Fixed issue #1778 by removing a hash of the absolute artifact path ap…

…pended to the end of the version string. That hash made artifact version different on different PCs and also breaks Gradle dependency locking.

CHANGELOG.md

@@ -1,6 +1,10 @@
 # Changelog
 
-## [next]
+### Fixed
+
+- Fixed issue #1778 by removing a hash of the absolute artifact path appended to the end of the version string. That hash made artifact version different on different PCs and also breaks Gradle dependency locking.
+
+## [2.1.0]
 
 ### Added
 

api/IntelliJPlatformGradlePlugin.api

@@ -176,6 +176,7 @@ public final class org/jetbrains/intellij/platform/gradle/Constants$Sandbox {
 public final class org/jetbrains/intellij/platform/gradle/Constants$Tasks {
 	public static final field BUILD_PLUGIN Ljava/lang/String;
 	public static final field BUILD_SEARCHABLE_OPTIONS Ljava/lang/String;
+	public static final field CLEAN Ljava/lang/String;
 	public static final field COMPOSED_JAR Ljava/lang/String;
 	public static final field GENERATE_MANIFEST Ljava/lang/String;
 	public static final field INITIALIZE_INTELLIJ_PLATFORM_PLUGIN Ljava/lang/String;

src/integrationTest/kotlin/org/jetbrains/intellij/platform/gradle/DependencyLockingAndVerificationIntegrationTest.kt

@@ -0,0 +1,108 @@
+// Copyright 2000-2024 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license.
+
+package org.jetbrains.intellij.platform.gradle
+
+import kotlin.io.path.fileSize
+import kotlin.io.path.readText
+import kotlin.test.Ignore
+import kotlin.test.Test
+import kotlin.test.assertTrue
+
+/**
+ * Tests dependency locking & verification in combination.
+ * [DependencyLockingIntegrationTest] + [DependencyVerificationIgnoreIntellijIntegrationTest] but no artifacts are
+ * ignored in this test.
+ * [Support dependency verification](https://github.com/JetBrains/intellij-platform-gradle-plugin/issues/1779)
+ */
+class DependencyLockingAndVerificationIntegrationTest : IntelliJPlatformIntegrationTestBase(
+    resourceName = "dependency-locking-and-verification",
+) {
+
+    @Test
+    @Ignore("https://github.com/JetBrains/intellij-platform-gradle-plugin/issues/1779")
+    fun `build plugin with dependency locks & hash verification`() {
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties,
+            args = listOf("--info", "--write-locks", "--write-verification-metadata", "md5,sha1,sha256,sha512")
+        ) {
+            buildDirectory.resolve("../gradle/locks/root/gradle.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+            buildDirectory.resolve("../gradle/locks/root/gradle-buildscript.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+            buildDirectory.resolve("../gradle/locks/root/settings-gradle-buildscript.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+            buildDirectory.resolve("../gradle/verification-metadata.xml").let {
+                assertExists(it)
+                val xmlText = it.readText(Charsets.UTF_8)
+                assertTrue(xmlText.contains("<components>"))
+                assertTrue(xmlText.contains("<component"))
+                assertTrue(xmlText.contains("<artifact"))
+                assertTrue(xmlText.contains("<md5"))
+                assertTrue(xmlText.contains("<sha1"))
+                assertTrue(xmlText.contains("<sha256"))
+                assertTrue(xmlText.contains("<sha512"))
+            }
+        }
+
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties
+        ) {
+            buildDirectory containsFile "libs/test-1.0.0.jar"
+        }
+    }
+
+    @Test
+    @Ignore("https://github.com/JetBrains/intellij-platform-gradle-plugin/issues/1779")
+    fun `build plugin with dependency locks, hash & signature verification`() {
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties,
+            args = listOf("--info", "--write-locks", "--write-verification-metadata", "md5,sha1,sha256,sha512,pgp")
+        ) {
+            buildDirectory.resolve("../gradle/locks/root/gradle.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+            buildDirectory.resolve("../gradle/locks/root/gradle-buildscript.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+            buildDirectory.resolve("../gradle/locks/root/settings-gradle-buildscript.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+            buildDirectory.resolve("../gradle/verification-metadata.xml").let {
+                assertExists(it)
+                val xmlText = it.readText(Charsets.UTF_8)
+                assertTrue(xmlText.contains("<components>"))
+                assertTrue(xmlText.contains("<component"))
+                assertTrue(xmlText.contains("<artifact"))
+                assertTrue(xmlText.contains("<md5"))
+                assertTrue(xmlText.contains("<sha1"))
+                assertTrue(xmlText.contains("<sha256"))
+                assertTrue(xmlText.contains("<sha512"))
+                assertTrue(xmlText.contains("<trusted-keys>"))
+                assertTrue(xmlText.contains("<trusted-key"))
+            }
+        }
+
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties
+        ) {
+            buildDirectory containsFile "libs/test-1.0.0.jar"
+        }
+    }
+}

src/integrationTest/kotlin/org/jetbrains/intellij/platform/gradle/DependencyLockingIntegrationTest.kt

