[jira] [Closed] (OFBIZ-13699) init-gradle-wrapper installs a wrapper jar that does not match the checksum Gradle publishes

["Mridul Pathak (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-13699?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mridul Pathak closed OFBIZ-13699.
---------------------------------
    Fix Version/s: Upcoming Branch
                   24.09.08
       Resolution: Fixed

> init-gradle-wrapper installs a wrapper jar that does not match the checksum Gradle publishes
> --------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13699
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13699
>             Project: OFBiz
>          Issue Type: Bug
>          Components: Gradle
>    Affects Versions: Upcoming Branch, 24.09.07
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Major
>             Fix For: Upcoming Branch, 24.09.08
>
>
> h3. Problem
> {{gradle/init-gradle-wrapper.sh}} and {{gradle/init-gradle-wrapper.ps1}} download {{gradle-wrapper.jar}} from the {{gradle/gradle}} git tag of the Gradle version and verify it against the checksum published at services.gradle.org. That jar is only the bootstrap wrapper Gradle builds itself with, and it is not always the released jar: for Gradle 8.14.6 (and 9.8.1) the tag still contains the previous version's jar, so the verification fails with "checksum mismatch". As a result the Dependabot bump to Gradle 8.14.6, which fixes the high-severity advisory GHSA-j5m7-59rp-24f5, cannot pass CI on trunk or release24.09, and a fresh setup would fail the same way after the bump is merged.
> Two smaller defects in the same scripts: releases without a patch number (for example 8.14, whose tag is {{v8.14.0}}) fail with a 404 because the script requests the tag {{v8.14}}, and the wget branch of the shell script can never succeed because it looks for a status line that {{wget -q}} does not print.
> h3. Proposed fix
> The released jar is nested in the Gradle distribution ({{gradle-<version>/lib/plugins/gradle-wrapper-main-<version>.jar}} contains {{gradle-wrapper.jar}}), so both scripts download {{gradle-<version>-bin.zip}} into a temporary directory, verify it against its published checksum, extract the nested jar (with {{unzip}} or, when it is missing, the {{jar}} tool of the JDK) and verify it against the published wrapper checksum as before. This costs a download of about 140 MB when the jar is missing or does not match. The wget branch is fixed to use wget's exit status.
> See also https://github.com/gradle/gradle/issues/39471 (closed: the tag holding the bootstrap jar is expected).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)