Merge branch 'master' into dockerclient_javacontainerbuilder

.allstar/binary_artifacts.yaml

@@ -0,0 +1,8 @@
+# Ignore reason: jars are used for testing purposes only
+ignorePaths:
+  - jib-cli/src/integration-test/resources/jarTest/standard/dependency1.jar
+  - jib-cli/src/integration-test/resources/jarTest/standard/directory/dependency2.jar
+  - jib-cli/src/integration-test/resources/jarTest/standard/jarWithCp.jar
+  - jib-cli/src/integration-test/resources/jarTest/standard/noDependencyJar.jar
+  - jib-gradle-plugin/src/integration-test/resources/gradle/projects/default-target/libs/dependency-1.0.0.jar
+  - jib-gradle-plugin/src/integration-test/resources/gradle/projects/simple/libs/dependency-1.0.0.jar

.github/workflows/gradle-wrapper-validation.yml

@@ -6,5 +6,5 @@ jobs:
     name: "Gradle wrapper validation"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: gradle/wrapper-validation-action@v1.0.6
+      - uses: actions/checkout@v4
+      - uses: gradle/wrapper-validation-action@v1.1.0

.github/workflows/jib-cli-release.yml

@@ -16,7 +16,7 @@ jobs:
       upload_url: ${{ steps.create-release.outputs.upload_url }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Build project
         run: |
@@ -99,7 +99,7 @@ jobs:
           asset_content_type: text/plain
 
       - name: Create Jib CLI release checklist issue
-        uses: JasonEtco/[email protected].1
+        uses: JasonEtco/[email protected].2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_NAME: v${{ github.event.inputs.release_version }}-cli
@@ -117,7 +117,7 @@ jobs:
       actions: read # To read the workflow path.
       id-token: write # To sign the provenance.
       contents: write # To add assets to a release.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.7.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
     with:
       base64-subjects: "${{ needs.release.outputs.hashes }}"
 

.github/workflows/prepare-release.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Check input
         run: |
@@ -92,7 +92,7 @@ jobs:
             See [CHANGELOG.md](https://github.com/GoogleContainerTools/jib/blob/master/jib-${{ github.event.inputs.project }}-plugin/CHANGELOG.md) for more details.
 
       - name: Create Maven/Gradle release checklist issue
-        uses: JasonEtco/[email protected].1
+        uses: JasonEtco/[email protected].2
         if: ${{ github.event.inputs.project == 'maven' || github.event.inputs.project == 'gradle' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -121,7 +121,7 @@ jobs:
             See [CHANGELOG.md](https://github.com/GoogleContainerTools/jib/blob/master/jib-core/CHANGELOG.md) for more details.
 
       - name: Create Core release checklist issue
-        uses: JasonEtco/[email protected].1
+        uses: JasonEtco/[email protected].2
         if: ${{ github.event.inputs.project == 'core' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/sonar.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Get current date
         id: date
         run: echo "date=$(date +'%Y-%m-%d' --utc)" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
       - name: Set up JDK 11

.github/workflows/unit-tests.yml

@@ -17,7 +17,7 @@ jobs:
       # for gradle
       TERM: dumb
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 2
       - uses: actions/setup-java@v3

CONTRIBUTING.md

@@ -75,10 +75,14 @@ To run select integration tests, use `--tests=<testPattern>`, see [gradle docs](
 
 # Development Tips
 
+## Java version
+
+Use Java 8 or 11 for development. https://sdkman.io/ is a helpful tool to switch between Java versions.
+
 ## Configuring Eclipse
 
 Although jib is a mix of Gradle and Maven projects, we build everything using one
-unifed gradle build. There is special code to include some projects directly as
+unified gradle build. There is special code to include some projects directly as
 source, but importing your project should be pretty straight forward.
 
   1. Ensure you have installed the Gradle tooling for Eclipse, called

README.md

@@ -19,10 +19,12 @@
 
 Jib builds optimized Docker and [OCI](https://github.com/opencontainers/image-spec) images for your Java applications without a Docker daemon - and without deep mastery of Docker best-practices. It is available as plugins for [Maven](jib-maven-plugin) and [Gradle](jib-gradle-plugin) and as a Java library.
 
