java: Only verify dependencies strictly in CI+Docker

Some IDEs download additional artifacts that a plain command-line
Gradle build won't use, which means Gradle won't automatically manage
them in verification-metadata.xml either. Compromise by only strictly
checking dependencies at certain boundaries, rather than on every
build action.

Author: jrose-signal

.github/workflows/build_and_test.yml

@@ -276,7 +276,7 @@ jobs:
     - name: Verify that the JNI bindings are up to date
       run: rust/bridge/jni/bin/gen_java_decl.py --verify
 
-    - run: ./gradlew build assembleAndroidTest android:lintDebug -PandroidArchs=arm,arm64 | tee ./gradle-output.txt
+    - run: ./gradlew --dependency-verification strict build assembleAndroidTest android:lintDebug -PandroidArchs=arm,arm64 | tee ./gradle-output.txt
       working-directory: java
       shell: bash # Explicitly setting the shell turns on pipefail in GitHub Actions
 

java/Makefile

@@ -11,6 +11,7 @@ default: java_build
 
 DOCKER_IMAGE := libsignal-builder
 DOCKER_TTY_FLAG := $$(test -t 0 && echo -it)
+GRADLE_OPTIONS ?= --dependency-verification strict
 CROSS_COMPILE_SERVER ?= -PcrossCompileServer
 
 docker_image:
@@ -22,7 +23,7 @@ java_build: docker_image
 		--env LIBSIGNAL_TESTING_RUN_NONHERMETIC_TESTS \
 		--env LIBSIGNAL_TESTING_PROXY_SERVER \
         -v `cd .. && pwd`/:/home/libsignal/src $(DOCKER_EXTRA) $(DOCKER_IMAGE) \
-        sh -c "cd src/java; ./gradlew build $(CROSS_COMPILE_SERVER)"
+        sh -c "cd src/java; ./gradlew $(GRADLE_OPTIONS) build $(CROSS_COMPILE_SERVER)"
 
 publish_java: DOCKER_EXTRA = $(shell [ -L build ] && P=$$(readlink build) && echo -v $$P/:$$P )
 publish_java: docker_image
@@ -34,7 +35,7 @@ publish_java: docker_image
 		-e ORG_GRADLE_PROJECT_signingPassword \
 		-e ORG_GRADLE_PROJECT_signingKey \
 		$(DOCKER_IMAGE) \
-		sh -c "cd src/java; ./gradlew publish closeAndReleaseStagingRepositories $(CROSS_COMPILE_SERVER)"
+		sh -c "cd src/java; ./gradlew $(GRADLE_OPTIONS) publish closeAndReleaseStagingRepositories $(CROSS_COMPILE_SERVER)"
 
 # We could run these through Docker, but they would have the same result anyway.
 

java/gradle.properties

@@ -1,5 +1,7 @@
 android.enableAdditionalTestOutput=true
 android.useAndroidX=true
+# Downgrade dependency verification by default (we turn it back to strict in CI and pre-commit checking).
+org.gradle.dependency.verification=lenient
 # Don't rely on the HTML output; that's not useful in CI.
 org.gradle.dependency.verification.console=verbose
-org.gradle.jvmargs=-Xmx4g -Xms256m -XX:MaxMetaspaceSize=1g
+org.gradle.jvmargs=-Xmx4g -Xms256m -XX:MaxMetaspaceSize=1g

justfile

@@ -56,6 +56,7 @@ check-pre-commit: check-format-all
     (cd node && npm run lint)
     (cd swift && ./verify_error_codes.sh)
     (cd swift && swiftlint lint --strict)
+    (cd java && ./gradlew --dependency-verification strict help >/dev/null)
     cargo test --workspace --all-features --verbose --no-fail-fast -- --include-ignored
     cargo clippy --workspace --all-targets --all-features --keep-going -- -D warnings
     @printf "\e[32mBasic pre-commit checks passed! ✅ Hopefully good to push! 🤞\e[0m\n"