This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 2dadc449d5 Fixed: init-gradle-wrapper installs a wrapper jar that does
not match the published checksum (OFBIZ-13699)
2dadc449d5 is described below
commit 2dadc449d5637cfab2e7f2dadbe745b77a31d677
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Oct 20 13:36:19 2026 +0530
Fixed: init-gradle-wrapper installs a wrapper jar that does not match the
published checksum (OFBIZ-13699)
(cherry picked from commit 01224730005f8465a06c39eb7bd32d8c7368f07b)
---
gradle/init-gradle-wrapper.ps1 | 100 ++++++++++++++++++++++++++++++++++++++---
gradle/init-gradle-wrapper.sh | 97 +++++++++++++++++++++++++++++++++++----
2 files changed, 183 insertions(+), 14 deletions(-)
diff --git a/gradle/init-gradle-wrapper.ps1 b/gradle/init-gradle-wrapper.ps1
index 9216ab0feb..0f1404f549 100644
--- a/gradle/init-gradle-wrapper.ps1
+++ b/gradle/init-gradle-wrapper.ps1
@@ -27,6 +27,8 @@ if ($Help) {
Write-Host "The jar is not committed to the repository; run this script"
Write-Host "before using gradlew.bat for the first time."
Write-Host ""
+ Write-Host "The jar is extracted from the Gradle distribution (about 140
MB)."
+ Write-Host ""
Write-Host "Options:"
Write-Host " -Help Show this message and exit."
Write-Host " -Upgrade After downloading/verifying the jar, run"
@@ -34,8 +36,11 @@ if ($Help) {
Write-Host " to match the new Gradle version."
Write-Host ""
Write-Host "Workflow for Gradle version upgrades (e.g. from a Dependabot
PR):"
- Write-Host " 1. gradle\init-gradle-wrapper.ps1 -Upgrade"
- Write-Host " 2. Commit any changes to gradlew and gradlew.bat"
+ Write-Host " 1. Apply the version change (a Dependabot commit only edits"
+ Write-Host " gradle\wrapper\gradle-wrapper.properties)"
+ Write-Host " 2. gradle\init-gradle-wrapper.ps1 -Upgrade"
+ Write-Host " 3. Commit any changes to gradlew and gradlew.bat (patch
releases"
+ Write-Host " usually have none)"
exit 0
}
@@ -47,7 +52,8 @@ $release = [regex]::Match($distributionUrl,
'gradle-(\d+(?:\.\d+)+)-').Groups[1]
Write-Host "Gradle version: $release"
$gradleWrapperJar = "gradle\wrapper\gradle-wrapper.jar"
-$gradleWrapperUri =
"https://github.com/gradle/gradle/raw/v$release/gradle/wrapper/gradle-wrapper.jar";
+$gradleDistributionUri =
"https://services.gradle.org/distributions/gradle-$release-bin.zip";
+$gradleDistributionSha256Uri = "$gradleDistributionUri.sha256"
$gradleWrapperSha256Uri =
"https://services.gradle.org/distributions/gradle-$release-wrapper.jar.sha256";
function Get-ExpectedSha256 {
@@ -84,13 +90,95 @@ if (Test-Path $gradleWrapperJar) {
}
}
-# Download gradle-wrapper.jar from the Gradle GitHub repository
+# Get gradle-wrapper.jar from the Gradle distribution.
+#
+# The wrapper jar is not published on its own. The jar whose checksum Gradle
publishes is the one nested in the
+# distribution: gradle-<version>/lib/plugins/gradle-wrapper-main-<version>.jar
contains gradle-wrapper.jar. The
+# gradle-wrapper.jar in the git tag of gradle/gradle is only the bootstrap
wrapper Gradle builds itself with and
+# does not always match the published checksum (see
https://github.com/gradle/gradle/issues/39471).
