Artifact checksum is changed after adding env variable in Azure Pipeline

Help/Discuss
1

Hi,
In our project we publish several libraries into Azure Feed. Before we publish new library version we fetch the checksum for the latest version and compare it with the current checksum calculated by Gradle and stored in build/publications/library/module.json.

In our plugin we also set several parameters that guarantees deterministic jar building:

                    jar.setPreserveFileTimestamps(false);
                    jar.setReproducibleFileOrder(true);
                    jar.dirPermissions(p -> p.unix("rwxr-xr-x"));
                    jar.filePermissions(p -> p.unix("rw-r--r--"));

Everything was working great until I changed Azure pipeline Gradle task ‘build’ adding:

env:
  SYSTEM_ACCESSTOKEN: $(System.AccessToken)

This small change initiated returning different checksum for the same binary (nothing changed in the code). Anyone knows why? and how to avoid it in a smart way ?

2

I’m not sure where you see a Gradle part in your question.
How is the “checksum” calculated?
If there is really a difference in the created JARs, get them both and compare them to find where the difference is.
Gradle should imho not behave any different just because the environment variable SYSTEM_ACCESSTOKEN is set or not, unless you have some build script or plugin that responds to it.