Skip to content

Commit 06905c7

Browse files
bigdazbigdaz
authored
Enable wrapper-validation by default in setup-gradle (#318)
2 parents 479297d + 73f1290 commit 06905c7

20 files changed

Lines changed: 559 additions & 51 deletions

File tree

‎.github/actions/init-integ-test/action.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@ runs:
99
distribution: 'temurin'
1010
java-version: 11
1111

12+
- name: Configure environment
13+
shell: bash
14+
run: |
15+
echo "ALLOWED_GRADLE_WRAPPER_CHECKSUMS=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" >> "$GITHUB_ENV"
16+
1217
# Downloads a 'dist' directory artifact that was uploaded in an earlier 'build-dist' step
1318
- name: Download dist
1419
if: ${{ env.SKIP_DIST != 'true' && !env.ACT }}

‎.github/workflows/integ-test-wrapper-validation.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ jobs:
2929
- name: Run wrapper-validation-action
3030
id: setup-gradle
3131
uses: ./setup-gradle
32-
with:
33-
validate-wrappers: true
32+
env:
33+
ALLOWED_GRADLE_WRAPPER_CHECKSUMS: ''
3434
continue-on-error: true
3535

3636
- name: Check failure

‎dependency-submission/action.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,21 @@ inputs:
172172
description: The Develocity short-lived access tokens expiry in hours. Default is 2 hours.
173173
required: false
174174

175+
# Wrapper validation configuration
176+
validate-wrappers:
177+
description: |
178+
When 'true' the action will automatically validate all wrapper jars found in the repository.
179+
If the wrapper checksums are not valid, the action will fail.
180+
required: false
181+
default: false
182+
183+
allow-snapshot-wrappers:
184+
description: |
185+
When 'true', wrapper validation will include the checksums of snapshot wrapper jars.
186+
Use this if you are running with nightly or snapshot versions of the Gradle wrapper.
187+
required: false
188+
default: false
189+
175190
# DEPRECATED ACTION INPUTS
176191

177192
# EXPERIMENTAL ACTION INPUTS

‎docs/setup-gradle.md‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -515,14 +515,30 @@ Since Gradle applies init scripts in alphabetical order, one way to ensure this
515515

516516
## Gradle Wrapper validation
517517

518-
Instead of using the [wrapper-validation action](./wrapper-validation.md) separately, you can enable
519-
wrapper validation directly in your Setup Gradle step.
518+
By default, this action will perform the same wrapper validation as is performed by the dedicated
519+
[wrapper-validation action](./wrapper-validation.md).
520+
This means that invalid wrapper jars will be automatically detected when using `setup-gradle`.
521+
522+
If you do not want wrapper-validation to occur automatically, you can disable it:
523+
524+
```yaml
525+
- name: Setup Gradle
526+
uses: gradle/actions/setup-gradle@v3
527+
with:
528+
validate-wrappers: false
529+
```
530+
531+
If your repository uses snapshot versions of the Gradle wrapper, such as nightly builds, then you'll need to
532+
explicitly allow snapshot wrappers in wrapper validation.
533+
These are not allowed by default.
534+
520535

521536
```yaml
522537
- name: Setup Gradle
523538
uses: gradle/actions/setup-gradle@v3
524539
with:
525540
validate-wrappers: true
541+
allow-snapshot-wrappers: true
526542
```
527543

528544
If you need more advanced configuration, then you're advised to continue using a separate workflow step

‎docs/wrapper-validation.md‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ This action validates the checksums of _all_ [Gradle Wrapper](https://docs.gradl
44

55
The action should be run in the root of the repository, as it will recursively search for any files named `gradle-wrapper.jar`.
66

7+
The `setup-gradle` action will perform wrapper validation on each execution. If you are using `setup-gradle` in your
8+
workflows, it is unlikely that you will need to use this action.
9+
710
## The Gradle Wrapper Problem in Open Source
811

912
The `gradle-wrapper.jar` is a binary blob of executable code that is checked into nearly
@@ -90,18 +93,22 @@ We recommend the message commit contents of:
9093

9194
From there, you can easily follow the rest of the prompts to create a Pull Request against the project.
9295

93-
## Reporting Failures
96+
## Validation Failures
9497

95-
If this GitHub action fails because a `gradle-wrapper.jar` doesn't match one of our published SHA-256 checksums,
96-
we highly recommend that you reach out to us at [security@gradle.com](mailto:security@gradle.com).
98+
A wrapper jar can fail validation for a few reasons:
99+
1. The wrapper is from a snapshot build of Gradle (nightly or release nightly) and you have not set `allow-snapshots`
100+
or `allow-snapshot-wrappers` to `true`.
101+
2. The wrapper jar is from a version of Gradle with an unverifiable wrapper jar (see below).
102+
3. The wrapper jar was not published by Gradle, and could be compromised.
97103

98-
**Note:** `gradle-wrapper.jar` generated by Gradle 3.3 to 4.0 are not verifiable because those files were dynamically generated by Gradle in a non-reproducible way. It's not possible to verify the `gradle-wrapper.jar` for those versions are legitimate using a hash comparison. You should try to determine if the `gradle-wrapper.jar` was generated by one of these versions before running the build.
104+
If this GitHub action fails because a `gradle-wrapper.jar` was not published by Gradle,
105+
we highly recommend that you reach out to us at [security@gradle.com](mailto:security@gradle.com).
99106

100-
If the Gradle version in `gradle-wrapper.properties` is out of this range, you may need to regenerate the `gradle-wrapper.jar` by running `./gradlew wrapper`. If you need to use a version of Gradle between 3.3 and 4.0, you can use a newer version of Gradle to generate the `gradle-wrapper.jar`.
107+
#### Unverifiable Wrapper Jars
108+
Wrapper Jars generated by Gradle versions `3.3` to `4.0` are not verifiable because those files were dynamically generated by Gradle in a non-reproducible way. It's not possible to verify the `gradle-wrapper.jar` for those versions are legitimate using a hash comparison. If you have a validation failure, you should try to determine if the `gradle-wrapper.jar` was generated by one of these versions before running the build.
101109

102-
If you're curious and want to explore what the differences are between the `gradle-wrapper.jar` in your possession
103-
and one of our valid release, you can compare them using this online utility: [diffoscope](https://try.diffoscope.org/).
104-
Regardless of what you find, we still kindly request that you reach out to us and let us know.
110+
- If the Gradle version in `gradle-wrapper.properties` is outside of this range, you can regenerate the `gradle-wrapper.jar` by running `./gradlew wrapper`. This will generate a new, verifiable wrapper jar.
111+
- If you need to run your build with a version of Gradle between 3.3 and 4.0, you can use a newer version of Gradle to generate the `gradle-wrapper.jar`.
105112

106113
## Resources
107114

‎setup-gradle/action.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,16 @@ inputs:
190190
# Wrapper validation configuration
191191
validate-wrappers:
192192
description: |
193-
When 'true', the action will perform the 'wrapper-validation' action automatically.
193+
When 'true' (the default) the action will automatically validate all wrapper jars found in the repository.
194194
If the wrapper checksums are not valid, the action will fail.
195195
required: false
196+
default: true
197+
198+
allow-snapshot-wrappers:
199+
description: |
200+
When 'true', wrapper validation will include the checksums of snapshot wrapper jars.
201+
Use this if you are running with nightly or snapshot versions of the Gradle wrapper.
202+
required: false
196203
default: false
197204

198205
# DEPRECATED ACTION INPUTS

0 commit comments

Comments
 (0)