+function Get-TextFromUri($uri) {
+ $content = (Invoke-WebRequest -Uri $uri -UseBasicParsing -ErrorAction
Stop).Content
+ if ($content -is [byte[]]) {
+ $content = [System.Text.Encoding]::ASCII.GetString($content)
+ }
+ return $content.Trim()
+}
+
+# Copy one entry of a zip (or jar) file to a destination file
+function Export-ZipEntry($zipFile, $entryName, $destinationFile) {
+ $archive = [System.IO.Compression.ZipFile]::OpenRead($zipFile)
+ try {
+ $entry = $archive.GetEntry($entryName)
+ if ($null -eq $entry) {
+ return $false
+ }
+ [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry,
$destinationFile, $true)
+ return $true
+ } finally {
+ $archive.Dispose()
+ }
+}
+
+function Save-WrapperJarFromDistribution {
+ $workDir = Join-Path ([System.IO.Path]::GetTempPath())
("ofbiz-gradle-wrapper-" + [System.Guid]::NewGuid().ToString("N"))
+ New-Item -ItemType Directory -Path $workDir | Out-Null
+ try {
+ $zip = Join-Path $workDir "gradle.zip"
+ Write-Host "Downloading gradle-$release-bin.zip (about 140 MB) to
extract the wrapper jar..."
+ # The progress bar makes Invoke-WebRequest very slow for large files
in Windows PowerShell
+ $savedProgressPreference = $ProgressPreference
+ $ProgressPreference = 'SilentlyContinue'
+ try {
+ Invoke-WebRequest -OutFile $zip -Uri $gradleDistributionUri
-UseBasicParsing -ErrorAction Stop
+ } finally {
+ $ProgressPreference = $savedProgressPreference
+ }
+
+ $expectedDistribution = Get-TextFromUri $gradleDistributionSha256Uri
+ $actualDistribution = (Get-FileHash $zip -Algorithm
SHA256).Hash.ToLower()
+ if ($actualDistribution -ne $expectedDistribution) {
+ Write-Host "Error: checksum mismatch for $gradleDistributionUri"
+ Write-Host "Expected: $expectedDistribution"
+ Write-Host "Actual: $actualDistribution"
+ return $false
+ }
+
+ Add-Type -AssemblyName System.IO.Compression.FileSystem
+ $nestedEntry =
"gradle-$release/lib/plugins/gradle-wrapper-main-$release.jar"
+ $nestedJar = Join-Path $workDir "gradle-wrapper-main.jar"
+ if (-not (Export-ZipEntry $zip $nestedEntry $nestedJar)) {
+ Write-Host "Error: could not extract $nestedEntry from the Gradle
distribution."
+ return $false
+ }
+ if (-not (Export-ZipEntry $nestedJar "gradle-wrapper.jar" (Join-Path
$workDir "gradle-wrapper.jar"))) {
+ Write-Host "Error: could not extract gradle-wrapper.jar from
$nestedEntry."
+ return $false
+ }
+ Move-Item -Force (Join-Path $workDir "gradle-wrapper.jar")
$gradleWrapperJar
+ return $true
+ } catch {
+ Write-Host "Error: $($_.Exception.Message)"
+ return $false
+ } finally {
+ Remove-Item -Recurse -Force $workDir -ErrorAction SilentlyContinue
+ }
+}
+
+Write-Host "Getting gradle-wrapper.jar from the Gradle $release
distribution..."
If ($ExecutionContext.SessionState.LanguageMode -eq "ConstrainedLanguage") {
Set-ItemProperty 'hklm:\SYSTEM\CurrentControlSet\Control\Session
Manager\Environment' -name "__PSLockdownPolicy" -Value 8
- Invoke-WebRequest -outf $gradleWrapperJar $gradleWrapperUri
+ $obtained = Save-WrapperJarFromDistribution
Set-ItemProperty 'hklm:\SYSTEM\CurrentControlSet\Control\Session
Manager\Environment' -name "__PSLockdownPolicy" -Value 4
} else {
- Invoke-WebRequest -outf $gradleWrapperJar $gradleWrapperUri
+ $obtained = Save-WrapperJarFromDistribution
+}
+if (-not $obtained) {
+ if (Test-Path $gradleWrapperJar) {
+ Remove-Item $gradleWrapperJar
+ }
+ Write-Host "Could not get gradle-wrapper.jar from $gradleDistributionUri"
+ Write-Host "Please check the logs, fix the problem and run the script
again."
