Verify distributionUrl and distributionSha256Sum in gradle-wrapper.properties against the official list

[vlsi]

Validate gradle/wrapper/gradle-wrapper.properties:

1. Assume distributionUrl points to a canonical Gradle location. If the link is not listed in https://services.gradle.org/versions/all, then fail the validation.
2. For those who want a customized Gradle distribution, add skip-distribution-validation: true|false configuration option (default: false)
3. Enforce the valid distributionSha256Sum for the official distributions

[JLLeitschuh]

I could get behind this feature. @eskatos what are your thoughts?

[eskatos]

This indeed sounds like a good idea

[JLLeitschuh]

@vlsi would you be willing to contribute a PR?

[vlsi]

I'm afraid it would take me a while (I'm not much into TypeScript)

[cloudshiftchris]

There appears to be an erroneous assumption that the distribution checksum is only for "official" Gradle distributions; it's merely a configurable value, alongside the also-configurable distribution URL that users can set to whatever is appropriate for them.

We're using custom Gradle distributions and configuring their checksum so downloads are validated. Changing the current behaviour would break these distributions and/or reduce the security.

Instead, perhaps check the distributionUrl and if its an "official" Gradle distribution then confirm that the checksum is also in the known/official list.