3.28.1: `java.util.zip.ZipException: duplicate entry` in Quarkus generated jar(s)

[snazy]

Describe the bug

For Quarkus 3.28.1, CI reports j,u.z.ZipException: duplicate entry... errors for every quarkusBuild Gradle task execution. 3.27.0 looks fine.

Renovate Quarkus 3.28.1 bump PR. Can be reproduced locally as well.

The issue is not particularly in the quarkusBuild task implementation, but raised in a custom Gradle code to make the quarkus-run.jar, generated-bytecode.jar and transformed-bytecode.jar files a (bit more) reproducible by re-recreating those with a fixed file modification timestamp for all zip entries.

However, the exception is thrown because there is a duplicate entry in at least one of the jars created by Quarkus.

In the particular case it is duplicate entry: io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$$CMImpl.class.

Reproducer: checkout the renovate-PR branch, run ./gradlew :polaris-server:quarkusBuild --stacktrace.

The above works fine up to Quarkus 3.27.0.

Noting: the ZipException is not raised from Quarkus code, but our custom code, but the duplicate ZIP entry in the Quarkus generated jar is real.

From generated-bytecode.jar:

     6018  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$$CMImpl.class
     6018  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$$CMImpl.class
     2775  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$KeyCert$$CMImpl.class
     2775  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$KeyCert$$CMImpl.class
     3579  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$ProxyConfig$$CMImpl.class
     3579  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$ProxyConfig$$CMImpl.class
     2565  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$TrustCert$$CMImpl.class
     2565  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterConfig$TrustCert$$CMImpl.class
     6026  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterLogsConfig$$CMImpl.class
     6556  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterMetricsConfig$$CMImpl.class
    10065  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterRuntimeConfig$$CMImpl.class
     6030  1970-01-02 01:00   io/quarkus/opentelemetry/runtime/config/runtime/exporter/OtlpExporterTracesConfig$$CMImpl.class

(Noticed the hard-coded modification timestamp, which is nice to see :) )

[quarkus-bot]

/cc @geoand (kotlin)

[Eng-Fouad]

After #49801, #49808 and quarkusio/quarkus-fs-util#60, Quarkus should now set fixed timestamps for ZIP entries (and file permissions as well) when building Gradle projects, but:

• When using Gradle 9+, no extra configuration is needed.
• When using Gradle 8.x, you need these configurations:

tasks.withType<AbstractArchiveTask>().configureEach {
    isPreserveFileTimestamps = false
    isReproducibleFileOrder = true
}

Try that without the custom Gradle code. No idea about the duplicated entries though.

---

Edit:

Ah, nvm, I just saw your PR: apache/polaris#2667

[snazy]

@Eng-Fouad Yea - there's also this piece pulled in by all projects. But that doesn't apply to the mentioned jars, which are generated by Quarkus, not Gradle.

[gsmet]

I confirm I can reproduce the issue even with a simple Maven project:

     6250  09-25-2025 09:25   io/quarkus/vertx/http/runtime/ServerLimitsConfig$$CMImpl.class
     6250  09-25-2025 09:25   io/quarkus/vertx/http/runtime/ServerLimitsConfig$$CMImpl.class

Note all entries are duplicated, which is extremely odd.

[gsmet]

I'm not sure exactly why yet but we are generating some of the config classes several times:

      2 Generated resource: io.quarkus.vertx.http.runtime.AuthRuntimeConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.BodyConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.CertificateConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.cors.CORSConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.FilterConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.FormAuthConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.HeaderConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.MultiPartConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.ProxyConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.ServerLimitsConfig$$CMImpl
      2 Generated resource: io.quarkus.vertx.http.runtime.ServerSslConfig$$CMImpl
      3 Generated resource: io.quarkus.vertx.http.runtime.PolicyConfig$$CMImpl
      3 Generated resource: io.quarkus.vertx.http.runtime.PolicyMappingConfig$$CMImpl

The previous implementation was deduplicating them by accident. This is not the case anymore.

[gsmet]

#50278 fixes it, thanks for the detailed report.

[Eng-Fouad]

@Eng-Fouad Yea - there's also this piece pulled in by all projects. But that doesn't apply to the mentioned jars, which are generated by Quarkus, not Gradle.

isPreserveFileTimestamps is being used by Quarkus.

quarkus/devtools/gradle/gradle-application-plugin/src/main/java/io/quarkus/gradle/tasks/QuarkusBuildTask.java

Line 70 in eb0b616

.map(Jar::isPreserveFileTimestamps)