commit gradle for openSUSE:Factory

2019-12-18 Thread root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2019-12-18 14:45:04

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new.4691 (New)


Package is "gradle"

Wed Dec 18 14:45:04 2019 rev:12 rq:757516 version:4.4.1

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2019-12-09 
21:36:37.774064926 +0100
+++ /work/SRC/openSUSE:Factory/.gradle.new.4691/gradle.changes  2019-12-18 
14:48:17.861938049 +0100
@@ -1,0 +2,6 @@
+Tue Dec 17 11:49:50 UTC 2019 - Fridrich Strba 
+
+- Avoid all-released-versions.json as source, since we are not
+  building integration tests.
+
+---

Old:

  all-released-versions.json



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.dg2Nll/_old  2019-12-18 14:48:19.365938737 +0100
+++ /var/tmp/diff_new_pack.dg2Nll/_new  2019-12-18 14:48:19.365938737 +0100
@@ -26,7 +26,7 @@
 URL:http://www.gradle.org/
 
 Source0:
http://services.gradle.org/distributions/gradle-%{version}-src.zip
-Source1:
http://services.gradle.org/versions/all#/all-released-versions.json
+#Source1:
http://services.gradle.org/versions/all#/all-released-versions.json
 Source2:gradle-font-metadata.xml
 Source3:gradle-jquery-metadata.xml
 Source4:gradle-launcher.sh.in
@@ -331,8 +331,8 @@
 >subprojects/diagnostics/src/main/resources/org/gradle/api/tasks/diagnostics/htmldependencyreport/jquery.jstree.js
 
 # This file is normally downloaded from Internet during package build
-mkdir -p build
-cp %{SOURCE1} build/all-released-versions.json
+# mkdir -p build
+# cp %{SOURCE1} build/all-released-versions.json
 
 # quality checks for which we don't have deps
 rm -r buildSrc/src/main/groovy/org/gradle/binarycompatibility





commit gradle for openSUSE:Factory

2019-12-09 Thread root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2019-12-09 21:36:22

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new.4691 (New)


Package is "gradle"

Mon Dec  9 21:36:22 2019 rev:11 rq:755237 version:4.4.1

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2019-11-28 
13:50:45.390697438 +0100
+++ /work/SRC/openSUSE:Factory/.gradle.new.4691/gradle.changes  2019-12-09 
21:36:37.774064926 +0100
@@ -1,0 +2,21 @@
+Mon Dec  9 12:38:32 UTC 2019 - Fridrich Strba 
+
+- Modified patch:
+  * gradle-4.4.1-asm7.patch
++ Rediff and use ASM7 api instead of ASM6, since we are using
+  objectweb-asm 7.2
+- Added patches:
+  * cast-estimated-runtime-to-long.patch
++ estimatedRuntime must be cast to long otherwise gradle build
+  fails with "Cannot assign value of type java.math.BigDecimal
+  to variable of type long".
+  * java11-compatibility.patch
++ Fixes the compatibility with Java 11. This is backport of
+  upstream changes in 4.8
+  * java8-compatibility.patch
++ Keep compatibility with Java 8 by avoiding to use Java 9+
+  APIs
+  * remove-timestamps.patch
++ Avoid timestamps and thus irreproducible builds
+
+---

New:

  cast-estimated-runtime-to-long.patch
  java11-compatibility.patch
  java8-compatibility.patch
  remove-timestamps.patch



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.9XjKPe/_old  2019-12-09 21:36:39.086064410 +0100
+++ /var/tmp/diff_new_pack.9XjKPe/_new  2019-12-09 21:36:39.086064410 +0100
@@ -56,6 +56,11 @@
 
 Patch200:   gradle-4.4.1-asm7.patch
 
+Patch300:   java11-compatibility.patch
+Patch301:   java8-compatibility.patch
+Patch302:   remove-timestamps.patch
+Patch303:   cast-estimated-runtime-to-long.patch
+
 BuildRequires:  gradle-local
 BuildRequires:  xmvn-subst
 
