Skip to content

MINOR: new checksum verification in gradlew #20658

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Oct 17, 2025
Merged

MINOR: new checksum verification in gradlew #20658

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
461e8e3
revert JVM options and CLASSPATH
joshua2519 Oct 8, 2025
c0b0428
revise comments
joshua2519 Oct 8, 2025
002b8ca
Revert "revise comments"
joshua2519 Oct 10, 2025
199f8f9
Revert "revert JVM options and CLASSPATH"
joshua2519 Oct 10, 2025
3a0fe97
verifying the version of wrapper jar
joshua2519 Oct 10, 2025
1d95c06
Merge remote-tracking branch 'upstream/trunk' into MINOR-revert-gradlew
joshua2519 Oct 10, 2025
5c93680
hardcode required checksum and add comments
joshua2519 Oct 10, 2025
673dab0
add break
joshua2519 Oct 11, 2025
1512bc9
Adjust the handling method when there is no checksum tool
joshua2519 Oct 13, 2025
5cf0f6f
Merge remote-tracking branch 'upstream/trunk' into MINOR-revert-gradlew
joshua2519 Oct 13, 2025
039e08c
skip checksum if no tools
joshua2519 Oct 14, 2025
3ab92f0
fix comments
joshua2519 Oct 17, 2025
f8fe4cb
Merge remote-tracking branch 'upstream/trunk' into MINOR-revert-gradlew
joshua2519 Oct 17, 2025
0bf201c
fix comments
joshua2519 Oct 17, 2025
4698956
merge url and move checksum variable
joshua2519 Oct 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions gradlew
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,7 @@ fi


# Loop in case we encounter an error.
REQUIRED_WRAPPER_JAR_CHECKSUM="76805e32c009c0cf0dd5d206bddc9fb22ea42e84db904b764f3047de095493f3"
for attempt in 1 2 3; do
if [ ! -e "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" ]; then
if ! curl -s -S --retry 3 -L -o "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" "https://raw.githubusercontent.com/gradle/gradle/v9.1.0/gradle/wrapper/gradle-wrapper.jar"; then
Expand All @@ -209,6 +210,26 @@ for attempt in 1 2 3; do
sleep 5
continue
fi
else
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This branch causes the unnecessary loops, right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes
Could it be better to add a condition to break the loop?

# Verify checksum of existing wrapper JAR.
# This prevents developers from running into incompatibility issues when using an outdated wrapper JAR after a Gradle upgrade.
# Use sha256sum or shasum, whichever is available.
if command -v sha256sum >/dev/null 2>&1; then
LOCAL_WRAPPER_JAR_CHECKSUM=$(sha256sum "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" | awk '{print $1}')
elif command -v shasum >/dev/null 2>&1; then
LOCAL_WRAPPER_JAR_CHECKSUM=$(shasum -a 256 "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" | awk '{print $1}')
else
# If no checksum tool is found, this verification is skipped .
warn "Cannot find sha256sum or shasum to verify wrapper JAR."
break
fi

# If the local checksum does not match the required checksum, delete the JAR to force re-download.
if [ "$LOCAL_WRAPPER_JAR_CHECKSUM" != "$REQUIRED_WRAPPER_JAR_CHECKSUM" ] ; then
rm -f "$APP_HOME/gradle/wrapper/gradle-wrapper.jar"
else
break
fi
fi
done

Expand Down
26 changes: 24 additions & 2 deletions wrapper.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,11 +39,13 @@ task bootstrapWrapper() {
// github.com servers deprecated TLSv1/TLSv1.1 support some time ago, so older versions
// of curl (built against OpenSSL library that doesn't support TLSv1.2) would fail to
// fetch the jar.
def wrapperBaseUrl = "https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper"
def wrapperJarUrl = wrapperBaseUrl + "/gradle-wrapper.jar"
// IMPORTANT: This checksum **must** be updated whenever the Gradle version changes.
String wrapperChecksum = "76805e32c009c0cf0dd5d206bddc9fb22ea42e84db904b764f3047de095493f3"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you please merge wrapperBaseUrl with wrapperJarUrl and then move wrapperChecksum up to line#41? Doing so would remind future developers to update both variables

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

def wrapperJarUrl = "https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar"

def bootstrapString = """
# Loop in case we encounter an error.
REQUIRED_WRAPPER_JAR_CHECKSUM="$wrapperChecksum"
for attempt in 1 2 3; do
if [ ! -e "$wrapperJarPath" ]; then
if ! curl -s -S --retry 3 -L -o "$wrapperJarPath" "$wrapperJarUrl"; then
Expand All @@ -52,6 +54,26 @@ task bootstrapWrapper() {
sleep 5
continue
fi
else
# Verify checksum of existing wrapper JAR.
# This prevents developers from running into incompatibility issues when using an outdated wrapper JAR after a Gradle upgrade.
# Use sha256sum or shasum, whichever is available.
if command -v sha256sum >/dev/null 2>&1; then
LOCAL_WRAPPER_JAR_CHECKSUM=\$(sha256sum "$wrapperJarPath" | awk '{print \$1}')
elif command -v shasum >/dev/null 2>&1; then
LOCAL_WRAPPER_JAR_CHECKSUM=\$(shasum -a 256 "$wrapperJarPath" | awk '{print \$1}')
else
# If no checksum tool is found, this verification is skipped .
warn "Cannot find sha256sum or shasum to verify wrapper JAR."
break
fi

# If the local checksum does not match the required checksum, delete the JAR to force re-download.
if [ "\$LOCAL_WRAPPER_JAR_CHECKSUM" != "\$REQUIRED_WRAPPER_JAR_CHECKSUM" ] ; then
rm -f "$wrapperJarPath"
else
break
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chia7712
The loop will break once the JAR file exists and the checksum matches.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if users' local machine can't use either sha256sum or shasum?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chia7712
Thank you for pointing that out.
If no checksum tool is found, exit with an error.

fi
fi
done
""".stripIndent()
Expand Down