gradlereg

Documentation

Overview

Package gradlereg asks services.gradle.org what it knows about the Gradle distribution a gradle-wrapper.properties diff pins. There is no OSV ecosystem and no deps.dev system for the Gradle distribution itself, so this package IS the metadata layer for wrapper pins:

• Release ages, from the version's own buildTime in /versions/all (the official version index Gradle's tooling uses).
• Broken releases: the index marks releases the Gradle project has withdrawn as broken → the deprecation lane.
• Unlisted detection: a version absent from the index while the index itself is healthy is real evidence — released Gradle versions are never removed (1.0-milestone-4 is still listed). Absence is re-proven with an uncached fetch AND a live probe of the distribution zip itself before any claim; snapshot/nightly builds (timestamped versions) are exempt, since old snapshots are routinely pruned.
• Checksum cross-check: when the wrapper pins distributionSha256Sum, it is compared against the checksum Gradle actually publishes for that version (both -bin and -all distributions). A pin matching neither is the wrapper-tampering shape — the wrapper will happily verify a poisoned distribution against a poisoned checksum — and lands in the same ‼ lane as moved release tags. Mismatch evidence is re-proven with uncached fetches before any claim; a match renders as a positive ✔.

services.gradle.org sends Access-Control-Allow-Origin: *, so this layer also works in the browser (wasm) playground.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)
• func Latest(name string) (string, error)
• func ResetForTesting()

Variables

var BaseURL = "https://services.gradle.org"

BaseURL is the Gradle version-index host; a var so tests can fake it.

var Enabled = true

Enabled gates the whole layer.

var Now = time.Now

Now is the clock; a var so tests can pin it.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills Gradle version-index metadata on the diffs; see the package comment for what it covers. The returned bool reports whether the index was actually consulted for at least one pin.

func Latest

func Latest(name string) (string, error)

Latest resolves the current stable Gradle version for pkg mode.

func ResetForTesting

func ResetForTesting()

ResetForTesting clears run-scoped memoization.