@@ -202,7 +207,6 @@
 #!BuildRequires: groovy-lib sbt gpars
 # But we want to avoid cycle with oneself
 #!BuildRequires: gradle-bootstrap
-BuildConflicts: java-devel >= 9
 
 Obsoletes:  %{name}-bootstrap
 
@@ -356,11 +360,11 @@
 
 %build
 export LANG=en_US.UTF8
+export JAVA_OPTS="-Xmx2g -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8"
 # Disables parallel build and daemon mode
 rm gradle.properties
 gradle-local --offline --no-daemon install xmvnInstall \
--Pgradle_installPath=$PWD/inst \
--PfinalRelease -Dbuild.number="%{?fedora:Fedora }%{?rhel:Red Hat 
}%{version}-%{release}"
+-Pgradle_installPath=$PWD/inst -PfinalRelease
 
 # manpage build
 mkdir man

++ all-released-versions.json ++
--- /var/tmp/diff_new_pack.9XjKPe/_old  2019-12-09 21:36:39.154064382 +0100
+++ /var/tmp/diff_new_pack.9XjKPe/_new  2019-12-09 21:36:39.154064382 +0100
@@ -1,6 +1,6 @@
 [ {
-  "version" : "6.0.1-20191128003021+",
-  "buildTime" : "20191128003021+",
+  "version" : "6.0.1-20191209004608+",
+  "buildTime" : "20191209004608+",
   "current" : false,
   "snapshot" : true,
   "nightly" : false,
@@ -9,12 +9,12 @@
   "rcFor" : "",
   "milestoneFor" : "",
   "broken" : false,
-  "downloadUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191128003021+-bin.zip;,
-  "checksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191128003021+-bin.zip.sha256;,
-  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191128003021+-wrapper.jar.sha256;
+  "downloadUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191209004608+-bin.zip;,
+  "checksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191209004608+-bin.zip.sha256;,
+  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191209004608+-wrapper.jar.sha256;
 }, {
-  "version" : "6.1-20191127232441+",
-  "buildTime" : "20191127232441+",
+  "version" : "6.1-20191208230017+",
+  "buildTime" : "20191208230017+",
   "current" : false,
   "snapshot" : true,
   "nightly" : true,
@@ -23,9 +23,37 @@
   "rcFor" : "",
   "milestoneFor" : "",
   "broken" : false,
-  "downloadUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191127232441+-bin.zip;,
-  "checksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191127232441+-bin.zip.sha256;,
-  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191127232441+-wrapper.jar.sha256;
+  "downloadUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191208230017+-bin.zip;,
+  

commit gradle for openSUSE:Factory

2019-11-28 Thread root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2019-11-28 13:50:42

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new.26869 (New)


Package is "gradle"

Thu Nov 28 13:50:42 2019 rev:10 rq:751519 version:4.4.1

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2019-11-26 
16:54:39.988200849 +0100
+++ /work/SRC/openSUSE:Factory/.gradle.new.26869/gradle.changes 2019-11-28 
13:50:45.390697438 +0100
@@ -1,0 +2,7 @@
+Mon Nov 25 11:14:34 UTC 2019 - Fridrich Strba 
+
+- Added patch:
+  * gradle-4.4.1-asm7.patch
++ fix build with objectweb-asm 7.2
+
+---

New:

  gradle-4.4.1-asm7.patch



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.yE4s7d/_old  2019-11-28 13:50:46.846696884 +0100
+++ /var/tmp/diff_new_pack.yE4s7d/_new  2019-11-28 13:50:46.850696883 +0100
@@ -54,6 +54,8 @@
 
 Patch100:   gradle-CVE-2019-16370.patch
 
+Patch200:   gradle-4.4.1-asm7.patch
+
 BuildRequires:  gradle-local
 BuildRequires:  xmvn-subst
 

