Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Gradle wrapper to 4.1 #171

Merged
merged 1 commit into from Aug 24, 2017

Conversation

friederbluemle
Copy link
Contributor

No description provided.

@dotsbb dotsbb self-requested a review August 21, 2017 09:35
@dotsbb
Copy link
Member

dotsbb commented Aug 21, 2017

@friederbluemle
Could you update binary wrapper to the one from official gradle repo: https://github.com/gradle/gradle/blob/v4.1.0/gradle/wrapper/gradle-wrapper.jar

with following checksum

sha256sum gradle-wrapper.jar 
2fe666278c4c937bef200572781334e4513237f74ad4c93f29247a3273f8b12b

@friederbluemle
Copy link
Contributor Author

friederbluemle commented Aug 22, 2017

@dotsbb Thanks for the reply. The gradle-wrapper.jar you linked is not the final version 4.1. It is the wrapper used by the Gradle project itself. They used it to build 4.1, and it happens to be 4.1-rc-1, as you can see by looking at the associated .properties file:
https://github.com/gradle/gradle/blob/v4.1.0/gradle/wrapper/gradle-wrapper.jar
The gradle-wrapper.jar file I included in my PR was auto-generated by the wrapper task. There is a timestamp file inside of this jar, which is why the checksum changes every time it is generated. You can easily reproduce this locally by repeatedly running:

./gradlew wrapper --gradle-version 4.1 --distribution-type all

@d4rken
Copy link
Member

d4rken commented Aug 23, 2017

I think the issue is that someone could submit a malicious binary (unknowingly or intentionally)?

@dotsbb
Copy link
Member

dotsbb commented Aug 23, 2017

@d4rken yes. but in the same time I think about using something like https://github.com/int128/gradleupdate - Automatic Gradle Updater

@d4rken
Copy link
Member

d4rken commented Aug 24, 2017

@d4rken yes. but in the same time I think about using something like https://github.com/int128/gradleupdate - Automatic Gradle Updater

Google Cloud dependency doesn't sound too nice.

Anyways, we can merge this, while one should always be suspicious of binary files, I trust @friederbluemle here.

@d4rken d4rken merged commit 207bea3 into matomo-org:dev Aug 24, 2017
@friederbluemle friederbluemle deleted the update-gradle-wrapper branch August 24, 2017 23:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants