[
https://issues.apache.org/jira/browse/KAFKA-21299?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dejan Stojadinović updated KAFKA-21299:
---------------------------------------
Issue Type: Task (was: Bug)
> Upgrade Gradle to 9.8.1 (security fix) and fetch the wrapper jar from a
> pinned commit
> -------------------------------------------------------------------------------------
>
> Key: KAFKA-21299
> URL: https://issues.apache.org/jira/browse/KAFKA-21299
> Project: Kafka
> Issue Type: Task
> Components: build
> Reporter: Dejan Stojadinović
> Assignee: Dejan Stojadinović
> Priority: Major
> Labels: Gradle, advisory, checksum, gradle, security
>
> (!) Note: this is also addressing security advisory: *Failure to disable
> repositories failing to establish an SSL connection can expose builds to
> malicious artifacts*
> {quote}
> _When resolving dependencies, Gradle searches repositories in declaration
> order. If it encounters connection errors, Gradle will disable the repository
> and fail dependency resolution. This is necessary for both reproducibility
> and security reasons to prevent dependencies from being resolved from other
> repositories without warning._
> {quote}
> *Scope:*
> * Upgrades Gradle from 9.7.1 to 9.8.1 ( ⚠️ addresses
> [https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5])
> * Fetches the Gradle wrapper jar from a pinned gradle/gradle commit: the
> {{v9.8.1}} tag contains a jar that doesn't match the published 9.8.1 checksum
>
> TLDR: *wrapperJarUrl* in wrapper.gradle file can't be used to fetch Gradle
> 9.8.1 wrapper jar because the v9.8.1 git tag contains the 9.8.0 wrapper jar
> (the bootstrap jar Gradle uses to build itself) i.e. v9.8.0 and v9.8.1 tags
> contain identical jars:
> {code:java}
> dejan@home:~$ date
> Sat 17 Oct 09:17:07 CEST 2026
> dejan@home:~$ curl -sL
> https://raw.githubusercontent.com/gradle/gradle/v9.7.1/gradle/wrapper/gradle-wrapper.jar
> | shasum -a 256
> 7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d -
> dejan@home:~$ curl -sL
> https://raw.githubusercontent.com/gradle/gradle/v9.8.0/gradle/wrapper/gradle-wrapper.jar
> | shasum -a 256
> 238e777fcddd7e34f9708186085def2abd6e08e658505b38718d79d74c21abd5 -
> dejan@home:~$ curl -sL
> https://raw.githubusercontent.com/gradle/gradle/v9.8.1/gradle/wrapper/gradle-wrapper.jar
> | shasum -a 256
> 238e777fcddd7e34f9708186085def2abd6e08e658505b38718d79d74c21abd5 -
> dejan@home:~$ date
> Sat 17 Oct 09:17:51 CEST 2026
> dejan@home:~$
> {code}
>
> {*}Note: this is not a bug on a Gradle side{*}; both
> [https://gradle.org/release-checksums] and/or
> [https://services.gradle.org/distributions] are showing proper SHA sums:
> * 9.7.1: 7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d
> * 9.8.0: 238e777fcddd7e34f9708186085def2abd6e08e658505b38718d79d74c21abd5
> * 9.8.1: 3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98
> {*}Related Gradle issue{*}:
> [https://github.com/gradle/gradle/issues/39471#issuecomment-6189156726]
> *How to reproduce this on Kafka side:*
> # try to upgrade Gradle version from 9.7.1 to 9.8.1 (follow manual in
> kafka/gradle/wrapper/README.md)
> # try to execute Gradle command, for example: *./gradlew clean*
> ** every *odd* (1st, 3rd, 5th, etc) execution fails with "Unable to access
> jarfile" (the wrapper jar fails checksum verification and gets deleted)
> ** every *even* (2nd, 4th, 6th) execution passes (the wrapper jar is
> downloaded again from the v9.8.1 tag and executed without verification)
> *Upgrade process:*
> {code:java}
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:31:32 CEST 2026
> dejan@home:~/kafka$ git log -2 --oneline
> 65566690ca1 (HEAD -> Gradle-9.8.1-yet-another-try, upstream/trunk,
> upstream/HEAD) MINOR: Don't block on position() when advancing standby
> restored offsets (#23841)
> 59046aecc31 KAFKA-21289 Fix release.py stage-docs for Hugo kafka-site (#23833)
> dejan@home:~/kafka$ git status
> On branch Gradle-9.8.1-yet-another-try
> nothing to commit, working tree clean
> dejan@home:~/kafka$ git diff
> diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
> index d670f3658dd..e82ce56aafe 100644
> --- a/gradle/dependencies.gradle
> +++ b/gradle/dependencies.gradle
> @@ -58,7 +58,7 @@ versions += [
> commonsValidator: "1.11.0",
> commonsNet: "3.13.0",
> classgraph: "4.8.196",
> - gradle: "9.7.1",
> + gradle: "9.8.1",
> httpclient: "4.5.14",
> jackson: "2.22.3",
> jacksonAnnotations: "2.22",
> diff --git a/wrapper.gradle b/wrapper.gradle
> index 2f7a1dc3245..364ed15fb91 100644
> --- a/wrapper.gradle
> +++ b/wrapper.gradle
> @@ -40,7 +40,7 @@ task bootstrapWrapper() {
> // of curl (built against OpenSSL library that doesn't support
> TLSv1.2) would fail to
> // fetch the jar.
> // IMPORTANT: This checksum **must** be updated whenever the Gradle
> version changes.
> - String wrapperChecksum =
> "7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d"
> + String wrapperChecksum =
> "3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98"
> def wrapperJarUrl =
> "https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";
>
> def bootstrapString = """
> dejan@home:~/kafka$ ./gradlew wrapper --gradle-version 9.8.1
> --distribution-type bin --gradle-distribution-sha256-sum
> dce76f55f8e251a3a1f130eb120f30b3d271de2b76c9b0729d316b5a1b6dc01f
> > Configure project :
> Starting build with version 4.5.0-SNAPSHOT (commit id 65566690) using Gradle
> 9.8.1, Java 17 and Scala 2.13.18
> Build properties: ignoreFailures=false, maxParallelForks=8,
> maxScalacThreads=8, maxTestRetries=0
> [Incubating] Problems report is available at:
> file:///home/dejan/kafka/build/reports/problems/problems-report.html
> Deprecated Gradle features were used in this build, making it incompatible
> with Gradle 10.
> You can use '--warning-mode all' to show the individual deprecation warnings
> and determine if they come from your own scripts or plugins.
> For more on this, please refer to
> https://docs.gradle.org/9.7.1/userguide/command_line_interface.html#sec:command_line_warnings
> in the Gradle documentation.
> BUILD SUCCESSFUL in 11s
> 9 actionable tasks: 9 executed
> Consider enabling configuration cache to speed up this build:
> https://docs.gradle.org/9.7.1/userguide/configuration_cache_enabling.html
> dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
> [Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
> 4 files changed, 6 insertions(+), 6 deletions(-)
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:15 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:28 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:34:41 CEST 2026
> dejan@home:~/kafka$
> {code}
> *Every odd execution (1, 3, 5) fails while every even (2,4,6) execution
> starts as expected:*
> {code:java}
> dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
> [Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
> 4 files changed, 6 insertions(+), 6 deletions(-)
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:15 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:28 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:34:41 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:39:30 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:39:43 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
