Further build file improvements #201

Merged
MateusRodCosta merged 4 commits from further-build-file-improvements into main 2025-12-30 23:59:26 +03:00
MateusRodCosta commented 2025-12-03 20:46:47 +03:00 (Migrated from github.com)
No description provided.
TJYSunset commented 2025-12-06 08:59:53 +03:00 (Migrated from github.com)

Don't want to install a new SDK version now, so I'm leaving this PR for later.

FYI, replacing the Gradle wrapper is a suspicious action. Although I believe you're genuinely trying to help and the JAR checksum seems good, Gradle doesn't seem to provide a way to verify the scripts, so it'll still be more difficult to review a PR than upgrading myself.

Don't want to install a new SDK version now, so I'm leaving this PR for later. FYI, [replacing the Gradle wrapper is a suspicious action](https://blog.gradle.org/wrapper-attack-report). Although I believe you're genuinely trying to help and the JAR checksum seems good, Gradle doesn't seem to provide a way to verify the scripts, so it'll still be more difficult to review a PR than upgrading myself.
MateusRodCosta commented 2025-12-06 17:01:23 +03:00 (Migrated from github.com)

FYI, replacing the Gradle wrapper is a suspicious action. Although I believe you're genuinely trying to help and the JAR checksum seems good

That's fair, which is why I linked to https://docs.gradle.org/current/userguide/gradle_wrapper.html#wrapper_checksum_verification on that commit.
However I do know that there's a Github action to check the gradle wrapper: https://github.com/marketplace/actions/build-with-gradle#the-wrapper-validation-action

If you think it's best, I can just remove the Gradle update commit and you can do it on your own in a future point in time.

Gradle doesn't seem to provide a way to verify the scripts, so it'll still be more difficult to review a PR than upgrading myself.

That's true, though from the diff it seems that barely anything changed. Mostly changes on how the gradle wrapper is invoked and formatting changes.

> FYI, [replacing the Gradle wrapper is a suspicious action](https://blog.gradle.org/wrapper-attack-report). Although I believe you're genuinely trying to help and the JAR checksum seems good That's fair, which is why I linked to https://docs.gradle.org/current/userguide/gradle_wrapper.html#wrapper_checksum_verification on that commit. However I do know that there's a Github action to check the gradle wrapper: https://github.com/marketplace/actions/build-with-gradle#the-wrapper-validation-action If you think it's best, I can just remove the Gradle update commit and you can do it on your own in a future point in time. > Gradle doesn't seem to provide a way to verify the scripts, so it'll still be more difficult to review a PR than upgrading myself. That's true, though from the diff it seems that barely anything changed. Mostly changes on how the gradle wrapper is invoked and formatting changes.
MateusRodCosta commented 2025-12-29 19:32:39 +03:00 (Migrated from github.com)

For now I just rebased the branch so I could remove the commit about updating Gradle.
Please consider upgrading to Gradle 9 at your earliest convenience if your project isn't incompatible!

For now I just rebased the branch so I could remove the commit about updating Gradle. Please consider upgrading to Gradle 9 at your earliest convenience if your project isn't incompatible!
TJYSunset commented 2025-12-31 01:37:26 +03:00 (Migrated from github.com)

Please consider upgrading to Gradle 9 at your earliest convenience if your project isn't incompatible!

Done. But why is that an urgent matter? Is there some vulnerability I don't know of?

> Please consider upgrading to Gradle 9 at your earliest convenience if your project isn't incompatible! Done. But why is that an urgent matter? Is there some vulnerability I don't know of?
MateusRodCosta commented 2025-12-31 02:07:18 +03:00 (Migrated from github.com)

Done. But why is that an urgent matter? Is there some vulnerability I don't know of?

You have a point. It's not as much that it's urgent or that there's a important patched vulnerability.

It's more on the nature that this project is in maintenance mode but still receiving PRs.

It's feature complete enough to not really need updates constantly, but if it goes, for example, some 3 months or more without any changes, then it would be nice if I at least it was somewhat "modern" enough (on relation to how is built) compared to what was available at the time.

Tbf that's some of my logic on how I handle dependencies or tooling/SDKs on my own projects, I try to be as modern as it makes sense at that point in time.

> Done. But why is that an urgent matter? Is there some vulnerability I don't know of? You have a point. It's not as much that it's urgent or that there's a important patched vulnerability. It's more on the nature that this project is in maintenance mode but still receiving PRs. It's feature complete enough to not really need updates constantly, but if it goes, for example, some 3 months or more without any changes, then it would be nice if I at least it was somewhat "modern" enough (on relation to how is built) compared to what was available at the time. Tbf that's some of my logic on how I handle dependencies or tooling/SDKs on my own projects, I try to be as modern as it makes sense at that point in time.
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
novvux/Blissid!201
No description provided.