-[Maven](https://maven.apache.org/): See documentation for [jib-maven-plugin](jib-maven-plugin).\
-[Gradle](https://gradle.org/): See documentation for [jib-gradle-plugin](jib-gradle-plugin).\
-[Jib Core](jib-core): A general-purpose container-building library for Java.\
-[Jib CLI](jib-cli): A command-line interface for building images that uses Jib Core.
+- [Maven](https://maven.apache.org/): See documentation for [jib-maven-plugin](jib-maven-plugin).
+- [Gradle](https://gradle.org/): See documentation for [jib-gradle-plugin](jib-gradle-plugin).
+- [Jib Core](jib-core): A general-purpose container-building library for Java.
+- [Jib CLI](jib-cli): A command-line interface for building images that uses Jib Core.
+
+Jib works well with Google Cloud Build. For details, see [how to use Jib on Google Cloud Build](docs/google-cloud-build.md).
 
 For more information, check out the [official blog post](https://cloudplatform.googleblog.com/2018/07/introducing-jib-build-java-docker-images-better.html) or watch [this talk](https://www.youtube.com/watch?v=H6gR_Cv4yWI) ([slides](https://speakerdeck.com/coollog/build-containers-faster-with-jib-a-google-image-build-tool-for-java-applications)).
 

build.gradle

@@ -19,7 +19,7 @@ project.ext.dependencyStrings = [
   GOOGLE_HTTP_CLIENT: 'com.google.http-client:google-http-client:1.42.2',
   GOOGLE_HTTP_CLIENT_APACHE_V2: 'com.google.http-client:google-http-client-apache-v2:1.42.2',
   GOOGLE_AUTH_LIBRARY_OAUTH2_HTTP: 'com.google.auth:google-auth-library-oauth2-http:1.10.0',
-  GUAVA: 'com.google.guava:guava:32.0.1-jre',
+  GUAVA: 'com.google.guava:guava:32.1.2-jre',
   JSR305: 'com.google.code.findbugs:jsr305:3.0.2', // transitively pulled in by GUAVA
 
   // for Build Plan and Jib Plugins Extension API
@@ -28,19 +28,19 @@ project.ext.dependencyStrings = [
   GRADLE_EXTENSION: 'com.google.cloud.tools:jib-gradle-plugin-extension-api:0.4.0',
   MAVEN_EXTENSION: 'com.google.cloud.tools:jib-maven-plugin-extension-api:0.4.0',
 
-  COMMONS_COMPRESS: 'org.apache.commons:commons-compress:1.21',
-  ZSTD_JNI: 'com.github.luben:zstd-jni:1.5.5-4',
+  COMMONS_COMPRESS: 'org.apache.commons:commons-compress:1.26.0',
+  ZSTD_JNI: 'com.github.luben:zstd-jni:1.5.5-5',
   COMMONS_TEXT: 'org.apache.commons:commons-text:1.10.0',
   JACKSON_BOM: 'com.fasterxml.jackson:jackson-bom:2.15.2',
   JACKSON_DATABIND: 'com.fasterxml.jackson.core:jackson-databind',
   JACKSON_DATAFORMAT_YAML: 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml',
   JACKSON_DATATYPE_JSR310: 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310',
   ASM: 'org.ow2.asm:asm:9.5',
-  PICOCLI: 'info.picocli:picocli:4.7.3',
+  PICOCLI: 'info.picocli:picocli:4.7.4',
 
   MAVEN_API: 'org.apache.maven:maven-plugin-api:3.9.3',
   MAVEN_CORE: 'org.apache.maven:maven-core:3.9.3',
-  MAVEN_COMPAT: 'org.apache.maven:maven-compat:3.9.2',
+  MAVEN_COMPAT: 'org.apache.maven:maven-compat:3.9.3',
   MAVEN_PLUGIN_ANNOTATIONS: 'org.apache.maven.plugin-tools:maven-plugin-annotations:3.9.0',
 
   //test
@@ -53,7 +53,7 @@ project.ext.dependencyStrings = [
   MOCKITO_CORE: 'org.mockito:mockito-core:4.11.0',
   SISU_PLEXUS: 'org.eclipse.sisu:org.eclipse.sisu.plexus:0.3.5',
   SLF4J_API: 'org.slf4j:slf4j-api:2.0.7',
-  SLF4J_SIMPLE: 'org.slf4j:slf4j-simple:2.0.7',
+  SLF4J_SIMPLE: 'org.slf4j:slf4j-simple:2.0.9',
   SYSTEM_RULES:  'com.github.stefanbirkner:system-rules:1.19.0',
   JBCRYPT: 'org.mindrot:jbcrypt:0.4',
 ]
@@ -79,6 +79,16 @@ subprojects {
   apply plugin: 'net.ltgt.errorprone'
   apply plugin: 'jacoco'
 
