This report lives on GitHub. You are reading it in Luma’s tracker. To add to it, reply there.Open on GitHub

GitHub #7 gradle-wrapper.jar in luma-connect-android does not match Gradle's published checksum

joaovitoriasilvaon GitHub · 12 days ago

Hi, and thanks for publishing the source. While reviewing the tree before building, I noticed something about the Gradle wrapper jar and wanted to ask about it.

What I see

src/luma-connect-android/gradle/wrapper/gradle-wrapper.jar has this SHA-256:

7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d

gradle-wrapper.properties points to Gradle 9.1.0. Gradle publishes this checksum for the 9.1.0 wrapper jar (the same value is published for 9.0.0):

76805e32c009c0cf0dd5d206bddc9fb22ea42e84db904b764f3047de095493f3

I compared the jar's hash against the checksum files at services.gradle.org/distributions/gradle-<version>-wrapper.jar.sha256 for 8.10, 8.14.3, 9.0.0, 9.1.0 and 9.2.0, and it matches none of them. The checksums are also listed at https://gradle.org/release-checksums/.

Other observations

The jar contains the 34 files a wrapper jar normally has: org/gradle/wrapper/*, org/gradle/cli/*, and a few org/gradle/internal and org/gradle/util classes.
Every entry is dated 1970-01-01 rather than a build date, so it looks repacked or rebuilt.
A string scan of the classes found no URLs other than the Gradle release-checksums page.
I haven't run or decompiled it, so I can't say whether the classes differ from upstream.
The history shows it was added in the initial public baseline commit (5ec9305).

Questions

Where did this jar come from? Examples would be a distro build of Gradle, a reproducible rebuild or a different Gradle version.
Is the mismatch intended? If it's a rebuild, can you document how and which upstream version it corresponds to?
Could you replace it with the official wrapper jar, for example by running ./gradlew wrapper --gradle-version 9.1.0? You could also add distributionSha256Sum to gradle-wrapper.properties, and drop the checked-in jar if you'd rather not carry it.

I'm not claiming anything is wrong. I'd just rather not run a build with a wrapper whose provenance I can't verify. Happy to help with a PR if useful.

2 replies on GitHub

nmcmil12 days ago

We verified the JAR matches Gradle’s official 9.7.0/9.7.1 wrapper exactly, it’s configured to download 9.1.0. Good catch on the missing distribution checksum, we will add that. Than you!

nmcmil12 days ago· edited

Thanks for checking. The JAR is Gradle's official wrapper from 9.7.0/9.7.1: its SHA-256 7a9ce74c…262c5d matches gradle-9.7.0-wrapper.jar.sha256 and gradle-9.7.1-wrapper.jar.sha256, so its entry timestamps are exactly as Gradle publishes them. The wrapper JAR version is independent of the distribution it downloads, which stays Gradle 9.1.0.

#8 pins distributionSha256Sum to the official gradle-9.1.0-bin.zip checksum, and CI now validates every wrapper JAR against Gradle's published checksums.

Add to this on GitHub

The conversation about this report is on GitHub, so that is where a reply reaches the people in it. If it happens to you too and you would rather not use GitHub, file it here and mention GitHub #7.

Reply on GitHub Report it here