feat(GradleInspector): Custom JDK bootstrap download #11039

heliocastro · 2025-11-03T08:15:44Z

Environments that are not allowed access to the open internet cannot use the Foojay discovery service, rendering the bootstrap feature invalid.

This pull request allows specifying a custom JDK URL to be downloaded tied to the javaVersion specified.

.github/workflows/docker-build.yml

utils/ort/src/main/kotlin/JavaBootstrapper.kt

codecov · 2025-11-03T09:03:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.42%. Comparing base (53c2023) to head (474a515).

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #11039   +/-   ##
=========================================
  Coverage     57.42%   57.42%           
+ Complexity     1705     1703    -2     
=========================================
  Files           346      346           
  Lines         12842    12842           
  Branches       1217     1217           
=========================================
  Hits           7374     7374           
  Misses         4999     4999           
  Partials        469      469

Flag	Coverage Δ
funTest-external-tools	`13.52% <ø> (-0.01%)`	⬇️
funTest-no-external-tools	`31.06% <ø> (-0.11%)`	⬇️
test-ubuntu-24.04	`42.34% <ø> (ø)`
test-windows-2025	`42.32% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

plugins/package-managers/gradle-inspector/src/main/kotlin/GradleInspector.kt

sschuberth · 2025-11-03T09:32:57Z

plugins/package-managers/gradle-inspector/src/main/kotlin/GradleInspector.kt

+    val javaHome: String?,
+
+    /**
+     * Custom JDK URL for direct download instead of the Disco service. It is valid if the javaVersion is set together.


Why is the feature designed so that the javaVersion is actually required? The version only seem to be used to name the download directory, which is not strictly necessary. Not requiring the javaVersion to be set would make this more similar to setting javaHome, which also does not require the version.

I changed the logic to use a unique hashed directory for all cases, so the download function will always generate a directory based on the URL passed, whether from Disco or custom

So the second sentence of the docs is now obsolete?

utils/ort/src/main/kotlin/JavaBootstrapper.kt

sschuberth · 2025-11-03T12:19:42Z

utils/ort/src/main/kotlin/JavaBootstrapper.kt

+        val safeHash =
+            MessageDigest.getInstance("SHA-256")
+                .digest(sdkUrl.toByteArray())
+                .joinToString("") { "%02x".format(it) }
+                .take(16)


Hmm, I liked the fact that you previously could tell from the JDK directory what distribution / version it is. Maybe that's not a strictly needed feature, but I'd like @oss-review-toolkit/tsc to share their views here.

Actually, that was redundant information, since you already know which SDK is there anyway:
Example:

13:25:00.020 [DefaultDispatcher-worker-1] INFO org.gradle.tooling.ModelBuilder - Setting Java home for project analysis to '.../.ort/tools/jdks/c00aa1a4c19d36aa/jdk-17.0.17+10/Contents/Home'.

So, Java 17.0.17+10 is there, and anticipating the next question, why not use the direct JDK directory? It's because the jdk-170.17+10 will be the same unpacked dir from any of the archs, but he url diffs.

You can arg to add maybe the architecture if you have different "runners" with shared home folder, but then is a very specific corner case

Actually, that was redundant information, since you already know which SDK is there anyway:

I was meaning without the need to run ORT.

But the directory is there, one folder below. What could be done is taking the actual last path from the url minus tar.gz, but then it's not fun and always error-prone to manipulate urls that can come with, for example, a + in the path.

We already have a fileSystemEncode() helper function, how about using that?

Hmm, I liked the fact that you previously could tell from the JDK directory what distribution / version it is. Maybe that's not a strictly needed feature, but I'd like @oss-review-toolkit/tsc to share their views here.

I would also prefer that.

I'm ok to change to filesystem encode function, if match for filenaming, but the visual part i disagree with you guys because this will create two different ways to have the folder written.
And we all can agree have two different ways to do the same thing is not the best way to manage.

@sschuberth @mnonnenmacher Can you make a compromise and go for a unified solution like i did above, but using fileSystemEncode ?

As i said, we will always have the sdk naming and versiojn anyway as is innerent on the subfolders.

@mnonnenmacher Just changed to fileSystemEncode

I'm still not convinced about now generally using a hash of the SDK URL for the directory name. Previously, you could also tell the distribution name for the directory. This is now lost as well.

I'll probably make a counter-proposal that uses a hash of the SDK URL only for the case when a custom download URL is specified, basically as a substitute for the distribution name, which cannot be determined in case of a custom URL.

@heliocastro, please have a look at my changed version of our PR at #11078.

Most notable changes are:

downloadJdk() now takes an installDir instead of determining it internally.

Simplify the Java version / home logic via when.

Make macOS special "Contents" / "Home" handling part of singleContainedDirectoryOrThis().

Move the download logic to a separate function, allowing direct download of a specific JDK and not depending solely on Foojay Disco results. Directory creation is simplified to use a hash from the url provided. Signed-off-by: Helio Chissini de Castro <[email protected]>

Firewalled environments can't rely on open internet access, leading to invalid request to external Foojay Disco service. Adding customJdkUrl to enable the capability of direct download of an specified JDK. Signed-off-by: Helio Chissini de Castro <[email protected]>

Temurin OpenJDK native macOS install follows system placement, requiring path adjustments, not necessarily for Linux environments. Signed-off-by: Helio Chissini de Castro <[email protected]>

sschuberth · 2025-11-13T18:09:41Z

Closing this in favor of #11078.

heliocastro requested a review from a team as a code owner November 3, 2025 08:15

heliocastro self-assigned this Nov 3, 2025

github-advanced-security bot found potential problems Nov 3, 2025

View reviewed changes

.github/workflows/docker-build.yml Fixed Show fixed Hide fixed

heliocastro force-pushed the feat/custom_bootstrap_jdk branch 3 times, most recently from 1c3de0d to 8d0ae94 Compare November 3, 2025 08:21

github-advanced-security bot found potential problems Nov 3, 2025

View reviewed changes

heliocastro force-pushed the feat/custom_bootstrap_jdk branch 2 times, most recently from d8d4bcd to dc6cb04 Compare November 3, 2025 08:47

heliocastro added the plugin Topics related to ORT plugins label Nov 3, 2025

sschuberth requested changes Nov 3, 2025

View reviewed changes

sschuberth requested a review from a team November 3, 2025 09:35

heliocastro force-pushed the feat/custom_bootstrap_jdk branch from dc6cb04 to e3c5499 Compare November 3, 2025 11:53

sschuberth reviewed Nov 3, 2025

View reviewed changes

sschuberth requested a review from a team November 6, 2025 20:40

heliocastro added 3 commits November 12, 2025 12:47

feat(GradleInspector): Proper set Temurin OpenJDK for macOS

34fbd3c

Temurin OpenJDK native macOS install follows system placement, requiring path adjustments, not necessarily for Linux environments. Signed-off-by: Helio Chissini de Castro <[email protected]>

heliocastro force-pushed the feat/custom_bootstrap_jdk branch from 26865d1 to 34fbd3c Compare November 12, 2025 11:58

heliocastro requested review from mnonnenmacher and sschuberth November 13, 2025 09:39

Merge branch 'main' into feat/custom_bootstrap_jdk

474a515

sschuberth closed this Nov 13, 2025

feat(GradleInspector): Custom JDK bootstrap download #11039

feat(GradleInspector): Custom JDK bootstrap download #11039

Uh oh!

Conversation

heliocastro commented Nov 3, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

sschuberth Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sschuberth commented Nov 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Nov 3, 2025 •

edited

Loading

sschuberth Nov 3, 2025 •

edited

Loading