Skip to content

Commit c8c8bca

Browse files
jacopocjacopoc
committed
Improved: Remove gradle-wrapper.jar from the repository and enhance the init-gradle-wrapper scripts to download and verify the version specified in gradle-wrapper.properties
This change simplifies gradlew upgrades (no longer requiring updates to the scripts or recomputation of file hashes) and improves repository quality by removing the binary file (gradle-wrapper.jar). The behavior of init-gradle-wrapper.sh and init-gradle-wrapper.ps1 is now consistent. The init-gradle-wrapper.sh and init-gradle-wrapper.ps1 scripts now: * download only gradle-wrapper.jar * parse the version from gradle-wrapper.properties (no hardcoded version in the scripts) * fetch the SHA-256 from services.gradle.org and verify it * correctly detect when the JAR already exists and fetch SHA, warn-and-continue if unreachable, exit if match, re-download if mismatch * accept arguments: ** --help: prints usage + full upgrade workflow, then exits ** --upgrade: sets a flag that triggers "./gradlew wrapper" at both success exit points (jar-already-valid and freshly-downloaded-and-verified) ** unknown arguments produce an error with a pointer to --help
1 parent 1a0675a commit c8c8bca

6 files changed

Lines changed: 231 additions & 86 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
bin/
22
build/
3+
gradle/wrapper/gradle-wrapper.jar
34
applications/*/build
45
framework/*/build
56
/plugins/

‎gradle/init-gradle-wrapper.ps1‎

Lines changed: 92 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,26 +15,106 @@
1515
# specific language governing permissions and limitations
1616
# under the License.
1717

18+
param(
19+
[switch]$Help,
20+
[switch]$Upgrade
21+
)
22+
23+
if ($Help) {
24+
Write-Host "Usage: gradle\init-gradle-wrapper.ps1 [-Help] [-Upgrade]"
25+
Write-Host ""
26+
Write-Host "Downloads and verifies gradle-wrapper.jar for Apache OFBiz."
27+
Write-Host "The jar is not committed to the repository; run this script"
28+
Write-Host "before using gradlew.bat for the first time."
29+
Write-Host ""
30+
Write-Host "Options:"
31+
Write-Host " -Help Show this message and exit."
32+
Write-Host " -Upgrade After downloading/verifying the jar, run"
33+
Write-Host " '.\gradlew wrapper' to regenerate gradlew.bat"
34+
Write-Host " to match the new Gradle version."
35+
Write-Host ""
36+
Write-Host "Workflow for Gradle version upgrades (e.g. from a Dependabot PR):"
37+
Write-Host " 1. gradle\init-gradle-wrapper.ps1 -Upgrade"
38+
Write-Host " 2. Commit any changes to gradlew and gradlew.bat"
39+
exit 0
40+
}
41+
1842
md -force gradle/wrapper
1943

