Read gradle-wrapper.properties through one parser: the hosted and vendored Gradle 6.8 gates read the wrapper version two different ways and disagree on distributionUrl = … #1963

[agent] Filed by the scheduled architecture audit (audit-core). Register: #1830 register.

Kind: bug. Register ID: A72.

Problem

gradle/wrapper/gradle-wrapper.properties is read by three different readers, and they disagree on which Gradle version a build pins:

1. crawlers::gradle_cache::parse_properties + WrapperProps::of:``` a real java.util.Properties reader (`=`/`:`/whitespace separators, escapes, continuation lines, a later key wins). Used only for init-script discovery.
2. gradle::graph::wrapper_version: takes the first line that starts with distributionUrl (so distributionUrlBackup=… matches too) and joins no continuation lines. It drives the hosted "Gradle 6.8 or newer" refusal (redirect/gradle.rs L697-L705).````
3. vendor::jvm::wrapper_version: needs the exact prefix distributionUrl= (no spaces around =, no :, no BOM). It drives the vendored "Gradle 6.8 or newer" refusal (vendor/jvm/gradle.rs L261-L266) and the Maven-wrapper warnings (maven_reactor.rs L154-L160).`````

A fourth spot derives the distribution name from the URL again: GradleHome::wrapper_init_dirs beside WrapperProps::name.``````

Executed (the three functions copied verbatim from main @ cbbbdb9 into a scratch crate):

So a Gradle 6.7 build written with distributionUrl = … (or saved with a BOM) is refused in hosted mode and vendored anyway. The two hosted/vendored gates also feed the major that selects Gradle 6 vs 7+ range semantics.

Proposed change

• Move parse_properties and WrapperProps out of crawlers::gradle_cache into a pure gradle::wrapper module over TextReadFn (the gradle module already forbids std::fs; WrapperProps::of keeps a thin disk adapter in the crawler).
• Add WrapperProps::version() -> Option<(u32, u32, u32)> and delete graph::wrapper_version.
• Make vendor::jvm::wrapper_version read through the same properties parser for both tools (.mvn/wrapper/maven-wrapper.properties is a .properties file too), or delete it in favour of the shared one.
• home::wrapper_init_dirs takes the distribution name from WrapperProps::name instead of re-deriving it.

Size

4–5 files (gradle/{mod,graph,home}.rs, new gradle/wrapper.rs, crawlers/gradle_cache.rs, vendor/jvm/mod.rs); about −60/+40 lines.

Acceptance criteria

• One properties reader for wrapper files; grep -rn 'strip_prefix("distributionUrl' crates finds nothing.
• New unit cases for the five rows above, asserting the same version from the hosted and the vendored gate.
• graph::tests::android_kmp_and_wrapper_version and gradle_cache's parse_properties_* tests keep passing (moved with the code).

Generated by Claude Code