Validate Wrapper Jar using PGP
- Dominant language
- TypeScript
- Stars
- 340
- Forks
- 117
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 11
Description
Currently, the wrapper checksums are hardcoded: https://github.com/gradle/actions/pull/810
[But Gradle finally signed the wrapper files](https://github.com/gradle/gradle/issues/33940#issuecomment-3615581618), so the action could verify the jars via the pgp signature instead. Also, the custom parsing of the html file for the SNAPSHOTs could be avoided too: https://github.com/gradle/actions/pull/318
Contributor guide
Research direction
Start by reviewing the linked pull requests and the Gradle signing discussion to understand the current hardcoded checksum and SNAPSHOT HTML parsing paths. Done means the action validates wrapper JARs with PGP signatures and no longer relies on the custom SNAPSHOT HTML parsing; the issue names no source files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, typescript
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100