amethyst/gradle/wrapper/gradle-wrapper.properties at bd1a6dbf2df609fbc47aa417002e45983767e02d - amethyst - Gitea on NOSTR

laantungir/amethyst

mirror of https://github.com/vitorpamplona/amethyst.git synced 2026-08-09 16:14:40 +00:00

Files

T

Claude e7f883f08b fix(hooks): seed Gradle distribution from a verified mirror in web sandbox

Claude Code Web routes github.com through a git-only proxy, so the Gradle
wrapper's distributionUrl (services.gradle.org, which 307-redirects to a
github.com release asset) can't bootstrap — it 403s even at Full network
access, and `./gradlew` fails before running any task.

Seed the pinned distribution in the existing web-only SessionStart hook,
reusing the same idempotent curl-download pattern already used there for the
Android SDK and Kotlin/Native deps: skip if already installed, else fetch
Gradle's OFFICIAL sha256 (served from services.gradle.org, reachable here),
download the zip from a mirror, and verify before extracting so a tampered or
wrong mirror file is rejected and never executed. The wrapper cache dir is
derived as base36(md5(distributionUrl)) so it survives version bumps.

Also pin distributionSha256Sum in gradle-wrapper.properties as defense in
depth: Gradle then verifies any distribution it installs (mirror-seeded, CI,
or local) against the known-good hash.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A7bocRTSPyXwz6zVMzDbKR

2026-07-17 02:11:56 +00:00

8 lines

319 B

Properties

Raw Blame History

 #Wed Jan 04 09:23:50 EST 2023
 distributionBase=GRADLE_USER_HOME
 distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.0-bin.zip
 distributionSha256Sum=553c78f50dafcd54d65b9a444649057857469edf836431389695608536d6b746
 distributionPath=wrapper/dists
 zipStorePath=wrapper/dists
 zipStoreBase=GRADLE_USER_HOME