+ exit 1
}
# Verify the downloaded jar against the expected checksum published by Gradle
diff --git a/gradle/init-gradle-wrapper.sh b/gradle/init-gradle-wrapper.sh
index aed0b50726..d0541c835d 100755
--- a/gradle/init-gradle-wrapper.sh
+++ b/gradle/init-gradle-wrapper.sh
@@ -41,8 +41,8 @@ downloadFile() {
HTTP_CODE=$(curl -L -o "$2" -s -w '%{http_code}' "$1")
[ "$HTTP_CODE" = "200" ]
elif [ -n "$(whereIsBinary wget)" ]; then
- wget -q -O "$2" "$1" 2>&1 | grep -q 'HTTP/1.1 200 OK'
- [ $? -eq 0 ]
+ # wget exits with a non-zero status on HTTP errors; there is no output
to inspect with -q
+ wget -q -O "$2" "$1"
else
return 1
fi
@@ -57,6 +57,73 @@ computeSha256() {
fi
}
+# Find a tool able to extract single entries from a zip file: unzip or, as a
fallback, the jar tool
+# of the JDK (which OFBiz needs anyway; some images, like the official
eclipse-temurin ones, have no unzip)
+findExtractTool() {
+ if [ -n "$(whereIsBinary unzip)" ]; then
+ echo "unzip"
+ elif [ -n "$(whereIsBinary jar)" ]; then
+ echo "jar"
+ elif [ -n "$JAVA_HOME" ] && [ -x "$JAVA_HOME/bin/jar" ]; then
+ echo "$JAVA_HOME/bin/jar"
+ fi
+}
+
+# Extract one entry from a zip (or jar) file: $1 = file, $2 = entry, $3 =
existing destination directory.
+# The file and the directory must be given as absolute paths.
+extractFromZip() {
+ if [ "$EXTRACT_TOOL" = "unzip" ]; then
+ unzip -q -o "$1" "$2" -d "$3"
+ else
+ (cd "$3" && "$EXTRACT_TOOL" xf "$1" "$2")
+ fi
+}
+
+# Get gradle-wrapper.jar from the Gradle distribution and put it in $1.
+#
+# The wrapper jar is not published on its own. The jar whose checksum Gradle
publishes is the one nested in the
+# distribution: gradle-<version>/lib/plugins/gradle-wrapper-main-<version>.jar
contains gradle-wrapper.jar. The
+# gradle-wrapper.jar in the git tag of gradle/gradle is only the bootstrap
wrapper Gradle builds itself with and
+# does not always match the published checksum (see
https://github.com/gradle/gradle/issues/39471).
+downloadWrapperJarFromDistribution() {
+ WORK_DIR=$(mktemp -d "${TMPDIR:-/tmp}/ofbiz-gradle-wrapper.XXXXXX") ||
return 1
+ trap 'rm -rf "$WORK_DIR"' EXIT
+ trap 'rm -rf "$WORK_DIR"; exit 1' INT TERM
+
+ echo "Downloading gradle-$RELEASE-bin.zip (about 140 MB) to extract the
wrapper jar..."
+ if ! downloadFile "$GRADLE_DISTRIBUTION_URI" "$WORK_DIR/gradle.zip"; then
+ echo "Download of $GRADLE_DISTRIBUTION_URI failed."
+ return 1
+ fi
+
+ EXPECTED_DISTRIBUTION_SHA256=$(downloadToStdout
"$GRADLE_DISTRIBUTION_SHA256_URI")
+ if [ -z "$EXPECTED_DISTRIBUTION_SHA256" ]; then
+ echo "Error: could not fetch checksum from
$GRADLE_DISTRIBUTION_SHA256_URI"
+ return 1
+ fi
+ ACTUAL_DISTRIBUTION_SHA256=$(computeSha256 "$WORK_DIR/gradle.zip")
+ if [ -z "$ACTUAL_DISTRIBUTION_SHA256" ]; then
+ echo "Warning: sha256sum or shasum not found, the downloaded
distribution could not be verified"
+ elif [ "$ACTUAL_DISTRIBUTION_SHA256" != "$EXPECTED_DISTRIBUTION_SHA256" ];
then
+ echo "Error: checksum mismatch for $GRADLE_DISTRIBUTION_URI"
+ echo "Expected: $EXPECTED_DISTRIBUTION_SHA256"
+ echo "Actual: $ACTUAL_DISTRIBUTION_SHA256"
+ return 1
+ fi
+
+ NESTED_JAR="gradle-$RELEASE/lib/plugins/gradle-wrapper-main-$RELEASE.jar"
+ if ! extractFromZip "$WORK_DIR/gradle.zip" "$NESTED_JAR" "$WORK_DIR"; then
+ echo "Error: could not extract $NESTED_JAR from the Gradle
distribution."