20-
# download raw format from https://github.com/gradle/gradle/tree/v8.14.4/gradle/wrapper
44+
# Parse the Gradle version from gradle-wrapper.properties
45+
$distributionUrl = (Get-Content "gradle\wrapper\gradle-wrapper.properties" | Where-Object { $_ -match "^distributionUrl=" }) -replace "^distributionUrl=", ""
46+
$release = [regex]::Match($distributionUrl, 'gradle-(\d+(?:\.\d+)+)-').Groups[1].Value
47+
Write-Host "Gradle version: $release"
48+
49+
$gradleWrapperJar = "gradle\wrapper\gradle-wrapper.jar"
50+
$gradleWrapperUri = "https://github.com/gradle/gradle/raw/v$release/gradle/wrapper/gradle-wrapper.jar"
51+
$gradleWrapperSha256Uri = "https://services.gradle.org/distributions/gradle-$release-wrapper.jar.sha256"
52+
53+
function Get-ExpectedSha256 {
54+
try {
55+
return Invoke-RestMethod -Uri $gradleWrapperSha256Uri -ErrorAction Stop
56+
} catch {
57+
return $null
58+
}
59+
}
60+
61+
function Get-ActualSha256 {
62+
return (Get-FileHash $gradleWrapperJar -Algorithm SHA256).Hash.ToLower()
63+
}
64+
65+
# If gradle-wrapper.jar already exists, verify its checksum before deciding to skip or re-download
66+
if (Test-Path $gradleWrapperJar) {
67+
Write-Host "gradle-wrapper.jar found, verifying checksum..."
68+
$expected = Get-ExpectedSha256
69+
if ($null -eq $expected) {
70+
Write-Host "Warning: could not reach checksum service, skipping verification"
71+
exit 0
72+
}
73+
$actual = Get-ActualSha256
74+
if ($actual -eq $expected) {
75+
Write-Host "Checksum OK."
76+
if ($Upgrade) {
77+
Write-Host "Running '.\gradlew wrapper' to regenerate gradlew and gradlew.bat..."
78+
& .\gradlew wrapper
79+
}
80+
exit 0
81+
} else {
82+
Write-Host "Checksum mismatch, re-downloading..."
83+
Remove-Item $gradleWrapperJar
84+
}
85+
}
86+
87+
# Download gradle-wrapper.jar from the Gradle GitHub repository
2188
If ($ExecutionContext.SessionState.LanguageMode -eq "ConstrainedLanguage") {
2289
Set-ItemProperty 'hklm:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -name "__PSLockdownPolicy" -Value 8
23-
Invoke-WebRequest -outf gradle\wrapper\gradle-wrapper.jar https://github.com/gradle/gradle/raw/v8.14.4/gradle/wrapper/gradle-wrapper.jar
90+
Invoke-WebRequest -outf $gradleWrapperJar $gradleWrapperUri
2491
Set-ItemProperty 'hklm:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -name "__PSLockdownPolicy" -Value 4
2592
} else {
26-
Invoke-WebRequest -outf gradle\wrapper\gradle-wrapper.jar https://github.com/gradle/gradle/raw/v8.14.4/gradle/wrapper/gradle-wrapper.jar
93+
Invoke-WebRequest -outf $gradleWrapperJar $gradleWrapperUri
2794
}
2895

29-
# https://docs.gradle.org/current/userguide/gradle_wrapper.html#wrapper_checksum_verification
30-
$expected = Invoke-RestMethod -Uri https://services.gradle.org/distributions/gradle-8.14.4-wrapper.jar.sha256
31-
$actual = (Get-FileHash gradle\wrapper\gradle-wrapper.jar -Algorithm SHA256).Hash.ToLower()
32-
@{$true = 'OK: Checksum match'; $false = "ERROR: Checksum mismatch!`nExpected: $expected`nActual: $actual"}[$actual -eq $expected]
33-
34-
if (!$true) {
35-
Remove-Item gradle\wrapper\gradle-wrapper.jar
96+
# Verify the downloaded jar against the expected checksum published by Gradle
97+
# See: https://docs.gradle.org/current/userguide/gradle_wrapper.html#wrapper_checksum_verification
98+
Write-Host "Verifying checksum..."
99+
$expected = Get-ExpectedSha256
100+
if ($null -eq $expected) {
101+
Remove-Item $gradleWrapperJar
102+
Write-Host "Error: could not fetch checksum from $gradleWrapperSha256Uri"
103+
exit 1
104+
}
105+
$actual = Get-ActualSha256
106+
if ($actual -eq $expected) {
107+
Write-Host "Checksum OK."
108+
if ($Upgrade) {
109+
Write-Host "Running '.\gradlew wrapper' to regenerate gradlew and gradlew.bat..."
110+
& .\gradlew wrapper
111+
}
112+
} else {
113+
Remove-Item $gradleWrapperJar
114+
Write-Host "Error: checksum mismatch"
115+
Write-Host "Expected: $expected"
116+
Write-Host "Actual: $actual"
117+
exit 1
36118
}
37-
38-
#Write-Host $ExecutionContext.SessionState.LanguageMode
39119

40120
Start-Sleep -s 3

‎gradle/init-gradle-wrapper.sh‎

Lines changed: 136 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -16,93 +16,162 @@
1616
# specific language governing permissions and limitations
1717
# under the License.
1818

