I don’t want to commit the gradle wrapper to VCS¹. Which gradle files could be git-ignored so other users have the least troubles setting up their environment? I’m specifically wondering about gradle/wrapper/gradle-wrapper.properties which may or may not be useful, since it seems to hold the URL to the distribution and its version.
Here’s my current gitignore:
/gradlew
/gradlew.bat
/gradle/wrapper/*
!/gradle/wrapper/gradle-wrapper.properties # not sure about this
Does it look right?
¹ Why?
(not relevant, but I anticipate answers beside the point, I’m not looking to negociate)
Even though it is recommended by the Gradle team themselves, comitting the wrapper to VCS sounds like a really bad idea:
- Binary files could hide malware (the xzorcist/CVE-2024-3094 exploit used an archive to hide its payload)
- This file take unreclaimable space, when it could just be downloaded from elsewhere, like all other project dependencies or the JDK itself
- It doesn’t make builds more reproducible than what other package managers do with their
package-lock.jsonorCargo.lock(download URL + checksum), I don’t understand this argument from the Gradle team - The JDK is crucial to develop a Java project too, yet we don’t push it to VCS. Same goes for the gradle dependencies themselves, most people don’t vendor them, for good reasons.