From 7a0cc3145c1b64ce878dfcea869d87658b66325e Mon Sep 17 00:00:00 2001 From: Jason Ross Date: Wed, 8 Jul 2026 12:05:00 -0500 Subject: [PATCH] ci(gradle): pin Gradle distribution against published SHA-256 The Gradle wrapper had no distributionSha256Sum, so the Gradle 9.6.0 distribution was the one unpinned download in CI (validateDistributionUrl only checks the URL shape, not content). Pin it to Gradle's published SHA-256 so the wrapper fails closed on any corrupt/tampered distribution, matching the SHA-256 integrity pin cmdline-tools already gets (#389). --- gradle/wrapper/gradle-wrapper.properties | 1 + 1 file changed, 1 insertion(+) diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties index eb84db6..906dbb9 100644 --- a/gradle/wrapper/gradle-wrapper.properties +++ b/gradle/wrapper/gradle-wrapper.properties @@ -1,6 +1,7 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip +distributionSha256Sum=bbaeb2fef8710818cf0e261201dab964c572f92b942812df0c3620d62a529a01 networkTimeout=10000 retries=0 retryBackOffMs=500 -- 2.47.3