++ all-released-versions.json ++
--- /var/tmp/diff_new_pack.yE4s7d/_old  2019-11-28 13:50:46.950696845 +0100
+++ /var/tmp/diff_new_pack.yE4s7d/_new  2019-11-28 13:50:46.950696845 +0100
@@ -1,6 +1,6 @@
 [ {
-  "version" : "6.0.1-20191118003341+",
-  "buildTime" : "20191118003341+",
+  "version" : "6.0.1-20191128003021+",
+  "buildTime" : "20191128003021+",
   "current" : false,
   "snapshot" : true,
   "nightly" : false,
@@ -9,12 +9,12 @@
   "rcFor" : "",
   "milestoneFor" : "",
   "broken" : false,
-  "downloadUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191118003341+-bin.zip;,
-  "checksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191118003341+-bin.zip.sha256;,
-  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191118003341+-wrapper.jar.sha256;
+  "downloadUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191128003021+-bin.zip;,
+  "checksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191128003021+-bin.zip.sha256;,
+  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.0.1-20191128003021+-wrapper.jar.sha256;
 }, {
-  "version" : "6.1-20191117230041+",
-  "buildTime" : "20191117230041+",
+  "version" : "6.1-20191127232441+",
+  "buildTime" : "20191127232441+",
   "current" : false,
   "snapshot" : true,
   "nightly" : true,
@@ -23,13 +23,41 @@
   "rcFor" : "",
   "milestoneFor" : "",
   "broken" : false,
-  "downloadUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191117230041+-bin.zip;,
-  "checksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191117230041+-bin.zip.sha256;,
-  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191117230041+-wrapper.jar.sha256;
+  "downloadUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191127232441+-bin.zip;,
+  "checksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191127232441+-bin.zip.sha256;,
+  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions-snapshots/gradle-6.1-20191127232441+-wrapper.jar.sha256;
+}, {
+  "version" : "6.1-milestone-1",
+  "buildTime" : "20191120132405+",
+  "current" : false,
+  "snapshot" : false,
+  "nightly" : false,
+  "releaseNightly" : false,
+  "activeRc" : false,
+  "rcFor" : "",
+  "milestoneFor" : "6.1",
+  "broken" : false,
+  "downloadUrl" : 
"https://services.gradle.org/distributions/gradle-6.1-milestone-1-bin.zip;,
+  "checksumUrl" : 
"https://services.gradle.org/distributions/gradle-6.1-milestone-1-bin.zip.sha256;,
+  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions/gradle-6.1-milestone-1-wrapper.jar.sha256;
+}, {
+  "version" : "6.0.1",
+  "buildTime" : "20191118202501+",
+  "current" : true,
+  "snapshot" : false,
+  "nightly" : false,
+  "releaseNightly" : false,
+  "activeRc" : false,
+  "rcFor" : "",
+  "milestoneFor" : "",
+  "broken" : false,
+  "downloadUrl" : 
"https://services.gradle.org/distributions/gradle-6.0.1-bin.zip;,
+  "checksumUrl" : 
"https://services.gradle.org/distributions/gradle-6.0.1-bin.zip.sha256;,
+  "wrapperChecksumUrl" : 
"https://services.gradle.org/distributions/gradle-6.0.1-wrapper.jar.sha256;
 }, {
   "version" : "6.0",
   "buildTime" : "20191108181212+",
-  "current" : true,
+  "current" : false,
   "snapshot" : false,
   "nightly" : false,
   "releaseNightly" 

commit gradle for openSUSE:Factory

2019-11-26 Thread root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2019-11-26 16:54:17

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new.26869 (New)


Package is "gradle"

Tue Nov 26 16:54:17 2019 rev:9 rq:750481 version:4.4.1

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2019-11-19 
13:45:02.084394882 +0100
+++ /work/SRC/openSUSE:Factory/.gradle.new.26869/gradle.changes 2019-11-26 
16:54:39.988200849 +0100
@@ -1,0 +2,5 @@
+Wed Nov 20 21:31:11 UTC 2019 - Fridrich Strba 
+
+- Gradle looks for slf4j-api.jar, so we provide a link there
+
+---



