would like to perform some "compatibility checks" to exclude possibility that the sources represent something dramatically different from what is in the "old" binaries.</p>
  
  <p>Using the <code>javap</code> tool I was able to extract the version of JDK used for compilation (at least I believe it is the version of JDK). It says, the binaries were built using major version 46 and minor 0. According to <a href="http://javapapers.com/core-java/how-to-find-java-the-compiler-target-version-from-a-java-class-file/" rel="nofollow">this article</a> it maps to JDK 1.2.</p>
  
  <p>Assume that the same JDK would be used for sources compilation.</p>
  
  <p>The <strong>question</strong> is:
  Is there a reliable and possibly effective method of verification if both of these binaries are built from the same sources? I would like to know if all method signatures and class definitions are identical and if most or maybe all of method implementations are identical/similar.</p>
  
  <p>The library is pretty big, so I think that detailed analysis of decompiled binaries may be not an option.</p>