CODEWITHSUNDEEP
securitygradle
ligi
ligi

Reputation: 39539

At what point is gradle distributionSha256Sum checked

I want to add distributionSha256Sum to my project - so I added 

distributionSha256Sum=203f4537da8b8075e38c036a6d14cb71b1149de5bf0a8f6db32ac2833a1d1294

to gradle-wrapper.properties

but then I wanted to trigger an error and changed the hash. It did not produce any error when building. Even after deleting .gradle I could still build. So when exactly is this hash checked?

Upvotes: 2

Views: 2185

Answers (1)

Robert
Robert

Reputation: 42734

Checksum Verification is only performed if the configured Wrapper distribution hasn’t been downloaded yet. https://docs.gradle.org/current/userguide/gradle_wrapper.html

Therefore just changing the hash and then triggering a rebuild does not trigger a hash check.

You have to clear the gradle wrapper cache in your home directory (~/.gradle/wrapper/dists) or at least remove the used gradle version from that cache.

Upvotes: 2

Related Questions