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.xI349I/_old  2019-11-26 16:54:41.164200461 +0100
+++ /var/tmp/diff_new_pack.xI349I/_new  2019-11-26 16:54:41.164200461 +0100
@@ -1,7 +1,7 @@
 #
 # spec file for package gradle
 #
-# Copyright (c) 2019 SUSE LLC.
+# Copyright (c) 2019 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -378,6 +378,7 @@
 xmvn-subst -s $(find inst/lib -type f)
 # TODO figure out why this one is missing
 ln -s $(find-jar commons-lang) inst/lib/
+ln -s $(find-jar slf4j/slf4j-api) inst/lib/
 cp -a inst %{buildroot}%{_datadir}/%{name}
 
 %mvn_install





commit gradle for openSUSE:Factory

2019-11-19 Thread root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2019-11-19 13:44:54

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new.26869 (New)


Package is "gradle"

Tue Nov 19 13:44:54 2019 rev:8 rq:749228 version:4.4.1

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2019-09-18 
13:14:56.496645702 +0200
+++ /work/SRC/openSUSE:Factory/.gradle.new.26869/gradle.changes 2019-11-19 
13:45:02.084394882 +0100
@@ -1,0 +2,42 @@
+Sun Nov 17 20:04:50 UTC 2019 - Fridrich Strba 
+
+- Package a full gradle instead of the open apis only
+- Upgrade to version 4.4.1
+- Added patches:
+  * 0001-Gradle-local-mode.patch
++ Use gradle local mode by default
+  * 0002-Remove-Class-Path-from-manifest.patch
++ Remove classpath from manifest
+  * 0003-Implement-XMvn-repository-factory-method.patch
++ Implement factory methods for xmvn repository
+  * 0004-Use-unversioned-dependency-JAR-names.patch
++ Use unversioned jar files for dependencies
+  * 0005-Port-to-Maven-3.3.9-and-Eclipse-Aether.patch
++ Port to maven 3.3.9 and maven-resolver
+  * 0006-Disable-code-quality-checks.patch
++ Disable code quality checks useless for rpm build
+  * 0007-Port-to-Kryo-3.0.patch
++ Fix build with kryo 3.0
+  * 0008-Port-to-Ivy-2.4.0.patch
++ Fix build with apache-ivy 2.4.0
+  * 0009-Port-to-Polyglot-0.1.8.patch
++ Allow building with tesla-polyglot >= 0.1.8
+  * 0010-Port-from-Simple-4-to-Jetty-9.patch
++ build using org.eclipse.jetty:jetty-server instead of
+  org.simpleframework:simple
+  * 0011-Disable-benchmarks.patch
++ Do not run benchmarks useless during rpm build
+  * 0012-Disable-patching-of-external-modules.patch
++ Disable patching of external modules during the build
+  * 0013-Add-missing-transitive-dependencies.patch
++ Add transitive dependencies for aqute-bndlib, jansi and zinc
+  * 0014-Disable-ideNative-module.patch
++ Do not build ideNative module
+  * 0015-Disable-docs-build.patch
++ Do not build docs needing asciidoctorj that we don't have
+  * 0016-Port-to-guava-20.0.patch
++ Fix build with guava 20.0
+  * 0017-Set-core-api-source-level-to-8.patch
++ Build core-api submodule with source/target 8
+
+---

Old:

  v3.2.1.zip

New:

  0001-Gradle-local-mode.patch
  0002-Remove-Class-Path-from-manifest.patch
  0003-Implement-XMvn-repository-factory-method.patch
  0004-Use-unversioned-dependency-JAR-names.patch
  0005-Port-to-Maven-3.3.9-and-Eclipse-Aether.patch
  0006-Disable-code-quality-checks.patch
  0007-Port-to-Kryo-3.0.patch
  0008-Port-to-Ivy-2.4.0.patch
  0009-Port-to-Polyglot-0.1.8.patch
  0010-Port-from-Simple-4-to-Jetty-9.patch
  0011-Disable-benchmarks.patch
  0012-Disable-patching-of-external-modules.patch
  0013-Add-missing-transitive-dependencies.patch
  0014-Disable-ideNative-module.patch
  0015-Disable-docs-build.patch
  0016-Port-to-guava-20.0.patch
  0017-Set-core-api-source-level-to-8.patch
  _constraints
  all-released-versions.json
  gradle-4.4.1-src.zip
  gradle-font-metadata.xml
  gradle-jquery-metadata.xml
  gradle-launcher.sh.in
  gradle-man.txt
  gradle.desktop



