Resolution of productionRuntimeClasspath configuration may select the wrong variant and contain a dependency's source jar

[cwiejack]

Hi,

The configuration productionRuntimeClasspath provided by the spring boot gradle plugin contains the sources jar of the dependency io.github.oshai:kotlin-logging-jvm:5.1.0 instead of the "real" jar.

All other third party jars are correct, only the kotlin-logging-jvm jar seems to be affected. I tested with different versions down to 4.0.0 all with the same result.

I tested with Spring Boot 3.1.5 and 3.2.0-RC2 on Mac M1 macOs 14.1.

You find a demo attached to this issue.
I created a task which copies the dependencies of productionRuntimeClasspath and runtimeClasspath into seperate folders. You can use ./gradlew copyAllDeps to reproduce on attached example project.

In build/allLibs/productionRuntime you find the sources jar of kotlin-logging-jvm and in build/allLibs/runtime everything is as expected.

logging-source.zip

Regards
Christian

[wilkinsona]

Thanks for the sample, @cwiejack.

You can work around the problem by adding an attribute to the productionRuntimeClasspath:

configurations {
	"productionRuntimeClasspath" {
		attributes {
			attribute(Category.CATEGORY_ATTRIBUTE, objects.named(Category::class, Category.LIBRARY))
		}
	}
}

The underlying bug exists in 2.7.x and later. However, given the ease with which a workaround can be applied, the risk of regression when configuring attributes, and that we're nearing EoL for 2.7.x and 3.0.x, I am going to fix it in 3.1.x and later.