+  // Guava update breaks unit tests. Workaround mentioned in https://github.com/google/guava/issues/6612#issuecomment-1614992368.
+  sourceSets.all {
+    configurations.getByName(runtimeClasspathConfigurationName) {
+      attributes.attribute(Attribute.of("org.gradle.jvm.environment", String), "standard-jvm")
+    }
+    configurations.getByName(compileClasspathConfigurationName) {
+      attributes.attribute(Attribute.of("org.gradle.jvm.environment", String), "standard-jvm")
+    }
+  }
+
   sourceCompatibility = JavaVersion.VERSION_1_8
   targetCompatibility = JavaVersion.VERSION_1_8
   compileJava.options.encoding = 'UTF-8'
@@ -166,8 +176,8 @@ subprojects {
   /* CHECKSTYLE */
 
   /* TEST CONFIG */
-  tasks.withType(Test) {
-    reports.html.setDestination file("${reporting.baseDir}/${name}")
+  tasks.withType(Test).configureEach {
+    reports.html.outputLocation = file("${reporting.baseDir}/${name}")
   }
 
   test {
@@ -180,7 +190,7 @@ subprojects {
   // testCompile project(path:':project-name', configuration:'tests')
   task testJar(type: Jar) {
     from sourceSets.test.output.classesDirs
-    classifier = 'tests'
+    archiveClassifier = 'tests'
   }
   // to import resources do: sourceSets.test.resources.srcDirs project(':project-name').sourceSets.test.resources
 
@@ -198,6 +208,8 @@ subprojects {
     integrationTest {
       java.srcDir file('src/integration-test/java')
       resources.srcDir file('src/integration-test/resources')
+      compileClasspath += sourceSets.main.output + sourceSets.test.output
+      runtimeClasspath += sourceSets.main.output + sourceSets.test.output
     }
   }
 
@@ -207,15 +219,6 @@ subprojects {
     integrationTestRuntime.extendsFrom testRuntime
   }
 
-  dependencies {
-    integrationTestImplementation sourceSets.main.output
-    integrationTestImplementation sourceSets.test.output
-    integrationTestImplementation configurations.compile
-    integrationTestImplementation configurations.testImplementation
-    integrationTestImplementation configurations.runtime
-    integrationTestImplementation configurations.testRuntime
-  }
-
   // Integration tests must be run explicitly
   task integrationTest(type: Test) {
     testClassesDirs = sourceSets.integrationTest.output.classesDirs
@@ -226,7 +229,7 @@ subprojects {
 
   task integrationTestJar(type: Jar) {
     from sourceSets.integrationTest.output.classesDirs
-    classifier = 'integration-tests'
+    archiveClassifier = 'integration-tests'
   }
 
   configurations {
@@ -280,12 +283,12 @@ subprojects {
     apply plugin: 'maven-publish'
     task sourceJar(type: Jar) {
       from sourceSets.main.allJava
-      classifier 'sources'
+      archiveClassifier = 'sources'
     }
 
     task javadocJar(type: Jar, dependsOn: javadoc) {
       from javadoc.destinationDir
-      classifier 'javadoc'
+      archiveClassifier = 'javadoc'
     }
 
     publishing {
@@ -368,7 +371,7 @@ subprojects {
   // sourceProject(Project) accepts a project and adds it as a dependency in a special manner:
   // 1. force evaluation of the project first
   // 2. add the project classes as "compileOnly" and make it available to tests in "testImplementation"
-  // 3. add the project's depedencies as "implementation"
+  // 3. add the project's dependencies as "implementation"
   // 4. remove any transitive reference of any sourceProject depenency that may have appeared
   // 5. add the project's classes to the final jar
   // Other nice effects (vs shadowJar)
@@ -420,12 +423,12 @@ subprojects {
   /* TEST COVERAGE */
   jacocoTestReport {
     reports {
-      xml.enabled true
-      html.enabled false
+      xml.required = true
+      html.required = false
     }
   }
   /* TEST COVERAGE */
-  
+
   /* INCLUDED PROJECT DEPENDENCY HELPER */
 
   /* LOCAL DEVELOPMENT HELPER TASKS */

docs/configure-gcp-credentials.md

@@ -1,6 +1,6 @@
 # Configuring Credentials for [Google Container Registry (GCR)](https://cloud.google.com/container-registry/)
 
-There are a few ways of supplying Jib with the credentials to push and pull images from your private GCR regsitry.
+There are a few ways of supplying Jib with the credentials to push and pull images from your private GCR registry.
 
