pin the gradle distribution checksum in the wrapper properties
What the developer wrote
Authored by Craig Raw
pin the gradle distribution checksum in the wrapper properties
What changed, and why it matters
This commit adds a cryptographic fingerprint (SHA-256 checksum) to the project's Gradle wrapper configuration. The wrapper is the tool that downloads the Gradle build system when developers compile the wallet. Pinning the checksum helps ensure that a compromised or tampered Gradle download is detected before it can run during the build process. Two Git submodules named drongo and lark were also updated, but no details about their changes are provided in the diff.
Verify the pinned SHA-256 against Gradle's official published checksum for 9.1.0-bin. Review the drongo and lark submodule commits separately to confirm they do not introduce unrelated changes. Consider this a routine hardening improvement rather than an active vulnerability fix.
Security signals we found
Adds SHA-256 checksum pinning for Gradle wrapper distribution
May reduce risk of malicious or corrupted Gradle distribution being executed during build
Submodule updates are opaque in this diff; their security relevance is unverified
Evidence from the diff
The change sets distributionSha256Sum in gradle/wrapper/gradle-wrapper.properties to the known SHA-256 hash of gradle-9.1.0-bin.zip, enabling the Gradle wrapper to verify the downloaded distribution. This is a supply-chain hardening measure. The commit also bumps submodule pointers for drongo and lark; the diff does not show what those submodule commits contain.
Changed components
gradle/wrapper/gradle-wrapper.propertiesdrongo submodulelark submoduleInspect captured patch +3 / −2
### drongo
@@ -1 +1 @@
-Subproject commit 7f0e5630a68c5b1487bb4b4ba40fdc72ea4307f7
+Subproject commit 350dd874da946aadc91188c8a062c5911046d8df
### gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,7 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-9.1.0-bin.zip
+distributionSha256Sum=a17ddd85a26b6a7f5ddb71ff8b05fc5104c0202c6e64782429790c933686c806
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
### lark
@@ -1 +1 @@
-Subproject commit d4fdf4dac185cef22b4446ab33734f9fab99fdf2
+Subproject commit f2b6b6624752bf195d9d506f7ee07d2e65a90a03Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.