Context

• MacOS
• Gradle 7.5.1
• Android Gradle Plugin 7.3.1
• Multiple APK support enabled

What happened

When assembling an application having multiple APK support, the content of the generated file output-metadata.json can vary, ABI definitions not being ordered consistently.

This has a direct impact on the build performances as cacheable Gradle tasks using this file as input won't get the same cache key generated.

Expected behavior

output-metadata.json remains identical

Steps to reproduce the problem

This is not happening constantly and I had to apply the focus plugin to be able to reproduce. I am aware of other situations where this behavior happened without the focus plugin though.

1. Clone the repository

https://github.com/jprinet/android-sample-app

2. Build the application

./gradlew clean assembleDebug

app/build/outputs/apk/debug/output-metadata.json:

https://github.com/jprinet/android-sample-app/blob/main/output-metadata-first.json

3. Set the focus one one lib

./gradlew :lib2:focus

4. Build the application

./gradlew clean assembleDebug

app/build/outputs/apk/debug/output-metadata.json:

https://github.com/jprinet/android-sample-app/blob/main/output-metadata-second.json

Is this a security related issue?

No