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.AOKfII/_old  2019-11-19 13:45:03.968393952 +0100
+++ /var/tmp/diff_new_pack.AOKfII/_new  2019-11-19 13:45:03.972393950 +0100
@@ -1,7 +1,7 @@
 #
 # spec file for package gradle
 #
-# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2019 SUSE LLC.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,63 +17,393 @@
 
 
 Name:   gradle
-Version:3.2.1
+Version:4.4.1
 Release:0
-Summary:Groovy-based build system
+Summary:Build automation tool
+# Some examples and integration tests are under GNU LGPL and Boost
+# Software License, but are not used to create binary package.
 License:Apache-2.0
-Group:  Development/Tools
-Url:https://www.gradle.org/
-Source0:https://github.com/gradle/gradle/archive/v%{version}.zip
-Patch0: gradle-CVE-2019-16370.patch
-BuildRequires:  java-devel
-BuildRequires:  javapackages-tools
+URL:http://www.gradle.org/
+
+Source0:
http://services.gradle.org/distributions/gradle-%{version}-src.zip
+Source1:
http://services.gradle.org/versions/all#/all-released-versions.json
+Source2:gradle-font-metadata.xml
+Source3:gradle-jquery-metadata.xml
+Source4:gradle-launcher.sh.in
+Source5:

commit gradle for openSUSE:Factory

2019-09-18 Thread root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2019-09-18 13:13:03

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new.7948 (New)


Package is "gradle"

Wed Sep 18 13:13:03 2019 rev:7 rq:731532 version:3.2.1

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2017-09-14 
21:17:31.987004340 +0200
+++ /work/SRC/openSUSE:Factory/.gradle.new.7948/gradle.changes  2019-09-18 
13:14:56.496645702 +0200
@@ -1,0 +2,14 @@
+Tue Sep 17 11:37:40 UTC 2019 - Pedro Monreal Gonzalez 

+
+- Add LICENSE file to the correct tag
+
+---
+Tue Sep 17 11:31:39 UTC 2019 - Pedro Monreal Gonzalez 

+
+- Security fix: [bsc#1150998, CVE-2019-16370]
+  * The PGP signing plugin in Gradle before 6.0 relies on the SHA-1
+algorithm. PGP signing plugin might allow an attacker to replace
+an artifact with a different one.
+- Add gradle-CVE-2019-16370.patch
+
+---

New:

  gradle-CVE-2019-16370.patch



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.AMY24y/_old  2019-09-18 13:14:59.624645044 +0200
+++ /var/tmp/diff_new_pack.AMY24y/_new  2019-09-18 13:14:59.624645044 +0200
@@ -1,7 +1,7 @@
 #
 # spec file for package gradle
 #
-# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -12,7 +12,7 @@
 # license that conforms to the Open Source Definition (Version 1.9)
 # published by the Open Source Initiative.
 
-# Please submit bugfixes or comments via http://bugs.opensuse.org/
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
 #
 
 
@@ -22,8 +22,9 @@
 Summary:Groovy-based build system
 License:Apache-2.0
 Group:  Development/Tools
-Url:http://www.gradle.org/
+Url:https://www.gradle.org/
 Source0:https://github.com/gradle/gradle/archive/v%{version}.zip
+Patch0: gradle-CVE-2019-16370.patch
 BuildRequires:  java-devel
 BuildRequires:  javapackages-tools
 BuildRequires:  unzip
@@ -49,6 +50,7 @@
 