 ## Using the Docker credential helper
 

docs/default_base_image.md

@@ -30,7 +30,7 @@ Some options:
 * Prevent Jib from accessing Docker Hub (after Jib cached a base image locally).
    - Pin to a specific base image using a SHA digest (for example, `jib.from.image='eclipse-temurin:11-jre@sha256:...'`).
    - Do offline building.
-   - Read a base from a local Docker deamon.
+   - Read a base from a local Docker daemon.
    - Set up a local registry, store a base image, and read it from the local registry.
 * Retry with increasing backoffs.
 

docs/faq.md

@@ -495,7 +495,7 @@ To inspect the image that is produced from the build using Docker, you can use c
 
 ### How do I specify a platform in the manifest list (or OCI index) of a base image?
 
-Newer Jib verisons added an _incubating feature_ that provides support for selecting base images with the desired platforms from a manifest list. For example,
+Newer Jib versions added an _incubating feature_ that provides support for selecting base images with the desired platforms from a manifest list. For example,
 
 ```xml
   <from>
@@ -582,7 +582,7 @@ Some other alternatives to get around the rate limits:
 * Prevent Jib from accessing Docker Hub (after Jib cached a base image locally).
    - **Pin to a specific base image using a SHA digest.** For example, `jib.from.image='eclipse-temurin:11-jre@sha256:...'`. If you are not setting a base image with a SHA digest (which is the case if you don't set `jib.from.image` at all), then every time Jib runs, it reaches out to the registry to check if the base image is up-to-date. On the other hand, if you pin to a specific image with a digest, then the image is immutable. Therefore, if Jib has cached the image once (by running Jib online once to fully cache the image), Jib will not reach out to the Docker Hub. See [this Stack Overflow answer](https://stackoverflow.com/a/61190005/1701388) for more details.
    - (Maven/Gradle plugins only) **Do offline building.** Pass `--offline` to Maven or Gradle. Before that, you need to run Jib online once to cache the image. However, `--offline` means you cannot push to a remote registry. See [this Stack Overflow answer](https://stackoverflow.com/a/61190005/1701388) for more details.
-   - **Retrieve a base image from a local Docker deamon.** Store an image to your local Docker daemon, and set, say, `jib.from.image='docker://eclipse-temurin:11-jre'`. It can be slow for an initial build where Jib has to cache the image in Jib's format. For performance reasons, we usually recommend using an image on a registry.
+   - **Retrieve a base image from a local Docker daemon.** Store an image to your local Docker daemon, and set, say, `jib.from.image='docker://eclipse-temurin:11-jre'`. It can be slow for an initial build where Jib has to cache the image in Jib's format. For performance reasons, we usually recommend using an image on a registry.
    - **Set up a local registry, store a base image, and read it from the local registry.** Setting up a local registry is as simple as running `docker run -d -p5000:5000 registry:2`, but nevertheless, the whole process is a bit involved.
 * Retry with increasing backoffs. For example, using the [`retry`](https://github.com/kadwanev/retry) tool.
 
@@ -759,7 +759,7 @@ When you're using latest Java versions to write an app (or using an old version
 Failed to execute goal com.google.cloud.tools:jib-maven-plugin:3.2.0:dockerBuild (default-cli) on project demo: Execution default-cli of goal com.google.cloud.tools:jib-maven-plugin:3.2.0:dockerBuild failed: Unsupported class file major version 61
 ```
 
