initial commit v 0.2.0

2026-09-24 22:49:27 +02:00
commit db873063f8
129 changed files with 7512 additions and 0 deletions
@@ -0,0 +1,52 @@
+#!/usr/bin/env sh
+# Build tooling only. All downloaded executable bytes must match official release hashes.
+set -eu
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+JAR="$ROOT/gradle/wrapper/gradle-wrapper.jar"
+EXPECTED=7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172
+DIST_EXPECTED=6f74b601422d6d6fc4e1f9a1ab6522f642c2fdcbc15ae33ebd30ba3d7198e854
+mkdir -p "$(dirname "$JAR")"
+WORK=$(mktemp -d "$ROOT/gradle/wrapper/bootstrap.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT HUP INT TERM
+fetch() {
+    if command -v curl >/dev/null 2>&1; then
+        curl --fail --location --proto '=https' --tlsv1.2 --connect-timeout 15 --max-time 300 "$1" -o "$2"
+    elif command -v wget >/dev/null 2>&1; then
+        wget --https-only --timeout=30 "$1" -O "$2"
+    else
+        echo 'Install curl/wget, or generate the wrapper with an installed Gradle 8.14.5.' >&2
+        return 1
+    fi
+}
+checksum() {
+    if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d ' ' -f 1
+    elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | cut -d ' ' -f 1
+    else echo 'No SHA-256 utility found; refusing unverified tooling.' >&2; return 1; fi
+}
+printf '%s\n' 'Fetching the official Gradle 8.14.5 wrapper; a pinned SHA-256 is required.'
+fetch https://raw.githubusercontent.com/gradle/gradle/v8.14.5/gradle/wrapper/gradle-wrapper.jar "$WORK/wrapper.jar"
+ACTUAL=$(checksum "$WORK/wrapper.jar")
+if [ "$ACTUAL" != "$EXPECTED" ]; then
+    # A source tag can contain an older build's wrapper. Never execute that mismatch.
+    # The released distribution contains the exact wrapper as an embedded resource.
+    printf '%s\n' 'Tag wrapper does not match the release checksum; retrieving the verified release distribution.'
+    command -v unzip >/dev/null 2>&1 || {
+        echo 'Install unzip for this fallback, or generate the wrapper with installed Gradle 8.14.5.' >&2
+        exit 1
+    }
+    fetch https://services.gradle.org/distributions/gradle-8.14.5-bin.zip "$WORK/gradle.zip"
+    [ "$(checksum "$WORK/gradle.zip")" = "$DIST_EXPECTED" ] || {
+        echo 'Gradle distribution checksum mismatch; refusing to execute.' >&2; exit 1
+    }
+    ENTRY=$(unzip -Z1 "$WORK/gradle.zip" | grep '/gradle-wrapper-main-8\.14\.5\.jar$')
+    [ "$(printf '%s\n' "$ENTRY" | wc -l | tr -d ' ')" = 1 ] || {
+        echo 'Expected exactly one wrapper-main JAR in the verified release.' >&2; exit 1
+    }
+    unzip -p "$WORK/gradle.zip" "$ENTRY" > "$WORK/wrapper-main.jar"
+    unzip -p "$WORK/wrapper-main.jar" gradle-wrapper.jar > "$WORK/wrapper.jar"
+    [ "$(checksum "$WORK/wrapper.jar")" = "$EXPECTED" ] || {
+        echo 'Embedded wrapper checksum mismatch; refusing to execute.' >&2; exit 1
+    }
+fi
+mv "$WORK/wrapper.jar" "$JAR"
+printf '%s\n' 'Official wrapper verified. The Gradle distribution is separately checksum-pinned.'