Gradle Build Does Not Work

[devcontainers]

Gradle Build Does Not Work

[schrum2]

Agreed. The problem still isn't fixed, so I keep working around by uninstalling/reinstalling gradle for every new codespace I make, despite the reintroduction of the security vulnerability.

Makes me wonder if the default version of gradle or some other component could be changed/lowered to avoid this. It seems odd that such a major build tool simply can't be used.

[samruddhikhandale]

Planning to release this image today/tomorrow (with gradle 8) which should fix the issue/
#422

[schrum2]

I just made a new codespace, and I can confirm that Gradle 8.0 was installed and the basic gradle commands worked without any problem! Thanks!

[samruddhikhandale]

Hi 👋

Looks like a regression due to #269. According to CVE-2022-36033, jsoup jar file with version less than 1.53 contains a security vulnerability. Hence, the universal image includes a patch for it.

I had reported this issue in gradle/gradle#23316.
Looks like we'd need to wait for gradle version 8 to support this.

However, do you mind creating an issue with gradle and see if they could support [email protected] in current v7*?

In the meanwhile, you could avoid this issue by pinning to an older universal:2.1.2 image to fix this. However, your devcontainer will be at security risk due to CVE-2022-36033.

[schrum2]

I found that I could fix this with sdk uninstall gradle 7.6 followed by sdk install gradle. Does this reintroduce the security vulnerability?

[samruddhikhandale]

I found that I could fix this with sdk uninstall gradle 7.6 followed by sdk install gradle. Does this reintroduce the security vulnerability?

Yep, because the jsoup jar file is installed within the gradle folder for v7.6.

[samruddhikhandale]

Closing as stale. Feel free to reopen the issue if needed.

[madhead]

It's still an issue. GitHub support sent me here regarding this issue. Also, an issue in Gradle repo: gradle/gradle#23730

[samruddhikhandale]

Apologies for the inconvenience, looks like gradle has a prerelease for 8.0 - https://github.com/gradle/gradle/releases
We can expect an official release soon, I'll ensure to quickly update the images.

In the meanwhile, can you add the following to you devcontainer.json to help you get inblocked?

"features": {
    "ghcr.io/devcontainers/features/java:1": {
        "installGradle": true
    }
}

ℹ️ This would reintroduce the security vulnerability but will help you get unblocked.

[samruddhikhandale]

universal image is updated to include gradle v8.
The issue should be resolved with vulnerability patched for jsoup