KAFKA-21299: Upgrade Gradle to 9.8.2 and fetch the wrapper jar from a pinned commit (#23770)

Reviewers: Mickael Maison <mickael.maison@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

gradle/dependencies.gradle

@@ -58,7 +58,7 @@ versions += [
   commonsValidator: "1.11.0",
   commonsNet: "3.13.0",
   classgraph: "4.8.196",
-  gradle: "9.7.1",
+  gradle: "9.8.2",
   httpclient: "4.5.14",
   jackson: "2.22.4",
   jacksonAnnotations: "2.22",

gradle/wrapper/README.md

@@ -11,21 +11,31 @@ When upgrading the Gradle version used by the Kafka project, update the followin
    gradle: "9.2.0"
    ```
 
-2. **Update wrapper JAR checksum** in `wrapper.gradle`:
+2. **You may have to update the wrapper JAR commit and checksum** in `wrapper.gradle`:
    - Find the ***Wrapper JAR Checksum*** at https://gradle.org/release-checksums/
-   - Update the `wrapperChecksum` variable:
+   - if the Wrapper JAR checksum ***was not changed*** between Gradle versions (old and new) ***skip below to step 3.***
+   - if the Wrapper JAR checksum was changed between Gradle versions (old and new) you will have to change two things:
+   - `wrapperChecksum`to a new value
+   - `wrapperJarCommit` to a specific commit from the Gradle master branch that is missing from the Gradle version’s git release tag:
+     - https://github.com/gradle/gradle/commits/master/gradle/wrapper/gradle-wrapper.jar
+     - https://github.com/gradle/gradle/commits/v<gradle-version>/gradle/wrapper/gradle-wrapper.jar
+   - ***Do not use the release tag*** (`v<gradle-version>`) for `wrapperJarCommit`: it may contain the wrapper JAR of the previous
+     Gradle version, see https://issues.apache.org/jira/browse/KAFKA-21299
    ```groovy
    task bootstrapWrapper() {
        // ... (other code)
        doLast {
            // ... (other code)
+           String wrapperJarCommit = "<gradle-commit-sha>"
            String wrapperChecksum = "<wrapper-jar-sha256-checksum>"
            // ...
        }
    }
    ```
-   - Verify the wrapper JAR URL is accessible at:
-     `https://raw.githubusercontent.com/gradle/gradle/v<gradle-version>/gradle/wrapper/gradle-wrapper.jar`
+   - Verify the wrapper JAR at the commit matches the checksum:
+   ```shell
+   curl -sL https://raw.githubusercontent.com/gradle/gradle/<gradle-commit-sha>/gradle/wrapper/gradle-wrapper.jar | sha256sum
+   ```
 
 
 3. **Regenerate the `gradle/wrapper/gradle-wrapper.properties` and the wrapper script**:

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=acd53f1edaf02f1a8ff99879f8a34b302661a057d9b063ae9e35b552f804d20a
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.1-bin.zip
+distributionSha256Sum=21bd5da2de49b642904077f38c0efdc7778e92b3ed0889392dca61b97e389607
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500

gradlew

@@ -201,10 +201,10 @@ fi
 
 
 # Loop in case we encounter an error.
-REQUIRED_WRAPPER_JAR_CHECKSUM="7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d"
+REQUIRED_WRAPPER_JAR_CHECKSUM="3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98"
 for attempt in 1 2 3; do
   if [ ! -e "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" ]; then
-    if ! curl -s -S --retry 3 -L -o "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" "https://raw.githubusercontent.com/gradle/gradle/v9.7.1/gradle/wrapper/gradle-wrapper.jar"; then
+    if ! curl -s -S --retry 3 -L -o "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" "https://raw.githubusercontent.com/gradle/gradle/dcc5ee0ec88270575344e6afd490f96d96f84ab3/gradle/wrapper/gradle-wrapper.jar"; then
       rm -f "$APP_HOME/gradle/wrapper/gradle-wrapper.jar"
       # Pause for a bit before looping in case the server throttled us.
       sleep 5

wrapper.gradle

@@ -39,9 +39,13 @@ task bootstrapWrapper() {
         // github.com servers deprecated TLSv1/TLSv1.1 support some time ago, so older versions
         // of curl (built against OpenSSL library that doesn't support TLSv1.2) would fail to
         // fetch the jar.
-        // IMPORTANT: This checksum **must** be updated whenever the Gradle version changes.
-        String wrapperChecksum = "7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d"
-        def wrapperJarUrl = "https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar"
+        // The jar is fetched from a pinned commit rather than the release tag: a release tag contains
+        // the bootstrap jar Gradle uses to build itself, which may be from the previous version and then
+        // doesn't match the published wrapper checksum; for more details see gradle/wrapper/README.md
+        // and https://issues.apache.org/jira/browse/KAFKA-21299
+        String wrapperJarCommit = "dcc5ee0ec88270575344e6afd490f96d96f84ab3"
+        String wrapperChecksum = "3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98"
+        def wrapperJarUrl = "https://raw.githubusercontent.com/gradle/gradle/$wrapperJarCommit/gradle/wrapper/gradle-wrapper.jar"
 
         def bootstrapString = """
       # Loop in case we encounter an error.