@@ -0,0 +1,46 @@
+// Copyright 2000-2024 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license.
+
+package org.jetbrains.intellij.platform.gradle
+
+import kotlin.io.path.fileSize
+import kotlin.test.Test
+import kotlin.test.assertTrue
+
+/**
+ * [Support for dependency locking, do not use absolute paths](https://github.com/JetBrains/intellij-platform-gradle-plugin/issues/1778)
+ */
+class DependencyLockingIntegrationTest : IntelliJPlatformIntegrationTestBase(
+    resourceName = "dependency-locking",
+) {
+
+    @Test
+    fun `build plugin with dependency locks`() {
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties,
+            args = listOf("--info", "--write-locks")
+        ) {
+            buildDirectory.resolve("../gradle/locks/root/gradle.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+            buildDirectory.resolve("../gradle/locks/root/gradle-buildscript.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+            buildDirectory.resolve("../gradle/locks/root/settings-gradle-buildscript.lockfile").let {
+                assertExists(it)
+                assertTrue(0 < it.fileSize())
+            }
+        }
+
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties
+        ) {
+            buildDirectory containsFile "libs/test-1.0.0.jar"
+        }
+    }
+}

src/integrationTest/kotlin/org/jetbrains/intellij/platform/gradle/DependencyVerificationIgnoreIntellijIntegrationTest.kt

@@ -0,0 +1,84 @@
+// Copyright 2000-2024 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license.
+
+package org.jetbrains.intellij.platform.gradle
+
+import kotlin.io.path.readText
+import kotlin.test.Ignore
+import kotlin.test.Test
+import kotlin.test.assertTrue
+
+/**
+ * For this test `src/integrationTest/resources/dependency-verification-ignore-intellij/gradle/verification-metadata.xml`
+ * adds "bundledModule" & "bundledPlugin" to trusted artifacts, so that we can test dependency locking & verification
+ * in isolation from Intellij Artifacts.
+ *
+ * [Support for dependency locking, do not use absolute paths](https://github.com/JetBrains/intellij-platform-gradle-plugin/issues/1778)
+ * [Support dependency verification](https://github.com/JetBrains/intellij-platform-gradle-plugin/issues/1779)
+ * @see DependencyLockingIntegrationTest
+ * @see DependencyLockingAndVerificationIntegrationTest
+ */
+class DependencyVerificationIgnoreIntellijIntegrationTest : IntelliJPlatformIntegrationTestBase(
+    resourceName = "dependency-verification-ignore-intellij",
+) {
+
+    @Test
+    fun `build plugin with dependency locks & hash verification ignoring intellij artifacts`() {
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties,
+            args = listOf("--info", "--write-verification-metadata", "md5,sha1,sha256,sha512")
+        ) {
+            buildDirectory.resolve("../gradle/verification-metadata.xml").let {
+                assertExists(it)
+                val xmlText = it.readText(Charsets.UTF_8)
+                assertTrue(xmlText.contains("<components>"))
+                assertTrue(xmlText.contains("<component"))
+                assertTrue(xmlText.contains("<artifact"))
+                assertTrue(xmlText.contains("<md5"))
+                assertTrue(xmlText.contains("<sha1"))
+                assertTrue(xmlText.contains("<sha256"))
+                assertTrue(xmlText.contains("<sha512"))
+            }
+        }
+
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties
+        ) {
+            buildDirectory containsFile "libs/test-1.0.0.jar"
+        }
+    }
+
+    @Test
+    @Ignore("https://github.com/JetBrains/intellij-platform-gradle-plugin/issues/1779")
+    fun `build plugin with dependency locks, hash & signature verification ignoring intellij artifacts`() {
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties,
+            args = listOf("--info", "--write-verification-metadata", "md5,sha1,sha256,sha512,pgp")
+        ) {
+            buildDirectory.resolve("../gradle/verification-metadata.xml").let {
+                assertExists(it)
+                val xmlText = it.readText(Charsets.UTF_8)
+                assertTrue(xmlText.contains("<components>"))
+                assertTrue(xmlText.contains("<component"))
+                assertTrue(xmlText.contains("<artifact"))
+                assertTrue(xmlText.contains("<md5"))
+                assertTrue(xmlText.contains("<sha1"))
+                assertTrue(xmlText.contains("<sha256"))
+                assertTrue(xmlText.contains("<sha512"))
+            }
+        }
+
+        build(
+            Constants.Tasks.CLEAN,
+            Constants.Tasks.BUILD_PLUGIN,
+            projectProperties = defaultProjectProperties
+        ) {
+            buildDirectory containsFile "libs/test-1.0.0.jar"
+        }
+    }
+}