-Jib uses the [ASM library](https://asm.ow2.io/) to examine compiled Java bytecode to automatically infer a main class (in other words, the class that defines `public static void main()` to start your app). In this way, if you have only one such class, Jib can automatically infer and use that class to set an image entrypoint (basically, a command to start your app). When new Java versions come out, often the ASM library version used in Jib doesn't support the new bytecode format. If this is the case, check if you are using the latest Jib. If you still get the error with the latest Jib, file a [bug](https://github.com/GoogleContainerTools/jib/issues/new/choose) to have the Jib team upgarde the ASM library.
+Jib uses the [ASM library](https://asm.ow2.io/) to examine compiled Java bytecode to automatically infer a main class (in other words, the class that defines `public static void main()` to start your app). In this way, if you have only one such class, Jib can automatically infer and use that class to set an image entrypoint (basically, a command to start your app). When new Java versions come out, often the ASM library version used in Jib doesn't support the new bytecode format. If this is the case, check if you are using the latest Jib. If you still get the error with the latest Jib, file a [bug](https://github.com/GoogleContainerTools/jib/issues/new/choose) to have the Jib team upgrade the ASM library.
 
 **Workaround**: to prevent Jib from doing auto-inference, you can manually set your desired main class via [`<container><mainClass>`](https://github.com/GoogleContainerTools/jib/tree/master/jib-maven-plugin#container-object) (for example, `<container><mainClass>com.example.your.Main</mainClass>`). As with other Jib parameters, it can be set through system/Maven properties or on the command-line (for example, `-Dcontainer.mainClass=...`).
 

docs/google-cloud-build.md

@@ -0,0 +1,33 @@
+# Jib on Google Cloud Build
+
+You can use Jib on [Google Cloud Build](https://cloud.google.com/build) in a simple step:
+
+```yaml
+steps:
+  - name: 'gcr.io/cloud-builders/javac:8'
+    entrypoint: './gradlew'
+    args: ['--console=plain', '--no-daemon', ':server:jib', '-Djib.to.image=gcr.io/$PROJECT_ID/$REPO_NAME:$COMMIT_SHA']
+```
+
+Any Java container can be used for building, not only the `gcr.io/cloud-builders/javac:*` (from [gcr.io/cloud-builders/javac](https://github.com/GoogleCloudPlatform/cloud-builders/tree/master/javac)), for example with [Temurin](https://adoptium.net/en-GB/temurin/)'s:
+
+```yaml
+steps:
+  - name: 'docker.io/library/eclipse-temurin:17'
+    entrypoint: './gradlew'
+    args: ['--console=plain', '--no-daemon', ':server:jib', '-Djib.to.image=gcr.io/$PROJECT_ID/$REPO_NAME:$COMMIT_SHA']
+```
+
+To use [Google "Distroless" Container Images](https://github.com/GoogleContainerTools/distroless) to build with Jib on Google Cloud Build, and avoid running into `Step #1: standard_init_linux.go:228: exec user process caused: no such file or directory` errors (because Google's _distroless_ containers are based on `busybox`), you have to do something like this:
+
+```yaml
+steps:
+  - name: 'gcr.io/distroless/java17-debian11:debug'
+    entrypoint: '/busybox/sh'
+    args:
+      - -c
+      - |
+        ln -s /busybox/sh /bin/sh
+        ln -s /busybox/env /usr/bin/env
+        /workspace/gradlew --console=plain --no-daemon --gradle-user-home=/home/.gradle :server:jib -Djib.to.image=gcr.io/$PROJECT_ID/$REPO_NAME:$COMMIT_SHA
+```

docs/privacy.md

@@ -11,7 +11,7 @@ and version.
 ### How to disable update checks
 
 1. set the `jib.disableUpdateChecks` system property to `true`
-2. set `disableUpdateChecks` to `true` in Jib's global config. The global config is in the following locations by default:
+2. set `disableUpdateCheck` to `true` in Jib's global config. The global config is in the following locations by default:
     * Linux: `$XDG_CONFIG_HOME/google-cloud-tools-java/jib/config.json` (if `$XDG_CONFIG_HOME` is defined), else `$HOME/.config/google-cloud-tools-java/jib/config.json`
     * Mac: `$XDG_CONFIG_HOME/Google/Jib/config.json` (if `$XDG_CONFIG_HOME` is defined), else `$HOME/Library/Preferences/Google/Jib/config.json`
     * Windows: `$XDG_CONFIG_HOME\Google\Jib\Config\config.json` (if `$XDG_CONFIG_HOME` is defined), else `%LOCALAPPDATA%\Google\Jib\Config\config.json`