Upgrade to Gradle 8.11.1 to fix PGP verification issues

[fdevans]

Upgrade to Gradle 8.11.1 to Fix PGP Verification Issues

Problem

Multiple Renovate PRs have been failing with this error:

class org.bouncycastle.openpgp.PGPCompressedData cannot be cast to class org.bouncycastle.openpgp.PGPSignatureList

This is a known bug in Gradle 7.x's BouncyCastle PGP processing when handling certain PGP key formats (specifically compressed signature packets). Every time Renovate updates a dependency, new PGP keys need to be downloaded, triggering this bug and causing CI to fail.

Solution

Upgraded to Gradle 8.11.1, which includes a fixed version of BouncyCastle that properly handles PGP signatures.

Changes

Gradle & Plugins

• Gradle: 7.6.6 → 8.11.1
• Shadow plugin: 7.1.2 → 8.1.1 (Gradle 8 compatibility)
• OSPackage plugin: 9.1.1 → 11.11.2 (includes namespace change from nebula.ospackage to com.netflix.nebula.ospackage)

Verification Files

• Completely regenerated gradle/verification-keyring.keys with fresh PGP keys (no more corrupted signatures)
• Regenerated gradle/verification-metadata.xml with both PGP and SHA256 verification
• Removed obsolete .gpg file per documentation

Renovate Configuration

Added postUpgradeTasks to automatically regenerate verification metadata when dependencies are updated:

{
  "postUpgradeTasks": {
    "commands": [
      "./gradlew --write-verification-metadata sha256 help"
    ],
    "fileFilters": [
      "gradle/verification-metadata.xml"
    ]
  }
}

This ensures future Renovate PRs automatically include updated checksums for new dependency versions.

Benefits

✅ Fixes PGP verification bug - No more ClassCastException errors
✅ Enables strict dependency verification - Full PGP + SHA256 validation works reliably
✅ Better build performance - Gradle 8 includes performance improvements and configuration caching
✅ Renovate automation - Dependency updates will now work seamlessly
✅ Future-proof - Gradle 8 is actively maintained and supports Java 11-21

Testing

• ✅ Clean build successful with strict verification: ./gradlew clean build --dependency-verification strict
• ✅ All 75 tasks execute without errors
• ✅ Compatible with existing Java 11 build environment
• ✅ No breaking changes to build scripts or configuration

Compatibility

• Java: Still builds with Java 11 (CI unchanged)
• Plugins: All plugins updated to Gradle 8 compatible versions
• APIs: No deprecated API usage that would break with Gradle 9
• CI/CD: No workflow changes needed - wrapper handles version automatically

Post-Merge Actions

After this merges to main:

1. Rebase existing Renovate PRs - They will now pass CI
2. Future Renovate PRs - Will automatically work with auto-updated verification metadata
3. Manual dependency updates - Use ./gradlew --write-verification-metadata sha256 help to update checksums

References

• Gradle 8.11 Release Notes
• Gradle Dependency Verification Documentation
• Related Issue: Original PGP verification failures in Renovate PRs

[Copilot]

Pull request overview

This PR upgrades the project from Gradle 7.6.6 to Gradle 8.11.1 to fix PGP verification issues caused by a known bug in Gradle 7.x's BouncyCastle PGP processing. The upgrade ensures reliable dependency verification and enables automated Renovate updates.

Changes:

• Upgraded Gradle from 7.6.6 to 8.11.1
• Updated shadow plugin from 7.1.2 to 8.1.1 (Gradle 8 compatibility)
• Updated OSPackage plugin from 9.1.1 to 11.11.2 with namespace change from nebula.ospackage to com.netflix.nebula.ospackage
• Regenerated dependency verification files with updated PGP keys and SHA256 checksums
• Added Renovate postUpgradeTasks to automatically update verification metadata
• Updated README documentation with clearer instructions for manual dependency updates

Reviewed changes

Copilot reviewed 4 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
renovate.json	Added postUpgradeTasks to automate verification metadata updates when Renovate updates dependencies
gradle/wrapper/gradle-wrapper.properties	Updated Gradle distribution URL from 7.6.6 to 8.11.1
gradle/verification-metadata.xml	Regenerated with schema 1.3, updated trusted keys, and fresh PGP/SHA256 verification data
gradle/libs.versions.toml	Updated plugin versions and OSPackage plugin namespace
README.md	Improved documentation with clearer instructions for dependency verification updates

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.