19-
# Variable for location
19+
# Paths
2020
OFBIZ_HOME="$(pwd)"
21-
GRADLE_OFBIZ_PATH="$OFBIZ_HOME/gradle"
22-
GRADLE_WRAPPER_OFBIZ_PATH="$GRADLE_OFBIZ_PATH/wrapper"
23-
24-
# version and uri to download the wrapper
25-
RELEASE="8.14.4"
26-
GRADLE_WRAPPER_URI="https://github.com/gradle/gradle/raw/v$RELEASE/gradle/wrapper/"
27-
28-
# checksum to verify the downloaded file
29-
SHASUM_GRADLE_WRAPPER_FILES="544d80232399265b2e8e152220cf016c5ce33c7d gradle/wrapper/gradle-wrapper.jar
30-
0028d540fd75d2ef6caa87e2c43d247f30b991ce gradle/wrapper/gradle-wrapper.properties
31-
15c2aff9e646f042e1f5f4aa39cf92b232083866 gradlew"
32-
33-
GRADLE_WRAPPER_JAR="gradle-wrapper.jar"
34-
GRADLE_WRAPPER_PROPERTIES="gradle-wrapper.properties"
35-
GRADLE_WRAPPER_FILES="$GRADLE_WRAPPER_JAR $GRADLE_WRAPPER_PROPERTIES"
36-
GRADLE_WRAPPER_SCRIPT="gradlew"
21+
GRADLE_WRAPPER_OFBIZ_PATH="$OFBIZ_HOME/gradle/wrapper"
22+
GRADLE_WRAPPER_PROPERTIES="$GRADLE_WRAPPER_OFBIZ_PATH/gradle-wrapper.properties"
23+
GRADLE_WRAPPER_JAR="$GRADLE_WRAPPER_OFBIZ_PATH/gradle-wrapper.jar"
3724

3825
whereIsBinary() {
3926
whereis $1 | grep /
4027
}
4128

42-
# Perform the download using curl or wget
29+
# Perform the download using curl or wget, output to stdout
30+
downloadToStdout() {
31+
if [ -n "$(whereIsBinary curl)" ]; then
32+
curl -L -s "$1"
33+
elif [ -n "$(whereIsBinary wget)" ]; then
34+
wget -q -O - "$1"
35+
fi
36+
}
37+
38+
# Download a file to a given destination path
4339
downloadFile() {
44-
if [ -n "$(whereIsBinary curl)" ]; then
45-
GET_CMD="curl -L -o $GRADLE_WRAPPER_OFBIZ_PATH/$1 -s -w %{http_code} $2/$1";
46-
if [ "$($GET_CMD)" = "200" ]; then
47-
return 0;
48-
fi
49-
elif [ -n "$(whereIsBinary wget)" ]; then
50-
if [[ `wget -q -S -O $GRADLE_WRAPPER_OFBIZ_PATH/$1 $2/$1 2>&1 > /dev/null | grep 'HTTP/1.1 200 OK'` ]]; then
51-
return 0;
52-
fi
53-
fi
54-
return 1
40+
if [ -n "$(whereIsBinary curl)" ]; then
41+
HTTP_CODE=$(curl -L -o "$2" -s -w '%{http_code}' "$1")
42+
[ "$HTTP_CODE" = "200" ]
43+
elif [ -n "$(whereIsBinary wget)" ]; then
44+
wget -q -O "$2" "$1" 2>&1 | grep -q 'HTTP/1.1 200 OK'
45+
[ $? -eq 0 ]
46+
else
47+
return 1
48+
fi
5549
}
5650

57-
# Download the file from the main URI
58-
resolveFile() {
59-
downloadFile $1 $GRADLE_WRAPPER_URI;
51+
# Compute SHA256 of a file
52+
computeSha256() {
53+
if [ -n "$(whereIsBinary sha256sum)" ]; then
54+
sha256sum "$1" | cut -d' ' -f1
55+
elif [ -n "$(whereIsBinary shasum)" ]; then
56+
shasum -a 256 "$1" | cut -d' ' -f1
57+
fi
6058
}
6159

