MINOR: new checksum verification in gradlew #20658

joshua2519 · 2025-10-08T07:03:57Z

According to the
discussion
in #19513 , add a new checksum verification process to determine whether
a new wrapper JAR needs to be downloaded.

This prevents developers from running into incompatibility issues when
using an outdated wrapper JAR after a Gradle upgrade.

Reviewers: Chia-Ping Tsai [email protected]

chia7712 · 2025-10-08T07:09:37Z

Th PR description is not correct. We don't want to revert whole changes. Als, please reference to the conversation

joshua2519 · 2025-10-08T07:21:13Z

Th PR description is not correct. We don't want to revert whole changes. Als, please reference to the conversation

Done

chia7712 · 2025-10-08T07:50:03Z

@joshua2519 I have another idea that we could check the sha256sum of gradle-wrapper.jar first. If it is not the latest version, we delete it and then re-download. WDYT?

This reverts commit c0b0428.

This reverts commit 461e8e3.

joshua2519 · 2025-10-10T10:01:51Z

@joshua2519 I have another idea that we could check the sha256sum of gradle-wrapper.jar first. If it is not the latest version, we delete it and then re-download. WDYT?

@chia7712
That's a great idea!
I've added a checksum verification process. Now, if the local version of the gradle-wrapper.jar doesn't match the project's required Gradle version, the local JAR file will be deleted, forcing a download of the new version.

chia7712 · 2025-10-10T10:07:25Z

wrapper.gradle


        def bootstrapString = """
      # Loop in case we encounter an error.
+      REQUIRED_WRAPPER_JAR_CHECKSUM=\$(curl -sSL "$wrapperJarChecksumUrl")


Could you please hardcode the sha?

Thanks for that. Considering that Gradle version updates are infrequent, hardcoding the SHA is a much more efficient method than retrieving the checksum every time. I've included a code comment to ensure the checksum is also updated whenever we perform a Gradle version upgrade.

chia7712 · 2025-10-10T10:08:08Z

wrapper.gradle

            continue
          fi
+        else
+          # Verify checksum of existing wrapper JAR.


Please add comments explaining the reason for adding this mechanism

chia7712 · 2025-10-10T17:46:23Z

gradlew

      sleep 5
      continue
    fi
+  else


This branch causes the unnecessary loops, right?

Yes
Could it be better to add a condition to break the loop?

joshua2519 · 2025-10-11T08:00:07Z

wrapper.gradle

+          if [ "\$LOCAL_WRAPPER_JAR_CHECKSUM" != "\$REQUIRED_WRAPPER_JAR_CHECKSUM" ] ; then
+            rm -f "$wrapperJarPath"
+          else
+            break


@chia7712
The loop will break once the JAR file exists and the checksum matches.

What happens if users' local machine can't use either sha256sum or shasum?

@chia7712
Thank you for pointing that out.
If no checksum tool is found, exit with an error.

chia7712 · 2025-10-13T19:03:57Z

gradlew

+      LOCAL_WRAPPER_JAR_CHECKSUM=$(shasum -a 256 "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" | awk '{print $1}')
+    else
+      # If no checksum tool is found, exit with an error.
+      die "ERROR: Cannot find sha256sum or shasum to verify wrapper JAR. Please install one of these tools."


Could we just skip the sha check if there is no available tool?

chia7712 · 2025-10-16T17:08:11Z

wrapper.gradle

+          elif command -v shasum >/dev/null 2>&1; then
+            LOCAL_WRAPPER_JAR_CHECKSUM=\$(shasum -a 256 "$wrapperJarPath" | awk '{print \$1}')
+          else
+            # If no checksum tool is found, exit with an error.


If no checksum tool is found, exit with an error. this comment is out-of-date, right?