+ return 1
+ fi
+ mkdir "$WORK_DIR/wrapper"
+ if ! extractFromZip "$WORK_DIR/$NESTED_JAR" "gradle-wrapper.jar"
"$WORK_DIR/wrapper"; then
+ echo "Error: could not extract gradle-wrapper.jar from $NESTED_JAR."
+ return 1
+ fi
+ mv "$WORK_DIR/wrapper/gradle-wrapper.jar" "$1"
+}
+
UPGRADE=false
for arg in "$@"; do
@@ -68,6 +135,9 @@ for arg in "$@"; do
echo "The jar is not committed to the repository; run this script"
echo "before using ./gradlew for the first time."
echo ""
+ echo "The jar is extracted from the Gradle distribution (about 140
MB),"
+ echo "which needs unzip or the jar tool of a JDK."
+ echo ""
echo "Options:"
echo " --help Show this message and exit."
echo " --upgrade After downloading/verifying the jar, run"
@@ -75,8 +145,11 @@ for arg in "$@"; do
echo " gradlew.bat to match the new Gradle version."
echo ""
echo "Workflow for Gradle version upgrades (e.g. from a Dependabot
PR):"
- echo " 1. sh gradle/init-gradle-wrapper.sh --upgrade"
- echo " 2. Commit any changes to gradlew and gradlew.bat"
+ echo " 1. Apply the version change (a Dependabot commit only
edits"
+ echo " gradle/wrapper/gradle-wrapper.properties)"
+ echo " 2. sh gradle/init-gradle-wrapper.sh --upgrade"
+ echo " 3. Commit any changes to gradlew and gradlew.bat (patch
releases"
+ echo " usually have none)"
exit 0
;;
--upgrade)
@@ -105,7 +178,8 @@ if [ -z "$RELEASE" ]; then
fi
echo "Gradle version: $RELEASE"
-GRADLE_WRAPPER_URI="https://github.com/gradle/gradle/raw/v$RELEASE/gradle/wrapper/gradle-wrapper.jar";
+GRADLE_DISTRIBUTION_URI="https://services.gradle.org/distributions/gradle-$RELEASE-bin.zip";
+GRADLE_DISTRIBUTION_SHA256_URI="$GRADLE_DISTRIBUTION_URI.sha256"
GRADLE_WRAPPER_SHA256_URI="https://services.gradle.org/distributions/gradle-$RELEASE-wrapper.jar.sha256";
# If gradle-wrapper.jar already exists, verify its checksum before deciding to
skip or re-download
@@ -140,10 +214,17 @@ if [ -z "$(whereIsBinary curl)" ] && [ -z
"$(whereIsBinary wget)" ]; then
exit 1
fi
-echo "Downloading gradle-wrapper.jar..."
-if ! downloadFile "$GRADLE_WRAPPER_URI" "$GRADLE_WRAPPER_JAR"; then
+# Ensure a tool to extract the jar from the distribution is available
+EXTRACT_TOOL=$(findExtractTool)
+if [ -z "$EXTRACT_TOOL" ]; then
+ echo "unzip or the jar tool of a JDK (found through JAVA_HOME) not found,
please install one of them or install yourself gradle (for more information see
README.md or https://gradle.org/install)"
+ exit 1
+fi
+
+echo "Getting gradle-wrapper.jar from the Gradle $RELEASE distribution..."
+if ! downloadWrapperJarFromDistribution "$GRADLE_WRAPPER_JAR"; then
rm -f "$GRADLE_WRAPPER_JAR"
- echo "Download of gradle-wrapper.jar from $GRADLE_WRAPPER_URI failed."
+ echo "Could not get gradle-wrapper.jar from $GRADLE_DISTRIBUTION_URI"
echo "Please check the logs, fix the problem and run the script again."
exit 1
fi