src/integrationTest/resources/dependency-locking-and-verification/build.gradle.kts

@@ -0,0 +1,69 @@
+// Copyright 2000-2024 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license.
+import org.jetbrains.intellij.platform.gradle.TestFrameworkType
+
+val intellijPlatformTypeProperty = providers.gradleProperty("intellijPlatform.type")
+val intellijPlatformVersionProperty = providers.gradleProperty("intellijPlatform.version")
+
+version = "1.0.0"
+
+plugins {
+    id("org.jetbrains.kotlin.jvm")
+    id("org.jetbrains.intellij.platform")
+}
+
+kotlin {
+    jvmToolchain(17)
+}
+
+buildscript {
+    // https://docs.gradle.org/current/userguide/dependency_locking.html
+    dependencyLocking {
+        lockAllConfigurations()
+        lockFile = file("gradle/locks/root/gradle-buildscript.lockfile")
+        lockMode.set(LockMode.DEFAULT)
+        //ignoredDependencies.add()
+    }
+}
+// https://docs.gradle.org/current/userguide/dependency_locking.html
+dependencyLocking {
+    lockAllConfigurations()
+    // There seems to be no way to customize the location of settings-gradle.lockfile
+    lockFile = file("gradle/locks/root/gradle.lockfile")
+    lockMode.set(LockMode.DEFAULT)
+}
+
+repositories {
+    mavenCentral()
+
+    intellijPlatform {
+        defaultRepositories()
+    }
+}
+
+dependencies {
+    intellijPlatform {
+        create(intellijPlatformTypeProperty, intellijPlatformVersionProperty)
+        instrumentationTools()
+        testFramework(TestFrameworkType.Platform)
+
+        // This is important for bug reproduction because we need some dependencies in the test
+        bundledPlugins(
+            "com.intellij.copyright",
+            "com.intellij.java",
+            "com.intellij.gradle",
+            "com.intellij.properties",
+            "org.intellij.groovy",
+            "com.intellij.java-i18n",
+            "JUnit",
+            "org.jetbrains.idea.maven",
+            "org.jetbrains.idea.eclipse"
+        )
+    }
+}
+
+intellijPlatform {
+    buildSearchableOptions = false
+    instrumentCode = false
+}
+
+

src/integrationTest/resources/dependency-locking-and-verification/gradle.properties

@@ -0,0 +1,2 @@
+# Copyright 2000-2024 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license.
+kotlin.stdlib.default.dependency=false

src/integrationTest/resources/dependency-locking-and-verification/gradle/verification-metadata.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright 2000-2024 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license. -->
+<!-- https://github.com/JetBrains/intellij-platform-gradle-plugin/issues/1779 -->
+<verification-metadata xmlns="https://schema.gradle.org/dependency-verification" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="https://schema.gradle.org/dependency-verification https://schema.gradle.org/dependency-verification/dependency-verification-1.3.xsd">
+   <configuration>
+      <verify-metadata>true</verify-metadata>
+      <verify-signatures>false</verify-signatures>
+      <keyring-format>armored</keyring-format>
+      <key-servers>
+         <key-server uri="https://keyserver.ubuntu.com"/>
+      </key-servers>
+   </configuration>
+</verification-metadata>

src/integrationTest/resources/dependency-locking-and-verification/settings.gradle.kts

@@ -0,0 +1,12 @@
+// Copyright 2000-2024 JetBrains s.r.o. and contributors. Use of this source code is governed by the Apache 2.0 license.
+rootProject.name = "test"
+
+buildscript {
+    // https://docs.gradle.org/current/userguide/dependency_locking.html
+    dependencyLocking {
+        lockAllConfigurations()
+        lockFile = file("gradle/locks/root/settings-gradle-buildscript.lockfile")
+        lockMode.set(LockMode.DEFAULT)
+        //ignoredDependencies.add()
+    }
+}