Skip to content
This repository has been archived by the owner on Nov 13, 2021. It is now read-only.

Update gradle build #1

Merged
merged 7 commits into from
Nov 15, 2018
Merged

Update gradle build #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4da09b5
Update build.gradle to ensure reproducible builds
devinbileck Nov 10, 2018
bf8dc64
Generate MD5 hash file and print it during gradle build
devinbileck Nov 10, 2018
a4a1b2d
Update source/target compatibility to 1.10
devinbileck Nov 10, 2018
0f1c41d
Remove unnecessary java plugin
devinbileck Nov 15, 2018
88fa8c3
Remove sourceCompatibility and targetCompatibility
devinbileck Nov 15, 2018
25c5f75
Add .gitattributes file
devinbileck Nov 15, 2018
44b0391
Normalize line endings to LF
devinbileck Nov 15, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitattributes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Auto detect text files and perform LF normalization
* text=auto
2 changes: 1 addition & 1 deletion LICENSE
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Copyright (c) 2014 Open Whisper Systems
Copyright (c) 2014 Open Whisper Systems

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,8 @@ In the remote directory, the artifact consists of a POM file and a jar or aar, a
sha1sum hash values for those files.

When gradle retrieves the artifact, it will also retrieve the md5sum and sha1sums to verify that
they match the calculated md5sum and sha1sum of the retrieved files. The problem, obviously, is
that if someone is able to compromise the remote maven repository and change the jar/aar for a
they match the calculated md5sum and sha1sum of the retrieved files. The problem, obviously, is
that if someone is able to compromise the remote maven repository and change the jar/aar for a
dependency to include some malicious functionality, they could just as easily change the md5sum
and sha1sum values the repository advertises as well.

Expand Down
10 changes: 8 additions & 2 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ dependencies {
compile localGroovy()
}

sourceCompatibility = '1.7'
targetCompatibility = '1.7'
tasks.withType(AbstractArchiveTask) {
preserveFileTimestamps = false
reproducibleFileOrder = true
}

jar.doLast { task ->
ant.checksum file: task.archivePath
println "md5=" + file("build/libs/gradle-witness.jar.MD5").text.trim()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm producing a different checksum result locally than what you report at bisq-network/bisq#1901 in the commit comment on bisq-network/bisq@ee96822:

~/Work/bisq-network/gradle-witness[update-gradle-build]
$ git log -1 --oneline
a4a1b2d (HEAD -> update-gradle-build, devinbileck/update-gradle-build) Update source/target compatibility to 1.10

$ ./gradlew --version
------------------------------------------------------------
Gradle 4.10.2
------------------------------------------------------------

Build time:   2018-09-19 18:10:15 UTC
Revision:     b4d8d5d170bb4ba516e88d7fe5647e2323d791dd

Kotlin DSL:   1.0-rc-6
Kotlin:       1.2.61
Groovy:       2.4.15
Ant:          Apache Ant(TM) version 1.9.11 compiled on March 23 2018
JVM:          10.0.2 ("Oracle Corporation" 10.0.2+13)
OS:           Mac OS X 10.12.5 x86_64

$ ./gradlew clean build
> Task :compileGroovy
> Task :jar
md5=ae4796f320ef3200515183fa9d3f4759

BUILD SUCCESSFUL in 2s
4 actionable tasks: 4 executed

$ cat ./build/libs/gradle-witness.jar.MD5
ae4796f320ef3200515183fa9d3f4759

(your commit comment says you produce the md5 sum 237be11ebb7604afa5ff478ec33d1df5)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Argg! I will investigate further.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is due to different line endings in the witness.properties file. If I change it to LF (vs CRLF) I get the same result as you. Shall I add a .gitattributes file to ensure consistent line endings and prevent issues like this in the future?

}
1 change: 0 additions & 1 deletion src/main/groovy/org/whispersystems/witness/WitnessPlugin.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,4 +63,3 @@ class WitnessPlugin implements Plugin<Project> {
}
}
}