Class: Dependabot::Maven::FileUpdater::WrapperUpdater

Inherits:
Object
  • Object
show all
Extended by:
T::Sig
Defined in:
lib/dependabot/maven/file_updater/wrapper_updater.rb

Constant Summary collapse

WRAPPER_PROPERTIES_RELATIVE = 
".mvn/wrapper/maven-wrapper.properties"
JAR_RELATIVE = 
".mvn/wrapper/maven-wrapper.jar"
DOWNLOADER_RELATIVE = 
".mvn/wrapper/MavenWrapperDownloader.java"
UNIX_SCRIPTS =

Named constants for all wrapper scripts, split by platform.

Every Unix shell script must have Mode::EXECUTABLE set after the update Windows executables can skip that as it carries no meaning

%w(mvnw mvnwDebug).freeze
WINDOWS_SCRIPTS = 
%w(mvnw.cmd mvnwDebug.cmd).freeze
ALL_SCRIPTS = 
T.let((UNIX_SCRIPTS + WINDOWS_SCRIPTS).freeze, T::Array[String])

Instance Method Summary collapse

Constructor Details

#initialize(dependency_files:, dependency:, credentials:, distribution_version: nil, wrapper_version: nil) ⇒ WrapperUpdater

Returns a new instance of WrapperUpdater.



45
46
47
48
49
50
51
52
53
54
 
# File 'lib/dependabot/maven/file_updater/wrapper_updater.rb', line 45

def initialize(dependency_files:, dependency:, credentials:, distribution_version: nil, wrapper_version: nil)
  @dependency_files = dependency_files
  @dependency       = dependency
  @credentials      = credentials
  # Optional resolved versions. When a grouped update bumps both the distribution and the
  # wrapper plugin, neither dependency alone carries both new versions, so the caller resolves
  # them and passes them in. When nil we fall back to reading them from the dependency.
  @distribution_version_override = distribution_version
  @wrapper_version_override      = wrapper_version
end

Instance Method Details

#update_files(buildfile) ⇒ Object 



60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
 
# File 'lib/dependabot/maven/file_updater/wrapper_updater.rb', line 60

def update_files(buildfile)
  # Return immediately for any non-wrapper dependency.
  return [] unless Distributions.distribution_requirements?(dependency.requirements)
  return [] unless wrapper_properties_file

  # Capture the user's original properties before we mutate the on-disk copy, so we can
  # tell which checksums they were tracking and restore exactly those afterwards.
  original_properties = wrapper_properties_file&.content
  desired_distribution_url = effective_distribution_url(original_properties.to_s)

  SharedHelpers.in_a_temporary_directory(project_root(buildfile)) do
    write_dependency_files

    # Drop both SHA-256 checksum properties before invoking the native command.
    # If they remain, Maven verifies the old checksum against the new version and fails.
    # We recompute and restore them afterwards: the plugin can accept -DdistributionSha256Sum /
    # -DwrapperSha256Sum, but it does not derive the value for us, and Maven Central only
    # publishes SHA-512, so we must download the artifact and compute the SHA-256 ourselves.
    strip_checksum_properties

    distribution_type = distribution_type_from_requirements
    # Run the native wrapper command to regenerate the shell scripts
    run_wrapper_command(distribution_type)

    # Older wrapper plugins ignore -DdistributionUrl and reconstruct a Maven Central URL.
    # Restore the effective URL so custom mirrors survive distribution-only updates too.
    restore_distribution_url(desired_distribution_url)

    # Maven Central only publishes SHA-512 checksums.
    # But the wrapper only supports SHA-256 validation
    # We need compute the SHA-256 digest directly from the artifact
    # and write it into the regenerated properties file.
    restore_checksum_properties(original_properties)

    collect_updated_files(distribution_type)
  end
end