How to inject a deterministic unique buildId into Gradle's java jar manifest?

I want to inject a unique 'buildId' into the java plugin's jar task's manifest (MANIFEST.MF). The requirements are:

• Unique for different builds: commit is not good enough, since there may be uncommitted changes on dev machines
• Deterministic: timestamp does not work, since Gradle will see it as a 'change' in the dependencies, and rebuild the jar even when the other dependencies don't change

I think the correct solution is to use a hash of the actual dependencies to the 'jar' task, which is 'classes', which is all of the compiled class files that will be included in the jar.

I could, in theory, create a task which takes a hash of all the classes, and injects that into the manifest.

However, Gradle is already doing this, and that is how it determines if a task is up to date. It takes a hash of the input and a hash of the output, and checks if that combo is in it's database. So, is there a way to get access to this information using some rare Gradle API, or by using reflection?

Or maybe there is some other solution?