[
https://issues.apache.org/jira/browse/KAFKA-21299?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18128694#comment-18128694
]
Dejan Stojadinović commented on KAFKA-21299:
--------------------------------------------
Update: I pushed a new commit with no functional changes: only
*_{{gradle/wrapper/README.md}}_* and the comments in *_{{wrapper.gradle}}_* are
changed (upgrade procedure is now easier to follow).
GitHub PR is (finally :))ready for review:
[https://github.com/apache/kafka/pull/23770]
> Upgrade Gradle to 9.8.1 (security fix) and fetch the wrapper jar from a
> pinned commit
> -------------------------------------------------------------------------------------
>
> Key: KAFKA-21299
> URL: https://issues.apache.org/jira/browse/KAFKA-21299
> Project: Kafka
> Issue Type: Task
> Components: build
> Reporter: Dejan Stojadinović
> Assignee: Dejan Stojadinović
> Priority: Major
> Labels: Gradle, advisory, build, checksum, gradle, security,
> update, upgrade
>
> (!) Note: this is also addressing security advisory: *Failure to disable
> repositories failing to establish an SSL connection can expose builds to
> malicious artifacts*
> {quote}_When resolving dependencies, Gradle searches repositories in
> declaration order. If it encounters connection errors, Gradle will disable
> the repository and fail dependency resolution. This is necessary for both
> reproducibility and security reasons to prevent dependencies from being
> resolved from other repositories without warning._
> {quote}
> *Scope:*
> * Upgrades Gradle from 9.7.1 to 9.8.1 ( ⚠️ addresses
> [https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5])
> * Fetches the Gradle wrapper jar from a pinned Gradle commit: because
> {{v9.8.1}} tag contains a jar that doesn't match the published 9.8.1 checksum
>
> {color:#ff0000}*Pitfall :*{color} Kafka trunk *wrapper.gradle* pins
> *wrapperJarUrl* to a Gradle tag
> ("https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";)
> that _*may*_ contain the wrapper JAR of the previous Gradle version (i.e.
> release tag contains the bootstrap jar Gradle uses to build itself which may
> be from the previous version and then doesn't match the published wrapper
> checksum).
> *Illustration: 16 Gradle 9.x.y versions share only 8 Wrapper JARs:*
> * Gradle checksums: [https://gradle.org/release-checksums] (or
> [https://services.gradle.org/distributions])
> ||Gradle version(s)||Wrapper JAR Checksum||
> |9.8.1|3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98|
> |9.8.0|238e777fcddd7e34f9708186085def2abd6e08e658505b38718d79d74c21abd5|
> |9.7.1,
> 9.7.0|7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d|
> |9.6.1, 9.6.0, 9.5.1,
> 9.5.0|497c8c2a7e5031f6aa847f88104aa80a93532ec32ee17bdb8d1d2f67a194a9c7|
> |9.4.1,
> 9.4.0|55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c|
> |9.3.1,
> 9.3.0|b3a875ddc1f044746e1b1a55f645584505f4a10438c1afea9f15e92a7c42ec13|
> |9.2.1,
> 9.2.0|423cb469ccc0ecc31f0e4e1c309976198ccb734cdcbb7029d4bda0f18f57e8d9|
> |9.1.0,
> 9.0.0|76805e32c009c0cf0dd5d206bddc9fb22ea42e84db904b764f3047de095493f3|
> * Gradle wrapper jar git commits:
> [https://github.com/gradle/gradle/commits/master/gradle/wrapper/gradle-wrapper.jar]
> (please note that Gradle tag v9.8.1 doesn't contain commit {_}*dcc5ee0ec88
> Update to Gradle 9.8.1*{_}):
> {quote}dejan@home:~/gradle$ *date*
> Mon 19 Oct 11:24:05 CEST 2026
> dejan@home:~/gradle$ *git remote -v*
> origin [https://github.com/gradle/gradle.git] (fetch)
> origin [https://github.com/gradle/gradle.git] (push)
> dejan@home:~/gradle$ *git status*
> *HEAD detached at v9.8.1*
> nothing to commit, working tree clean
> dejan@home:~/gradle$ *git log --oneline -12 gradle/wrapper/gradle-wrapper.jar*
> *7bb5f96fca0 Update Gradle wrapper to version release-candidate*
> 8ed35c9985f Gradle 9.8.0 M1
> 17901347dad Update Gradle wrapper to version 9.7.0-rc-1
> ae5c0f4c6e9 Update Gradle wrapper to version 9.5.0-rc-1
> 112aba6448e Update wrapper to 9.5.0-milestone-7
> 5c141fb9464 Update Gradle wrapper to version release-milestone
> 11535f62912 Update wrapper to 9.4.0-milestone-4
> 308880bfbe2 Upgradlew to 9.4.0-milestone-1
> 90638756ec0 Update Gradle to 9.3.0-milestone-1
> 16145458453 Update Gradle wrapper to version 9.2.0-rc-1
> 5f992e2737e Update Gradle to 9.0.0-milestone-9
> d0e7e8baa15 Update Gradle to 9.0-milestone-6
> dejan@home:~/gradle$ git checkout master
> Previous HEAD position was 39daf39feb6 Release notes for Gradle 9.8.1 (#39409)
> Switched to branch 'master'
> Your branch is up-to-date with 'origin/master'.
