53 lines
2.8 KiB
Bash
53 lines
2.8 KiB
Bash
#!/usr/bin/env sh
|
|
# Build tooling only. All downloaded executable bytes must match official release hashes.
|
|
set -eu
|
|
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
|
JAR="$ROOT/gradle/wrapper/gradle-wrapper.jar"
|
|
EXPECTED=7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172
|
|
DIST_EXPECTED=6f74b601422d6d6fc4e1f9a1ab6522f642c2fdcbc15ae33ebd30ba3d7198e854
|
|
mkdir -p "$(dirname "$JAR")"
|
|
WORK=$(mktemp -d "$ROOT/gradle/wrapper/bootstrap.XXXXXX")
|
|
trap 'rm -rf "$WORK"' EXIT HUP INT TERM
|
|
fetch() {
|
|
if command -v curl >/dev/null 2>&1; then
|
|
curl --fail --location --proto '=https' --tlsv1.2 --connect-timeout 15 --max-time 300 "$1" -o "$2"
|
|
elif command -v wget >/dev/null 2>&1; then
|
|
wget --https-only --timeout=30 "$1" -O "$2"
|
|
else
|
|
echo 'Install curl/wget, or generate the wrapper with an installed Gradle 8.14.5.' >&2
|
|
return 1
|
|
fi
|
|
}
|
|
checksum() {
|
|
if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d ' ' -f 1
|
|
elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | cut -d ' ' -f 1
|
|
else echo 'No SHA-256 utility found; refusing unverified tooling.' >&2; return 1; fi
|
|
}
|
|
printf '%s\n' 'Fetching the official Gradle 8.14.5 wrapper; a pinned SHA-256 is required.'
|
|
fetch https://raw.githubusercontent.com/gradle/gradle/v8.14.5/gradle/wrapper/gradle-wrapper.jar "$WORK/wrapper.jar"
|
|
ACTUAL=$(checksum "$WORK/wrapper.jar")
|
|
if [ "$ACTUAL" != "$EXPECTED" ]; then
|
|
# A source tag can contain an older build's wrapper. Never execute that mismatch.
|
|
# The released distribution contains the exact wrapper as an embedded resource.
|
|
printf '%s\n' 'Tag wrapper does not match the release checksum; retrieving the verified release distribution.'
|
|
command -v unzip >/dev/null 2>&1 || {
|
|
echo 'Install unzip for this fallback, or generate the wrapper with installed Gradle 8.14.5.' >&2
|
|
exit 1
|
|
}
|
|
fetch https://services.gradle.org/distributions/gradle-8.14.5-bin.zip "$WORK/gradle.zip"
|
|
[ "$(checksum "$WORK/gradle.zip")" = "$DIST_EXPECTED" ] || {
|
|
echo 'Gradle distribution checksum mismatch; refusing to execute.' >&2; exit 1
|
|
}
|
|
ENTRY=$(unzip -Z1 "$WORK/gradle.zip" | grep '/gradle-wrapper-main-8\.14\.5\.jar$')
|
|
[ "$(printf '%s\n' "$ENTRY" | wc -l | tr -d ' ')" = 1 ] || {
|
|
echo 'Expected exactly one wrapper-main JAR in the verified release.' >&2; exit 1
|
|
}
|
|
unzip -p "$WORK/gradle.zip" "$ENTRY" > "$WORK/wrapper-main.jar"
|
|
unzip -p "$WORK/wrapper-main.jar" gradle-wrapper.jar > "$WORK/wrapper.jar"
|
|
[ "$(checksum "$WORK/wrapper.jar")" = "$EXPECTED" ] || {
|
|
echo 'Embedded wrapper checksum mismatch; refusing to execute.' >&2; exit 1
|
|
}
|
|
fi
|
|
mv "$WORK/wrapper.jar" "$JAR"
|
|
printf '%s\n' 'Official wrapper verified. The Gradle distribution is separately checksum-pinned.'
|