What the developer wrote
Authored by Craig Raw
update beryx jlink plugin to v4.0.2
What changed, and why it matters
This commit updates a build tool (the Beryx JLink plugin) from version 3.2.1 to 4.0.2 and adjusts the build script syntax to match the new plugin version. It also slightly reorganizes how native library paths are referenced. There is no direct evidence in the commit that this fixes a security vulnerability, but updating build tooling can sometimes address indirect risks such as supply-chain or build-reproducibility issues.
Verify the Beryx JLink 4.0.2 release notes for any security-related fixes. Confirm that the build still produces reproducible, signed installers and that native library extraction behaves identically. No urgent security action is indicated by this commit alone.
Security signals we found
Dependency/plugin version bump (beryx jlink 3.2.1 -> 4.0.2)
Build script API migration only; no application logic changed
No mention of CVE, security fix, or vulnerability in commit message or diff
Evidence from the diff
The diff upgrades the Gradle plugin org.beryx.jlink from 3.2.1 to 4.0.2. The plugin’s API changed: list concatenation with += is replaced by .addAll() calls for jvmArgs, installerOptions, and imageOptions. A local variable drongoNativeDir is introduced in the extractNativeLibraries task. No runtime application code is modified, and no explicit security fix is described.
Changed components
build.gradleBeryx JLink Gradle pluginSparrow Wallet build/packaging pipelineInspect captured patch +13 / −12
diff --git a/build.gradle b/build.gradle
index 9e53dcd..80ea6ca 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,7 +1,7 @@
plugins {
id 'application'
id 'org.openjfx.javafxplugin' version '0.1.0'
- id 'org.beryx.jlink' version '3.2.1'
+ id 'org.beryx.jlink' version '4.0.2'
id 'org.gradlex.extra-java-module-info' version '1.13.1'
id 'io.matthewnelson.kmp.tor.resource-filterjar' version '408.21.0'
}
@@ -248,13 +248,13 @@ jlink {
"--add-reads=org.flywaydb.core=java.desktop"]
if(os.windows) {
- jvmArgs += ["-Djavax.accessibility.assistive_technologies", "-Djavax.accessibility.screen_magnifier_present=false"]
+ jvmArgs.addAll(["-Djavax.accessibility.assistive_technologies", "-Djavax.accessibility.screen_magnifier_present=false"])
}
if(os.macOsX) {
- jvmArgs += ["-Dprism.lcdtext=false", "--add-opens=javafx.graphics/com.sun.glass.ui.mac=com.sparrowwallet.merged.module"]
+ jvmArgs.addAll(["-Dprism.lcdtext=false", "--add-opens=javafx.graphics/com.sun.glass.ui.mac=com.sparrowwallet.merged.module"])
}
if(headless) {
- jvmArgs += ["-Dglass.platform=Headless"]
+ jvmArgs.addAll(["-Dglass.platform=Headless"])
}
}
addExtraDependencies("javafx")
@@ -266,8 +266,8 @@ jlink {
imageOptions = []
installerOptions = ['--file-associations', 'src/main/deploy/psbt.properties', '--file-associations', 'src/main/deploy/txn.properties', '--file-associations', 'src/main/deploy/asc.properties', '--license-file', 'LICENSE']
if(os.windows) {
- installerOptions += ['--win-per-user-install', '--win-dir-chooser', '--win-menu', '--win-menu-group', 'Sparrow', '--win-shortcut', '--resource-dir', 'src/main/deploy/package/windows/']
- imageOptions += ['--icon', 'src/main/deploy/package/windows/sparrow.ico']
+ installerOptions.addAll(['--win-per-user-install', '--win-dir-chooser', '--win-menu', '--win-menu-group', 'Sparrow', '--win-shortcut', '--resource-dir', 'src/main/deploy/package/windows/'])
+ imageOptions.addAll(['--icon', 'src/main/deploy/package/windows/sparrow.ico'])
installerType = "msi"
}
if(os.linux) {
@@ -276,14 +276,14 @@ jlink {
installerOptions = ['--license-file', 'LICENSE']
} else {
installerName = "sparrowwallet"
- installerOptions += ['--linux-shortcut', '--linux-menu-group', 'Sparrow']
+ installerOptions.addAll(['--linux-shortcut', '--linux-menu-group', 'Sparrow'])
}
- installerOptions += ['--resource-dir', layout.buildDirectory.dir('deploy/package').get().asFile.toString(), '--linux-app-category', 'utils', '--linux-app-release', '1', '--linux-rpm-license-type', 'ASL 2.0', '--linux-deb-maintainer', 'mail@sparrowwallet.com']
- imageOptions += ['--icon', 'src/main/deploy/package/linux/Sparrow.png', '--resource-dir', 'src/main/deploy/package/linux/']
+ installerOptions.addAll(['--resource-dir', layout.buildDirectory.dir('deploy/package').get().asFile.toString(), '--linux-app-category', 'utils', '--linux-app-release', '1', '--linux-rpm-license-type', 'ASL 2.0', '--linux-deb-maintainer', 'mail@sparrowwallet.com'])
+ imageOptions.addAll(['--icon', 'src/main/deploy/package/linux/Sparrow.png', '--resource-dir', 'src/main/deploy/package/linux/'])
}
if(os.macOsX) {
- installerOptions += ['--mac-sign', '--mac-signing-key-user-name', 'Craig Raw (UPLVMSK9D7)']
- imageOptions += ['--icon', 'src/main/deploy/package/macos/sparrow.icns', '--resource-dir', 'src/main/deploy/package/macos/']
+ installerOptions.addAll(['--mac-sign', '--mac-signing-key-user-name', 'Craig Raw (UPLVMSK9D7)'])
+ imageOptions.addAll(['--icon', 'src/main/deploy/package/macos/sparrow.icns', '--resource-dir', 'src/main/deploy/package/macos/'])
installerType = "dmg"
}
}
@@ -405,12 +405,13 @@ def nativeLibJars = [
tasks.register('extractNativeLibraries') {
dependsOn 'jlink'
+ def drongoNativeDir = "${project(':drongo').projectDir}/src/main/resources/native/${osName}/${osArch}"
doLast {
def imageLib = file("$buildDir/image/lib")
// Project-owned natives
copy {
- from "${project(':drongo').projectDir}/src/main/resources/native/${osName}/${osArch}", "src/main/resources/native/${osName}/${osArch}"
+ from drongoNativeDir, "src/main/resources/native/${osName}/${osArch}"
into imageLib
eachFile { it.permissions { unix('rw-r--r--') } }
}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.