> dejan@home:~/gradle$ *git log --oneline -12 gradle/wrapper/gradle-wrapper.jar*
> *dcc5ee0ec88 Update to Gradle 9.8.1*
> *7bb5f96fca0 Update Gradle wrapper to version release-candidate*
> 8ed35c9985f Gradle 9.8.0 M1
> 17901347dad Update Gradle wrapper to version 9.7.0-rc-1
> ae5c0f4c6e9 Update Gradle wrapper to version 9.5.0-rc-1
> 112aba6448e Update wrapper to 9.5.0-milestone-7
> 5c141fb9464 Update Gradle wrapper to version release-milestone
> 11535f62912 Update wrapper to 9.4.0-milestone-4
> 308880bfbe2 Upgradlew to 9.4.0-milestone-1
> 90638756ec0 Update Gradle to 9.3.0-milestone-1
> 16145458453 Update Gradle wrapper to version 9.2.0-rc-1
> 5f992e2737e Update Gradle to 9.0.0-milestone-9
> dejan@home:~/gradle$ *date*
> Mon 19 Oct 11:24:41 CEST 2026
> dejan@home:~/gradle$
> {quote}
> {*}Related Gradle issue{*}:
> [https://github.com/gradle/gradle/issues/39471#issuecomment-6189156726]
> *How to reproduce wrapper related issue on Kafka side:*
> # try to upgrade Gradle version from 9.7.1 to 9.8.1 (follow manual in
> kafka/gradle/wrapper/README.md)
> # try to execute Gradle command, for example: *./gradlew clean*
> ** every *odd* (1st, 3rd, 5th, etc) execution fails (x) with "Unable to
> access jarfile" (the wrapper jar fails checksum verification and gets deleted)
> ** every *even* (2nd, 4th, 6th, etc) execution passes (on) (the wrapper jar
> is downloaded again from the v9.8.1 tag and executed without verification)
> *Upgrade process (taken from terminal):*
> {code:java}
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:31:32 CEST 2026
> dejan@home:~/kafka$ git log -2 --oneline
> 65566690ca1 (HEAD -> Gradle-9.8.1-yet-another-try, upstream/trunk,
> upstream/HEAD) MINOR: Don't block on position() when advancing standby
> restored offsets (#23841)
> 59046aecc31 KAFKA-21289 Fix release.py stage-docs for Hugo kafka-site (#23833)
> dejan@home:~/kafka$ git status
> On branch Gradle-9.8.1-yet-another-try
> nothing to commit, working tree clean
> dejan@home:~/kafka$ git diff
> diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
> index d670f3658dd..e82ce56aafe 100644
> --- a/gradle/dependencies.gradle
> +++ b/gradle/dependencies.gradle
> @@ -58,7 +58,7 @@ versions += [
> commonsValidator: "1.11.0",
> commonsNet: "3.13.0",
> classgraph: "4.8.196",
> - gradle: "9.7.1",
> + gradle: "9.8.1",
> httpclient: "4.5.14",
> jackson: "2.22.3",
> jacksonAnnotations: "2.22",
> diff --git a/wrapper.gradle b/wrapper.gradle
> index 2f7a1dc3245..364ed15fb91 100644
> --- a/wrapper.gradle
> +++ b/wrapper.gradle
> @@ -40,7 +40,7 @@ task bootstrapWrapper() {
> // of curl (built against OpenSSL library that doesn't support
> TLSv1.2) would fail to
> // fetch the jar.
> // IMPORTANT: This checksum **must** be updated whenever the Gradle
> version changes.
> - String wrapperChecksum =
> "7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d"
> + String wrapperChecksum =
> "3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98"
> def wrapperJarUrl =
> "https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";
>
> def bootstrapString = """
> dejan@home:~/kafka$ ./gradlew wrapper --gradle-version 9.8.1
> --distribution-type bin --gradle-distribution-sha256-sum
> dce76f55f8e251a3a1f130eb120f30b3d271de2b76c9b0729d316b5a1b6dc01f
> > Configure project :
> Starting build with version 4.5.0-SNAPSHOT (commit id 65566690) using Gradle
> 9.8.1, Java 17 and Scala 2.13.18
> Build properties: ignoreFailures=false, maxParallelForks=8,
> maxScalacThreads=8, maxTestRetries=0
> [Incubating] Problems report is available at:
> file:///home/dejan/kafka/build/reports/problems/problems-report.html
> Deprecated Gradle features were used in this build, making it incompatible
> with Gradle 10.
> You can use '--warning-mode all' to show the individual deprecation warnings
> and determine if they come from your own scripts or plugins.
> For more on this, please refer to
> https://docs.gradle.org/9.7.1/userguide/command_line_interface.html#sec:command_line_warnings
> in the Gradle documentation.
> BUILD SUCCESSFUL in 11s
> 9 actionable tasks: 9 executed
> Consider enabling configuration cache to speed up this build:
> https://docs.gradle.org/9.7.1/userguide/configuration_cache_enabling.html
> dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
> [Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
> 4 files changed, 6 insertions(+), 6 deletions(-)
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:15 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:28 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:34:41 CEST 2026
> dejan@home:~/kafka$
> {code}
> *Every odd execution (1, 3, 5) fails while every even (2,4,6) execution
> starts as expected:*
> {code:java}
> dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
> [Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
> 4 files changed, 6 insertions(+), 6 deletions(-)
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:15 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:28 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:34:41 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:39:30 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:39:43 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