62-
echo " === Prepare operation ===";
60+
UPGRADE=false
61+
62+
for arg in "$@"; do
63+
case "$arg" in
64+
--help)
65+
echo "Usage: sh gradle/init-gradle-wrapper.sh [--help] [--upgrade]"
66+
echo ""
67+
echo "Downloads and verifies gradle-wrapper.jar for Apache OFBiz."
68+
echo "The jar is not committed to the repository; run this script"
69+
echo "before using ./gradlew for the first time."
70+
echo ""
71+
echo "Options:"
72+
echo " --help Show this message and exit."
73+
echo " --upgrade After downloading/verifying the jar, run"
74+
echo " './gradlew wrapper' to regenerate gradlew and"
75+
echo " gradlew.bat to match the new Gradle version."
76+
echo ""
77+
echo "Workflow for Gradle version upgrades (e.g. from a Dependabot PR):"
78+
echo " 1. sh gradle/init-gradle-wrapper.sh --upgrade"
79+
echo " 2. Commit any changes to gradlew and gradlew.bat"
80+
exit 0
81+
;;
82+
--upgrade)
83+
UPGRADE=true
84+
;;
85+
*)
86+
echo "Unknown option: $arg"
87+
echo "Run 'sh gradle/init-gradle-wrapper.sh --help' for usage."
88+
exit 1
89+
;;
90+
esac
91+
done
92+
6393
# Verify that the script is executed from the right location
64-
if [ ! -d "$GRADLE_OFBIZ_PATH" ]; then
65-
echo "Location seems to be incorrect, please run 'sh gradle/init-gradle-wrapper.sh' from the Apache OFBiz home";
66-
exit 1;
94+
if [ ! -f "$GRADLE_WRAPPER_PROPERTIES" ]; then
95+
echo "gradle/wrapper/gradle-wrapper.properties not found."
96+
echo "Please run 'sh gradle/init-gradle-wrapper.sh' from the Apache OFBiz home."
97+
exit 1
98+
fi
99+
100+
# Parse the Gradle version from gradle-wrapper.properties
101+
RELEASE=$(grep "^distributionUrl=" "$GRADLE_WRAPPER_PROPERTIES" | sed 's/.*gradle-\([0-9.]*\)-.*/\1/')
102+
if [ -z "$RELEASE" ]; then
103+
echo "Could not determine Gradle version from $GRADLE_WRAPPER_PROPERTIES"
104+
exit 1
67105
fi
68-
if [ ! -d "$GRADLE_WRAPPER_OFBIZ_PATH" ]; then
69-
mkdir $GRADLE_WRAPPER_OFBIZ_PATH;
106+
echo "Gradle version: $RELEASE"
107+
108+
GRADLE_WRAPPER_URI="https://github.com/gradle/gradle/raw/v$RELEASE/gradle/wrapper/gradle-wrapper.jar"
109+
GRADLE_WRAPPER_SHA256_URI="https://services.gradle.org/distributions/gradle-$RELEASE-wrapper.jar.sha256"
110+
111+
# If gradle-wrapper.jar already exists, verify its checksum before deciding to skip or re-download
112+
if [ -r "$GRADLE_WRAPPER_JAR" ]; then
113+
echo "gradle-wrapper.jar found, verifying checksum..."
114+
EXPECTED_SHA256=$(downloadToStdout "$GRADLE_WRAPPER_SHA256_URI")
115+
if [ -z "$EXPECTED_SHA256" ]; then
116+
echo "Warning: could not reach checksum service, skipping verification"
117+
exit 0
118+
fi
119+
ACTUAL_SHA256=$(computeSha256 "$GRADLE_WRAPPER_JAR")
120+
if [ -z "$ACTUAL_SHA256" ]; then
121+
echo "Warning: sha256sum or shasum not found, cannot verify existing gradle-wrapper.jar"
122+
exit 0
123+
fi
124+
if [ "$ACTUAL_SHA256" = "$EXPECTED_SHA256" ]; then
125+
echo "Checksum OK."
126+
if [ "$UPGRADE" = true ]; then
127+
echo "Running './gradlew wrapper' to regenerate gradlew and gradlew.bat..."
128+
./gradlew wrapper
129+
fi
130+
exit 0
131+
else
132+
echo "Checksum mismatch, re-downloading..."
133+
rm -f "$GRADLE_WRAPPER_JAR"
134+
fi
70135
fi
71136

72-
# check if we have on binary to download missing wrapper
137+
# Ensure curl or wget is available
73138
if [ -z "$(whereIsBinary curl)" ] && [ -z "$(whereIsBinary wget)" ]; then
74-
echo "curl or wget not found, please install one of them or install yourself gradle (for more information see README.md or https://gradle.org/install)";
75-
exit 1
139+
echo "curl or wget not found, please install one of them or install yourself gradle (for more information see README.md or https://gradle.org/install)"
140+
exit 1
76141
fi
77142

