From mobile apps to microservices, from small startups to big enterprises, Gradle helps teams build, automate and deliver better software, faster.

Gradle Community

Our auto-updater for our custom Gradle distribution started failing. It seems that the `gradle-wrapper-${version}.jar` is gone from `libs` and now there is a `gradle-wrapper-shared-${version}.jar`. This one does not contain any `gradle-wrapper.jar` anymore. We have been verifying the SHA256 of it as part of our automatic repackaging, but it seems this is no longer necessary. Is there more information on this somewhere? Is there anything else we should be doing instead now?

I removed the extra checksum check, which obviously means that everything works again. Are there any plans to introduce release signing? This would help to protect supply chains. The checksums are nice for integrity verification, but receiving both the ZIP and the SHA256 from the same origin does not guarantee authenticity.

~The stable configuration cache flag is still not compatible with the latest <https://github.com/gradle/common-custom-user-data-gradle-plugin|common user data plugin>~ :eyes:

Resolved: <https://github.com/gradle/common-custom-user-data-gradle-plugin/issues/65>

cc: <@UFDR8S97S>