 %prep
 %setup -q
+%patch0 -p1
 
 %build
 # Build Open API subpackage
@@ -71,7 +73,7 @@
 %defattr(-,root,root,-)
 %{_javadir}/gradle-open-api-%{version}.jar
 %{_javadir}/gradle-open-api.jar
-%doc LICENSE
+%license LICENSE
 %doc subprojects/distributions/src/toplevel/NOTICE
 
 %changelog

++ gradle-CVE-2019-16370.patch ++
>From f50bb2513f8880f75db2c2b3f1badbae856f6f85 Mon Sep 17 00:00:00 2001
From: Vladimir Sitnikov 
Date: Tue, 10 Sep 2019 14:37:35 +0300
Subject: [PATCH] signing plugin: use SHA512 instead of SHA1 when signing
 artifacts

PGP signs a digest, so MITM is still possible provided an attacker can update
the artifact in such a way that its SHA1 is intact.

Relevant article is 
https://medium.com/@jonathan.leitschuh/many-of-these-gpg-signatures-are-signed-with-sha-1-which-is-vulnerable-to-a-second-preimage-attack-67104d827930

Signed-off-by: Vladimir Sitnikov 
---
 .../org/gradle/plugins/signing/signatory/pgp/PgpSignatory.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git 
a/subprojects/signing/src/main/java/org/gradle/plugins/signing/signatory/pgp/PgpSignatory.java
 
b/subprojects/signing/src/main/java/org/gradle/plugins/signing/signatory/pgp/PgpSignatory.java
index 5e022b5b5d07..3e212fe4a93d 100644
--- 
a/subprojects/signing/src/main/java/org/gradle/plugins/signing/signatory/pgp/PgpSignatory.java
+++ 
b/subprojects/signing/src/main/java/org/gradle/plugins/signing/signatory/pgp/PgpSignatory.java
@@ -104,7 +104,7 @@ private void writeSignatureTo(OutputStream 
signatureDestination, PGPSignature pg
 
 public PGPSignatureGenerator createSignatureGenerator() {
 try {
-PGPSignatureGenerator generator = new PGPSignatureGenerator(new 
BcPGPContentSignerBuilder(secretKey.getPublicKey().getAlgorithm(), 
PGPUtil.SHA1));
+PGPSignatureGenerator generator = new PGPSignatureGenerator(new 
BcPGPContentSignerBuilder(secretKey.getPublicKey().getAlgorithm(), 
PGPUtil.SHA512));
 generator.init(PGPSignature.BINARY_DOCUMENT, privateKey);
 return generator;
 } catch (PGPException e) {




commit gradle for openSUSE:Factory

2017-09-14 Thread root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2017-09-14 21:17:14

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new (New)


Package is "gradle"

Thu Sep 14 21:17:14 2017 rev:6 rq:526029 version:3.2.1

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2016-12-29 
22:52:08.122344033 +0100
+++ /work/SRC/openSUSE:Factory/.gradle.new/gradle.changes   2017-09-14 
21:17:31.987004340 +0200
@@ -1,0 +2,6 @@
+Thu Sep 14 05:34:54 UTC 2017 - fst...@suse.com
+
+- Specify java source and target level 1.6 in order to allow
+  building with jdk9
+
+---



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.AvDeAW/_old  2017-09-14 21:17:33.054854043 +0200
+++ /var/tmp/diff_new_pack.AvDeAW/_new  2017-09-14 21:17:33.062852917 +0200
@@ -1,7 +1,7 @@
 #
 # spec file for package gradle
 #
-# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -53,7 +53,7 @@
 %build
 # Build Open API subpackage
 pushd subprojects/open-api/src/main/java
-find -name '*.java' |xargs javac -source 1.5 -target 1.5
+find -name '*.java' |xargs javac -source 1.6 -target 1.6
 find -name '*.class' |xargs jar cf gradle-open-api.jar
 popd
 





commit gradle for openSUSE:Factory

2016-01-01 Thread h_root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2016-01-01 19:48:05

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new (New)


Package is "gradle"

