8389847: Gradle project import fails dependency verification

[mstr2]

Loading the project in IntelliJ fails during Gradle synchronization with dependency verification errors for Groovy 4.0.28 artifacts. A normal command-line task such as gradlew help does not reproduce the problem because it does not request source artifacts for Gradle’s bundled Groovy libraries. The underlying cause is that the Gradle 9.2 upgrade introduced Groovy 4.0.28, but the committed verification metadata was never expanded for the metadata files used specifically during IDE source resolution.

When IntelliJ imports the project with source downloading enabled, Gradle attempts to attach sources for its local Groovy dependencies. Gradle performs this resolution through its internal repository named Gradle Libs. The project enables verification of dependency metadata:

<verify-metadata>true</verify-metadata>

Source JARs are already trusted by the existing *-sources.jar rule. Resolving those JARs, however, also requires Gradle module metadata and the Groovy BOM metadata. These .module and .pom files are not present in verification-metadata.xml, so Gradle rejects them.

This problem is fixed by adding checksums for the module metadata of every Groovy 4.0.28 library bundled with Gradle 9.2.

---

• I confirm that I make this contribution in accordance with the OpenJDK Interim AI Policy.

---

Progress

• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• Change must be properly reviewed (2 reviews required, with at least 1 Reviewer, 1 Author)

Issue

• JDK-8389847: Gradle project import fails dependency verification (Bug - P4)

Reviewers

• Marius Hanl (@Maran23 - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jfx.git pull/2247/head:pull/2247
$ git checkout pull/2247

Update a local copy of the PR:
$ git checkout pull/2247
$ git pull https://git.openjdk.org/jfx.git pull/2247/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 2247

View PR using the GUI difftool:
$ git pr show -t 2247

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jfx/pull/2247.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back mstrauss! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

[openjdk]

The total number of required reviews for this PR has been set to 2 based on the presence of this label: rfr. This can be overridden with the /reviewers command.

[mlbridge]

Webrevs

• 01: Full - Incremental (4f299e8e)
• 00: Full (f09b690a)

[Maran23]

I also have this issue and solved it by adding:
<trust file=".*groovy.*" regex="true"/>,
which really is not a good solution but worked for me. So thanks for solving this!

I can confirm this fixes the issue and is the correct way.

One question: How can we generate those entries in the future, e.g. for new Gradle versions?
When I run the command in the README.txt next to verification-metadata.xml, those entries are not added for me. Maybe we should update / add the steps into this file for the future?

[mstr2]

One question: How can we generate those entries in the future, e.g. for new Gradle versions? When I run the command in the README.txt next to verification-metadata.xml, those entries are not added for me. Maybe we should update / add the steps into this file for the future?

I've added a section to gradle/README.txt

[nlisker]

When I generate the verification metadata, I get entries that are different than yours: verification-metadata.xml. Do we add the entries that are required by all IDEs?

[mstr2]

When I generate the verification metadata, I get entries that are different than yours: verification-metadata.xml. Do we add the entries that are required by all IDEs?

Well, you do get the same entries for Groovy, which is good. I see no reason not to add entries that are required by other IDEs, as otherwise working with JavaFX is just gets a little harder. The alternative to adding individual entries is a blanket <trust/> entry (see Marius' comment).

[nlisker]

In this PR do you only want to add the Groovy dependencies without the IDE ones?

[mstr2]

In this PR do you only want to add the Groovy dependencies without the IDE ones?

For this PR, I'm only adding the dependencies that are required to make JavaFX work with IntelliJ. I'm not familiar with other IDEs and how people use them with JavaFX, so that's something I'd leave for others to figure out.

[kevinrushforth]

@arapte I believe you use IntelliJ. Can you review this?

[kevinrushforth]

FWIW, this seems fine to me.