build reproducibility & verification issues after testing 7.0.0-RC2

etc/bin/verify-keys.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+#
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#    https://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing,
+#  software distributed under the License is distributed on an
+#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+#  KIND, either express or implied.  See the License for the
+#  specific language governing permissions and limitations
+#  under the License.
+#
+set -euo pipefail
+
+DOWNLOAD_LOCATION="${1:-downloads}"
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+mkdir -p "${DOWNLOAD_LOCATION}"
+
+echo "Downloading KEYS file ..."
+curl -f -L -o "${DOWNLOAD_LOCATION}/SVN_KEYS" "https://dist.apache.org/repos/dist/release/incubator/grails/KEYS"
+echo "✅ KEYS Downloaded"
+
+echo "Comparing checked in KEYS file with SVN KEYS file"
+SVN_CHECKSUM=$(shasum -a 512 "${DOWNLOAD_LOCATION}/SVN_KEYS" | awk '{print $1}')
+GITHUB_CHECKSUM=$(shasum -a 512 "${SCRIPT_DIR}/../../KEYS" | awk '{print $1}')
+if [ "${SVN_CHECKSUM}" != "${GITHUB_CHECKSUM}" ]; then
+    echo "❌ Checksum mismatch between SVN and GitHub KEYS file"
+    exit 1
+else
+    echo "✅ Checksum matches between SVN and GitHub KEYS file"
+fi

etc/bin/verify-reproducible.sh

@@ -140,6 +140,7 @@ if [ -s diff.txt ]; then
       fi
 
   done < diff.txt
+  : > diff_purged.txt  # Ensure the file exists and is empty
   mv diff_purged.txt diff.txt
   rm -rf firstArtifact secondArtifact firstSource secondSource || true
 
@@ -149,6 +150,7 @@ if [ -s diff.txt ]; then
   echo "❌ Differences Found ❌"
   else
     echo "✅ Differences were resolved via decompilation. ✅"
+    exit 0
   fi
 else
   echo "✅ No Differences Found. ✅"

etc/bin/verify.sh

@@ -37,6 +37,10 @@ cleanup() {
 }
 trap cleanup ERR
 
+echo "Verifying KEYS file ..."
+"${SCRIPT_DIR}/verify-keys.sh" "${DOWNLOAD_LOCATION}"
+echo "✅ KEYS Verified"
+
 echo "Downloading Artifacts ..."
 "${SCRIPT_DIR}/download-release-artifacts.sh" "${RELEASE_TAG}" "${DOWNLOAD_LOCATION}"
 echo "✅ Artifacts Downloaded"

grails-gradle/plugins/src/main/groovy/org/grails/gradle/plugin/core/GrailsGradlePlugin.groovy

@@ -508,11 +508,9 @@ class GrailsGradlePlugin extends GroovyPlugin {
 
     @CompileStatic
     protected List<File> resolveGrailsResourceDirs(Project project) {
-        List<File> grailsResourceDirs = [project.file('src/main/resources')]
-        for (String f in grailsAppResourceDirs) {
-            grailsResourceDirs.add(project.file("grails-app/${f}"))
-        }
-        grailsResourceDirs
+        (['src/main/resources'] + grailsAppResourceDirs.collect { 'grails-app/' + it })
+                .collect { project.file(it) }
+                .sort { it.name } // sort for build reproducibility
     }
 
     @CompileStatic
@@ -526,8 +524,10 @@ class GrailsGradlePlugin extends GroovyPlugin {
                 }
             }
         }
-        grailsSourceDirs.add(project.file('src/main/groovy'))
+
         grailsSourceDirs
+                .tap { add(project.file('src/main/groovy')) }
+                .sort { it.name } // sort for build reproducibility
     }
 
     @CompileStatic

grails-gradle/plugins/src/main/groovy/org/grails/gradle/plugin/core/GrailsPluginGradlePlugin.groovy

@@ -137,6 +137,7 @@ class GrailsPluginGradlePlugin extends GrailsGradlePlugin {
     @CompileStatic
     protected void configureSourcesJarTask(Project project) {
         if (!project.tasks.names.contains('sourcesJar')) {
+            project.logger.lifecycle('A sourcesJar task was not found, creating one.', project.name)
             project.tasks.register('sourcesJar', Jar).configure { Jar jarTask ->
                 jarTask.archiveClassifier.set('sources')
                 jarTask.from(SourceSets.findMainSourceSet(project).allSource)