78-
if [ ! -r "$GRADLE_WRAPPER_OFBIZ_PATH/$GRADLE_WRAPPER_JAR" ]; then
79-
echo "$GRADLE_WRAPPER_OFBIZ_PATH/$GRADLE_WRAPPER_JAR not found, we download it"
143+
echo "Downloading gradle-wrapper.jar..."
144+
if ! downloadFile "$GRADLE_WRAPPER_URI" "$GRADLE_WRAPPER_JAR"; then
145+
rm -f "$GRADLE_WRAPPER_JAR"
146+
echo "Download of gradle-wrapper.jar from $GRADLE_WRAPPER_URI failed."
147+
echo "Please check the logs, fix the problem and run the script again."
148+
exit 1
149+
fi
80150

81-
for fileToDownload in $GRADLE_WRAPPER_FILES; do
82-
echo " === Download $fileToDownload ===";
83-
resolveFile $fileToDownload
84-
done
85-
if [ ! $? -eq 0 ]; then
86-
rm -f $GRADLE_WRAPPER_OFBIZ_PATH/*
87-
echo "\nDownload files $GRADLE_WRAPPER_FILES from $GRADLE_WRAPPER_URI failed.\nPlease check the logs, fix the problem and run the script again."
88-
fi
151+
echo "Verifying checksum..."
152+
EXPECTED_SHA256=$(downloadToStdout "$GRADLE_WRAPPER_SHA256_URI")
153+
if [ -z "$EXPECTED_SHA256" ]; then
154+
rm -f "$GRADLE_WRAPPER_JAR"
155+
echo "Error: could not fetch checksum from $GRADLE_WRAPPER_SHA256_URI"
156+
exit 1
157+
fi
89158

90-
if [ ! -r "$GRADLE_WRAPPER_SCRIPT" ]; then
91-
echo " === Download script wrapper ==="
92-
resolveFile $GRADLE_WRAPPER_SCRIPT
93-
mv "$GRADLE_WRAPPER_OFBIZ_PATH/$GRADLE_WRAPPER_SCRIPT" .
94-
chmod u+x $GRADLE_WRAPPER_SCRIPT
95-
fi
159+
ACTUAL_SHA256=$(computeSha256 "$GRADLE_WRAPPER_JAR")
160+
if [ -z "$ACTUAL_SHA256" ]; then
161+
echo "Warning: sha256sum or shasum not found, the downloaded file could not be verified"
162+
exit 0
163+
fi
96164

97-
echo " === Control downloaded files ==="
98-
if [ -n "$(whereIsBinary shasum)" ]; then
99-
echo "$SHASUM_GRADLE_WRAPPER_FILES" | shasum -c -;
100-
exit 0;
101-
else
102-
echo " Warning: shasum not found, the downloaded files could not be verified"
103-
exit 1;
104-
fi
165+
if [ "$ACTUAL_SHA256" = "$EXPECTED_SHA256" ]; then
166+
echo "Checksum OK."
167+
if [ "$UPGRADE" = true ]; then
168+
echo "Running './gradlew wrapper' to regenerate gradlew and gradlew.bat..."
169+
./gradlew wrapper
105170
fi
106-
exit 1;
171+
else
172+
rm -f "$GRADLE_WRAPPER_JAR"
173+
echo "Error: checksum mismatch"
174+
echo "Expected: $EXPECTED_SHA256"
175+
echo "Actual: $ACTUAL_SHA256"
176+
exit 1
107177
fi
108-
echo " Nothing more to be done"

‎gradle/wrapper/gradle-wrapper.jar‎

-42.7 KB
Binary file not shown.

‎gradle/wrapper/gradle-wrapper.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
distributionBase=GRADLE_USER_HOME
22
distributionPath=wrapper/dists
3-
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
3+
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.4-bin.zip
44
networkTimeout=10000
55
validateDistributionUrl=true
66
zipStoreBase=GRADLE_USER_HOME

‎init-gradle-wrapper.bat‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,4 @@ rem specific language governing permissions and limitations
1818
rem under the License.
1919
rem #####################################################################
2020

21-
if exist "%~dp0gradle\wrapper\gradle-wrapper.jar" (
22-
echo The Gradle Wrapper has already been downloaded.
23-
exit /b
24-
)
25-
26-
pwsh -command " Start-Process pwsh -Verb RunAs \""-Command `\""cd '%cd%'; & 'gradle\init-gradle-wrapper.ps1';`\""\"" "
21+
pwsh -command " Start-Process pwsh -Verb RunAs \""-Command `\""cd '%cd%'; & 'gradle\init-gradle-wrapper.ps1' %*;`\""\"" "

0 commit comments

Comments
 (0)