GoogleContainerTools
spring boot 3.2 jib build is not reproducible
Environment:
- Jib version: 3.4.0
- Build tool: gradle-8.2
- OS: Ubuntu 23.10
Description of the issue: Tar build is not reproducible since spring-boot 3.2.0 verison. Below you could find a demo multi-module project to make a repro:
https://github.com/golosegor/spring-boot-3.2-build-reproducible-issue
Expected behavior:
After 2 execution tar has the same md5 hash code.
Steps to reproduce:
- Clone the repo https://github.com/golosegor/spring-boot-3.2-build-reproducible-issue
- Execute ./gradlew -q clean jibBuildTar && md5sum user-backend/build/jib-image.tar
&&./gradlew -q clean jibBuildTar && md5sum user-backend/build/jib-image.tar - Ensure you have the different hash summs
This bug is happening since spring-boot 3.2.0. In version 3.1.7 no repro is happening.
If build is happening with buildpack - you won't see the issue. Looks like it is jib-related.
forcing the plugin version helped, but it would be great if dependencies for jib is embeded (not sure if it is possible) so people are not facing this issue (below code snippet in kotlin dsl)
buildscript { configurations.all { resolutionStrategy { force("org.apache.commons:commons-compress:1.21") } } }
