The build tool distribution is verified
build/wrapper-distribution-verified@v1
The Gradle wrapper pins the checksum of the distribution it downloads, so the toolchain cannot be swapped underneath the build.
| Id | build/wrapper-distribution-verified |
| Version | v1 |
| Category | build |
| Default severity | error |
| Interpreter | python3 |
| Timeout | 30 seconds |
| Violations tolerated | 0 |
| Collects | gradle |
Collectors
This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.
| Collector | Gathers | Inputs it is given |
|---|---|---|
gradle | The Gradle build in the project directory: its settings and manifest, every included project, the wrapper and the distribution it pins, the version catalog, and every dependency the build files declare or the lock files resolve, with the versions its platforms supply. | projectDir |
The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.
Configuration
{
"guardrails": {
"failOn": "error",
"comment": true,
"checks": [
{
"use": "build/wrapper-distribution-verified@v1",
"severity": "error",
"with": {
"projectDir": "."
},
"exemptions": []
}
]
}
}Inputs
| Input | Description | Default | Environment variable |
|---|---|---|---|
projectDir | Directory holding the project, relative to the directory the CLI runs in. | . | GUARDRAIL_INPUT_PROJECTDIR |
How to fix
Regenerate the wrapper asking it to record the distribution checksum:
./gradlew wrapper --gradle-version 8.14 --gradle-distribution-sha256-sum <sha>Gradle publishes the checksum for every distribution at https://gradle.org/release-checksums/. Without distributionSha256Sum the wrapper runs whatever the distribution URL serves it, which puts the build tool itself outside the chain of custody the rest of the pipeline maintains.
More in build
build/dependency-updates-configured. The repository configures a tool that opens the dependency update, so upgrades arrive as reviewable pull requests rather than as a task nobody has time for.build/gradle-version-floor. The Gradle version the wrapper pins is at or above the floor the team sets, so the build runs on a toolchain that is still supported.build/runs-on-hosted-ci. The artifact was built by a CI platform rather than on somebody's workstation, so the build is attributable and repeatable.