Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Gradle wrapper to use correct files #242

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

asos-edgeorge
Copy link
Contributor

Background

The local Gradle wrapper-related files within the project do not match the expected files for the Gradle version specified within the gradle-wrapper.properties file

distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip

This is likely occurring as the expected ./gradlew wrapper call was not previously used to upgrade the wrapper and the file was edited manually

To confirm this locally, you can run gradlew wrapper --gradle-version=8.7 --distribution-type=bin locally and observe there's a difference in a number of the related wrapper files

$ ./gradlew wrapper --gradle-version=8.7 --distribution-type=bin

# [Truncated]
BUILD SUCCESSFUL in 5s
4 actionable tasks: 2 executed, 2 up-to-date 

$ git status --porcelain
 M gradle/wrapper/gradle-wrapper.jar
 M gradle/wrapper/gradle-wrapper.properties
 M gradlew
 M gradlew.bat

What I've changed

This change contains the result of running the following command:

./gradlew wrapper --gradle-version=8.7 --distribution-type=bin --gradle-distribution-sha256-sum=544c35d6bd849ae8a5ed0bcea39ba677dc40f49df7d1835561582da2009b961d

Running the above locally within the project will ensure the relevant Gradle wrapper files for Gradle 8.7 are added.

Additionally, by providing the expected SHA-256 checksum for the Gradle 8.7 distribution (source) in this way, a distributionSha256Sum property is created within gradle-wrapper.properties which provides additional protection against Gradle supply chain attacks by ensuring future downloads via the distributionUrl are matched against the checksum and failing the builds otherwise.

See this post and relevant docs for more information.

Any questions, feel free to ask! ✨

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant