Gradle M5 dependency downloader swallowing HTTP 409s without telling us?

I suspect this might be a gradle dependency resolution bug, so I figured I’d post it here and let gradleware sort it out.

Here are the symptoms to an issue I had earlier today. I had a settings.gradle file which was adding http-builder to the buildscript classpath and then (still in settings) using http builder to download a jar file from an authenticated repository. The code then added the jar to the buildscript classpath of all subprojects. I know this is a hack and there are reasons for this insanity. But for the purposes for this issue, let’s for a moment forget that the code is somewhat insane.

So what happened was that the code in settings.gradle was not finding the HttpBuilder class. Not even after various attempts at browbeating it into submission. So I wrote a groovy script which was using @Grapes to do the exact same thing. The groovy script worked. I then started comparing the grapes cache with the gadle cache and noticed that gradle had downloaded all the maven pom and ivy xml files but not the actual jar file for http-builder.

Digging further it turns out that due to a checksum policy in one of my proxied repositories, the repo gradle was downloading from was returning a 409 on the request for the jar file. Artifactory log:

2011-11-30 14:44:22,957 ["ajp-bio-backip/10.68.63.122-8067"-exec-10] [ERROR] (o.a.r.HttpRepo
    :261) - gradle-plugins-snapshots: Failed to download 'http://repo.jfrog.org/artifactory/gradle-plugins-snapshots/org/codehaus/groovy/modules/http-builder/http-builder/0.5.1/http-builder-0.5.1.jar'. Received status code 200 and caught exception: Checksum policy 'GEN_IF_ABSENT' rejected the artifact 'http-builder-0.5.1.jar'. Checksums info: [ChecksumInfo{type=MD5, original='6a7205a9d7fc5e4e6bd931dad14ea204', actual='0adb319f78b78a6bec46d2d1ba261e71'}, ChecksumInfo{type=SHA-1, original='64644da1c2bcc23fbc5b0e3172cb7ea48f0d0140', actual='b9702ae21997c13bda2e66242aac10461bd24a36'}]
2011-11-30 14:44:22,971 ["ajp-bio-backip/10.68.63.122-8067"-exec-10] [WARN ] (o.a.e.DownloadServiceImpl:265) - Sending HTTP error code 409: Rejected artifact download request: Checksum policy 'GEN_IF_ABSENT' rejected the artifact 'http-builder-0.5.1.jar'. Checksums info: [ChecksumInfo{type=MD5, original='6a7205a9d7fc5e4e6bd931dad14ea204', actual='0adb319f78b78a6bec46d2d1ba261e71'}, ChecksumInfo{type=SHA-1, original='64644da1c2bcc23fbc5b0e3172cb7ea48f0d0140', actual='b9702ae21997c13bda2e66242aac10461bd24a36'}].

so the good news is that I now know what the issue was. I could re-order my proxied repos in my virtual repository and my build now works. The bad news is that at least in M5, gradle did not tell me that it received a 409 from the server and never downloaded the jar file. The build didn’t break on the dependency resolution. The gradle cache didn’t complain. It just failed to find the class when it was executing the settings.gradle script. I’m thinking this is highly undesirable. Imagine if the missing class was in one of the 50 transitive dependencies pulled in by http-builder. Might not have been all that easy to pin down.

So my issue is solved, but I figured I’d give a heads up and flag this as something that should potentially be looked at.

Thanks for the report: I’ve raised a specific forum problem (http://forums.gradle.org/gradle/topics/gradle_does_not_report_missing_failed_artifact_downloads) and Jira issue for this: GRADLE-1973

Thanks Daz. Glad to add a data point to the bug hunt. We can consider this “question” answered.