SpringBoot Deterministic ordering in classpath.idx based on Gradle dependencies order no longer works, redux

You closed https://github.com/spring-projects/spring-boot/issues/30355, saying it's a Gradle problem, but I don't understand what you mean.

The reproducible example in the zip has a build.gradle with dependencies like this:

dependencies {
    implementation "org.bouncycastle:bc-fips:${bouncyCastleFipsVersion}"
    implementation "org.bouncycastle:bcpkix-jdk15on:${bouncyCastleVersion}"
    implementation "org.bouncycastle:bcprov-jdk15on:${bouncyCastleVersion}"

    implementation "org.springframework.data:spring-data-commons:${springDataCommonsVersion}"
    implementation "org.springframework.boot:spring-boot-starter-web:${springBootVersion}"
    implementation "org.springframework.boot:spring-boot-starter-jersey:${springBootVersion}"
    implementation "org.springframework.boot:spring-boot-starter-actuator:${springBootVersion}"
    implementation "org.springframework.boot:spring-boot-starter-validation:${springBootVersion}"
    implementation "org.springframework.boot:spring-boot-properties-migrator:${springBootVersion}"

    // TODO: Why does deleting this fix the out-of-order problem?
    implementation "com.box:box-java-sdk:${boxJavaSdkVersion}"
}

The classpath.idx file you generate starts like this:

- "BOOT-INF/lib/bc-fips-1.0.2.1.jar"
- "BOOT-INF/lib/box-java-sdk-3.1.2.jar"
- "BOOT-INF/lib/bcpkix-jdk15on-1.57.jar"
- "BOOT-INF/lib/bcprov-jdk15on-1.57.jar"

Isn't that Spring Boot's problem?

Comment From: wilkinsona

Isn't that Spring Boot's problem?

No, I don't think so.

As I tried to explain on #30355, the order of the file in the classpath index file is determined by the ordering of the runtime classpath. It's Gradle that determines this ordering. You have also opened https://github.com/gradle/gradle/issues/20286 which the Gradle team have labelled as a bug. It also contains some examples that reproduces the problem with no involvement from Spring Boot. In short, this will have to be resolved in Gradle as it appears that there's a problem with certain dependencies adversely affecting the expected classpath ordering.