JMR-dev
7a0cc3145c
The Gradle wrapper had no distributionSha256Sum, so the Gradle 9.6.0 distribution was the one unpinned download in CI (validateDistributionUrl only checks the URL shape, not content). Pin it to Gradle's published SHA-256 so the wrapper fails closed on any corrupt/tampered distribution, matching the SHA-256 integrity pin cmdline-tools already gets (#389).
11 lines
368 B
Properties
11 lines
368 B
Properties
distributionBase=GRADLE_USER_HOME
|
|
distributionPath=wrapper/dists
|
|
distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
|
|
distributionSha256Sum=bbaeb2fef8710818cf0e261201dab964c572f92b942812df0c3620d62a529a01
|
|
networkTimeout=10000
|
|
retries=0
|
|
retryBackOffMs=500
|
|
validateDistributionUrl=true
|
|
zipStoreBase=GRADLE_USER_HOME
|
|
zipStorePath=wrapper/dists
|