[PR] Fixed: init-gradle-wrapper installs a wrapper jar that does not match the published checksum (OFBIZ-13699) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak opened a new pull request, #2374:
URL: https://github.com/apache/ofbiz-framework/pull/2374

   Fixed: init-gradle-wrapper installs a wrapper jar that does not match the published checksum (OFBIZ-13699)
   
   init-gradle-wrapper.sh and init-gradle-wrapper.ps1 downloaded gradle-wrapper.jar from the gradle/gradle git tag of the Gradle version, but that jar is only the bootstrap wrapper Gradle builds itself with, and it is not always the released jar whose checksum Gradle publishes. For Gradle 8.14.6 and 9.8.1 the tag still holds the previous version's jar, so the checksum verification fails and the Dependabot bump to 8.14.6, which fixes the high-severity GHSA-j5m7-59rp-24f5, cannot pass CI. The released jar is nested in the Gradle distribution (gradle-<version>/lib/plugins/gradle-wrapper-main-<version>.jar contains gradle-wrapper.jar), so both scripts now download gradle-<version>-bin.zip into a temporary directory, verify it against its published checksum, extract the nested jar (with unzip or, when it is missing, the jar tool of the JDK) and verify it against the published wrapper checksum as before. The temporary directory is removed on exit.
   
   The scripts also no longer build a tag name from the version, so releases without a patch number (for example 8.14, whose tag is v8.14.0) no longer fail with a 404, and the wget branch of the shell script, which could never succeed because it looked for a status line that wget -q does not print, now uses wget's exit status.
   
   The cost is a download of the distribution (about 140 MB) when the jar is missing or does not match, which Gradle then does again on the first ./gradlew run.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fixed: init-gradle-wrapper installs a wrapper jar that does not match the published checksum (OFBIZ-13699) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak merged PR #2374:
URL: https://github.com/apache/ofbiz-framework/pull/2374


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org