Safety of Gradle distributions?

[Jesper_Skov]

When I launched Gradle 3.4 for the first time, my Windows 7 box blacked out. Instant death.

Nothing could be found on it, so it was probably just an unfortunate coincidence.

But since then, I have a very bad feeling whenever I download a new release.
Which is a shame, because I look forward to testing the new release.

Searching the forums shows that I am not alone:

Where can I find distribution checksums

I’m building a Chef script to automate my developer’s environment setup. One of the recipes downloads Gradle from http://services.gradle.org/distributions/. I want to be sure that download was correct and check ZIP’s checksum, but I cannot find any checksums for latest versions published. How can I check integrity?

Publish SHA Checksum for gradle distributions

The gradle wrapper allows the configuration of a SHA-256 hash for verifying an automatically downloaded gradle distribution. See https://docs.gradle.org/current/userguide/gradle_wrapper.html#sec:verification However, this hash apparently has to be computed by the user. So if I download an already infected distribution and compute the hash myself, the security checksum would be useless. I wonder, why you don’t publish checksums for your distributions on your releases page https://gradle.org/re…

Supply checksum when downloading gradle

Would it be possible to provide the MD5 and SHA1 checksum of gradle on the downloads page? Otherwise I have no way to verify that the gradle zip I have is correct or untampered with.

I would really like for the release note to include SHA2±sums for the distribution archives.

It might not be the best solution (that would be signing), but it should be such a small effort to implement that it is hard (for an outsider) to understand, why it has still not been done.

Cue crickets…

[diogocp (Diogo Pereira)]

What I don’t understand is why the wrapper task doesn’t set the distributionSha256Sum property automatically. Seems like a no-brainer to me.

[eljobe (Pepper Lebeck-Jobe)]

We now publish sha256 checksums with every release. We’ve also backfilled the data for older releases.

• https://gradle.org/install
• https://gradle.org/releases
• https://gradle.org/release-candidate
• https://gradle.org/nightly
• https://services.gradle.org/distributions
• https://services.gradle.org/distributions-snapshots

[Jesper_Skov]

Good stuff!

Thanks!

[Jesper_Skov]

Uh, I spoke too soon.

I guess it is better than nothing.

But the checksums should really be included in the release notes.

As it is now, the file containing the checksum is placed right next to the release archive.

Anyone capable of replacing the release archive with nasty stuff, probably has the wits to also replace the checksum file.

Sorry,
Jesper

[eljobe (Pepper Lebeck-Jobe)]

What’s special about the release notes? They are also hosted on our web infrastructure (like the distributions and the current location of the checksum files.)

[Jesper_Skov]

Nothing special about the release notes. My bad.

But somewhere different than where the archives are placed.

Many other places I download from use some third-party file service for distribution of archives, but host their web locally. Hence my suggestion.