spring boot 3.2 jib build is not reproducible

[golosegor]

Environment:

• Jib version: 3.4.0
• Build tool: gradle-8.2
• OS: Ubuntu 23.10

Description of the issue: Tar build is not reproducible since spring-boot 3.2.0 verison. Below you could find a demo multi-module project to make a repro:

https://github.com/golosegor/spring-boot-3.2-build-reproducible-issue

Expected behavior:

After 2 execution tar has the same md5 hash code.

Steps to reproduce:

1. Clone the repo https://github.com/golosegor/spring-boot-3.2-build-reproducible-issue
2. Execute ./gradlew -q clean jibBuildTar && md5sum user-backend/build/jib-image.tar \ &&./gradlew -q clean jibBuildTar && md5sum user-backend/build/jib-image.tar
3. Ensure you have the different hash summs

This bug is happening since spring-boot 3.2.0. In version 3.1.7 no repro is happening.

If build is happening with buildpack - you won't see the issue. Looks like it is jib-related.

[chanseokoh]

Probably #4141 and #4131.

[golosegor]

forcing the plugin version helped, but it would be great if dependencies for jib is embeded (not sure if it is possible) so people are not facing this issue (below code snippet in kotlin dsl)

buildscript { configurations.all { resolutionStrategy { force("org.apache.commons:commons-compress:1.21") } } }

[bjornbugge]

This will probably be closed with #4142

[mpeddada1]

@golosegor Quick update: jib-gradle-plugin:3.4.2 has been release with a fix. Please let us know if this addresses your issue?