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2015-04-16 
14:14:13.0 +0200
+++ /work/SRC/openSUSE:Factory/.gradle.new/gradle.changes   2016-01-01 
19:50:07.0 +0100
@@ -1,0 +2,5 @@
+Mon Dec 28 13:56:20 UTC 2015 - mailaen...@opensuse.org
+
+- Update to 2.10
+
+---

Old:

  gradle-2.3-src.zip

New:

  gradle-2.10-src.zip



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.8p0ssd/_old  2016-01-01 19:50:08.0 +0100
+++ /var/tmp/diff_new_pack.8p0ssd/_new  2016-01-01 19:50:08.0 +0100
@@ -17,7 +17,7 @@
 
 
 Name:   gradle
-Version:2.3
+Version:2.10
 Release:0
 Summary:Groovy-based build system
 License:Apache-2.0




commit gradle for openSUSE:Factory

2015-04-16 Thread h_root
Hello community,

here is the log from the commit of package gradle for openSUSE:Factory checked 
in at 2015-04-16 14:14:12

Comparing /work/SRC/openSUSE:Factory/gradle (Old)
 and  /work/SRC/openSUSE:Factory/.gradle.new (New)


Package is gradle

Changes:

--- /work/SRC/openSUSE:Factory/gradle/gradle.changes2014-07-18 
14:03:59.0 +0200
+++ /work/SRC/openSUSE:Factory/.gradle.new/gradle.changes   2015-04-16 
14:14:13.0 +0200
@@ -1,0 +2,5 @@
+Tue Apr 14 19:21:36 UTC 2015 - afaer...@suse.de
+
+- Update to 2.3
+
+---

Old:

  gradle.tar.gz

New:

  gradle-2.3-src.zip



Other differences:
--
++ gradle.spec ++
--- /var/tmp/diff_new_pack.KhWAFM/_old  2015-04-16 14:14:14.0 +0200
+++ /var/tmp/diff_new_pack.KhWAFM/_new  2015-04-16 14:14:14.0 +0200
@@ -1,7 +1,7 @@
 #
 # spec file for package gradle
 #
-# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany.
+# Copyright (c) 2015 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,18 +17,16 @@
 
 
 Name:   gradle
-Version:0.9
+Version:2.3
 Release:0
 Summary:Groovy-based build system
 License:Apache-2.0
 Group:  Development/Tools
 Url:http://www.gradle.org/
-# git clone git://github.com/gradle/gradle.git
-# (cd gradle; git checkout 72)
-# tar czf gradle.tar.gz gradle --exclude .git
-Source0:gradle.tar.gz
+Source0:
https://services.gradle.org/distributions/gradle-%{version}-src.zip
 BuildRequires:  java-devel
 BuildRequires:  javapackages-tools
+BuildRequires:  unzip
 BuildRoot:  %{_tmppath}/%{name}-%{version}-build
 BuildArch:  noarch
 
@@ -50,32 +48,30 @@
 gradle home directory and the open API jar.
 
 %prep
-%setup -q -n %{name}
-
+%setup -q
 
 %build
 # Build Open API subpackage
-pushd subprojects/gradle-open-api/src/main/groovy
+pushd subprojects/open-api/src/main/java
 find -name '*.java' |xargs javac -source 1.5 -target 1.5
 find -name '*.class' |xargs jar cf gradle-open-api.jar
 popd
 
-
 %install
 install -d %{buildroot}%{_javadir}
 # Open API
-pushd subprojects/gradle-open-api/src/main/groovy
+pushd subprojects/open-api/src/main/java
 install -p -m644 gradle-open-api.jar \
 %{buildroot}%{_javadir}/gradle-open-api-%{version}.jar
 ln -s gradle-open-api-%{version}.jar \
 %{buildroot}%{_javadir}/gradle-open-api.jar
 popd
 
-
 %files open-api
 %defattr(-,root,root,-)
 %{_javadir}/gradle-open-api-%{version}.jar
 %{_javadir}/gradle-open-api.jar
-%doc website/src/content/license.html
+%doc subprojects/distributions/src/toplevel/LICENSE
+%doc subprojects/distributions/src/toplevel/NOTICE
 
 %changelog