gradle / gradle/actions

Validate Wrapper Jar using PGP

Open
#813 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
340
Forks
117
Avg merge
1d 9h
Merged PRs (30d)
11

Description

Currently, the wrapper checksums are hardcoded: https://github.com/gradle/actions/pull/810

[But Gradle finally signed the wrapper files](https://github.com/gradle/gradle/issues/33940#issuecomment-3615581618), so the action could verify the jars via the pgp signature instead. Also, the custom parsing of the html file for the SNAPSHOTs could be avoided too: https://github.com/gradle/actions/pull/318

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the linked pull requests and the Gradle signing discussion to understand the current hardcoded checksum and SNAPSHOT HTML parsing paths. Done means the action validates wrapper JARs with PGP signatures and no longer relies on the custom SNAPSHOT HTML parsing; the issue names no source files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, typescript
Domain
devops, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.