Thanks for catching this. I have fixed it.

joshua2519 · 2025-10-17T06:50:19Z

I have completed the following tests locally:

Executing ./gradlew in an environment without sha256sum and shasum displays a warn message.
After manually downloading an old version of the wrapper JAR, executing ./gradlew results in the new version of the JAR file being re-downloaded.

chia7712 · 2025-10-17T13:47:00Z

wrapper.gradle

        def wrapperBaseUrl = "https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper"
        def wrapperJarUrl = wrapperBaseUrl + "/gradle-wrapper.jar"
+        // IMPORTANT: This checksum **must** be updated whenever the Gradle version changes.
+        String wrapperChecksum = "76805e32c009c0cf0dd5d206bddc9fb22ea42e84db904b764f3047de095493f3"


Could you please merge wrapperBaseUrl with wrapperJarUrl and then move wrapperChecksum up to line#41? Doing so would remind future developers to update both variables

According to the [discussion](apache#19513 (comment)) in apache#19513 , add a new checksum verification process to determine whether a new wrapper JAR needs to be downloaded. This prevents developers from running into incompatibility issues when using an outdated wrapper JAR after a Gradle upgrade. Reviewers: Chia-Ping Tsai <[email protected]>

joshua2519 added 2 commits October 8, 2025 14:47

revert JVM options and CLASSPATH

461e8e3

revise comments

c0b0428

github-actions bot added triage PRs from the community build Gradle build or GitHub Actions small Small PRs labels Oct 8, 2025

joshua2519 mentioned this pull request Oct 8, 2025

KAFKA-19174 Gradle version upgrade 8 -->> 9 #19513

Merged

chia7712 added the ci-approved label Oct 8, 2025

joshua2519 added 4 commits October 10, 2025 15:35

Revert "revise comments"

002b8ca

This reverts commit c0b0428.

Revert "revert JVM options and CLASSPATH"

199f8f9

This reverts commit 461e8e3.

verifying the version of wrapper jar

3a0fe97

Merge remote-tracking branch 'upstream/trunk' into MINOR-revert-gradlew

1d95c06

joshua2519 changed the title ~~MINOR: Revert JVM options and CLASSPATH in gradlew~~ MINOR: verifying the wrapper JAR version in gradlew Oct 10, 2025

joshua2519 changed the title ~~MINOR: verifying the wrapper JAR version in gradlew~~ MINOR: new checksum verification in gradlew Oct 10, 2025

chia7712 reviewed Oct 10, 2025

View reviewed changes

hardcode required checksum and add comments

5c93680

chia7712 reviewed Oct 10, 2025

View reviewed changes

github-actions bot removed the triage PRs from the community label Oct 11, 2025

add break

673dab0

joshua2519 commented Oct 11, 2025

View reviewed changes

joshua2519 added 2 commits October 13, 2025 23:34

Adjust the handling method when there is no checksum tool

1512bc9

Merge remote-tracking branch 'upstream/trunk' into MINOR-revert-gradlew

5cf0f6f

chia7712 reviewed Oct 13, 2025

View reviewed changes

skip checksum if no tools

039e08c

chia7712 reviewed Oct 16, 2025

View reviewed changes

joshua2519 added 2 commits October 17, 2025 08:21

fix comments

3ab92f0

Merge remote-tracking branch 'upstream/trunk' into MINOR-revert-gradlew

f8fe4cb

fix comments

0bf201c

chia7712 reviewed Oct 17, 2025

View reviewed changes

merge url and move checksum variable

4698956

chia7712 approved these changes Oct 17, 2025

View reviewed changes

chia7712 merged commit db1ee63 into apache:trunk Oct 17, 2025
24 checks passed

MINOR: new checksum verification in gradlew #20658

MINOR: new checksum verification in gradlew #20658

Uh oh!

Conversation

joshua2519 commented Oct 8, 2025 • edited by chia7712 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chia7712 commented Oct 8, 2025

Uh oh!

joshua2519 commented Oct 8, 2025

Uh oh!

chia7712 commented Oct 8, 2025

Uh oh!

joshua2519 commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joshua2519 commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

joshua2519 commented Oct 8, 2025 •

edited by chia7712

Loading

joshua2519 commented Oct 10, 2025 •

edited

Loading

joshua2519 commented Oct 17, 2025 •

edited

Loading