This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-secure-xml.git
The following commit(s) were added to refs/heads/main by this push:
new 2457a9a Verify the Gradle wrapper and distribution by checksum
2457a9a is described below
commit 2457a9adfb087ac259204659841684a9f5ddb6cc
Author: Piotr P. Karwasz <[email protected]>
AuthorDate: Tue Sep 1 09:51:17 2026 +0200
Verify the Gradle wrapper and distribution by checksum
Add distributionSha256Sum for gradle-8.10-bin.zip to the wrapper
properties, so the wrapper verifies the downloaded distribution before
executing it, and run gradle/actions/wrapper-validation in the Android
CI job, so the checked-in gradle-wrapper.jar is checked against
Gradle's published checksums before anything invokes ./gradlew.
Assisted-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01CLnTBsvmYtxzNTWVGNyz33
---
.github/workflows/maven.yml | 4 ++++
android-tests/gradle/wrapper/gradle-wrapper.properties | 1 +
2 files changed, 5 insertions(+)
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 39b7f81..f231076 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -146,6 +146,10 @@ jobs:
with:
persist-credentials: false
+ # Verifies the checked-in gradle-wrapper.jar against Gradle's published
checksums before anything runs ./gradlew
+ - name: Validate Gradle wrapper
+ uses:
gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb #
v6.3.0
+
- name: Set up JDK 17
uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c #
6.0.0
with:
diff --git a/android-tests/gradle/wrapper/gradle-wrapper.properties
b/android-tests/gradle/wrapper/gradle-wrapper.properties
index f238904..acffdc8 100644
--- a/android-tests/gradle/wrapper/gradle-wrapper.properties
+++ b/android-tests/gradle/wrapper/gradle-wrapper.properties
@@ -15,6 +15,7 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
+distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
networkTimeout=10000
validateDistributionUrl=true
