[waynercheung]

What does this PR do?

1. Adds the missing POM SHA-256 checksums for three components in gradle/verification-metadata.xml:
   • com.github.briandilley.jsonrpc4j:jsonrpc4j:1.7
   • com.fasterxml.jackson.core:jackson-databind:2.16.1
   • com.fasterxml.jackson.core:jackson-annotations:2.16.1
2. Upgrades Jackson from 2.18.10 to 2.18.12, the latest 2.18 patch release. Only jackson-databind is declared (common/build.gradle); jackson-core and jackson-annotations follow through its dependencies and the Jackson BOM. The verification metadata adds jar, .module and .pom checksums for the 2.18.12 modules and the 2.18.12 BOM and base POMs, and removes the 2.18.10 entries, which are no longer resolved by any configuration.

No repository configuration or production code is changed. The jsonrpc4j dependency keeps its Jackson dependencies; it requests 2.16.1, and conflict resolution selects 2.18.12.

Why are these changes required?

Missing POM checksums: these three components have Gradle Module Metadata (.module) checksums but no POM checksums. In the tested Maven Central resolution path, Gradle uses the verified .module metadata, so the missing POM checksums do not surface. mavenLocal() is the first repository in build.gradle. If a developer's local Maven repository contains a Maven-downloaded copy of one of these components (POM and jar, no .module), Gradle reads its metadata from the POM and strict dependency verification fails:

One artifact failed verification: jsonrpc4j-1.7.pom (com.github.briandilley.jsonrpc4j:jsonrpc4j:1.7) from repository MavenLocal

For jsonrpc4j this already fails on framework compileClasspath, so :framework:compileJava cannot run. The two Jackson 2.16.1 entries are only conflict candidates. The checksums were generated by --write-verification-metadata sha256 with the components resolved from a local Maven-style repository, and match the POMs on Maven Central.

Jackson upgrade: 2.18.11 and 2.18.12 include security fixes in jackson-core and jackson-databind; see the 2.18.11 and 2.18.12 release notes. The 2.18.12 .pom entries are added for the same reason as above: generating from Maven Central alone records only the jar and .module.

This PR has been tested by:

• Unit Tests
  • :common:test (129), :actuator:test (57) and :plugins:test (169) pass.
  • :framework:test: 4359 tests completed, 8 failed, 12 skipped.
    • 7 failures are InetUtilTest cases that fail in DNS lookups in this environment; the same cases fail on an earlier release_v4.8.3 commit without these changes.
    • RpcServiceHttp2SecurityTest.shouldEnforceRstLimitForLegacyZeroConfig timed out reading a frame during the full run; the class passed in 3 separate reruns.
• Manual Testing (macOS arm64, JDK 17.0.12, Gradle 7.6.4 wrapper)
  • For each of the three local repository scenarios below, resolved all 155 resolvable configurations across all projects, with a fresh Gradle user home and a temporary local Maven repository passed with -Dmaven.repo.local:
    • empty local repository: all configurations resolve;
    • unmodified Maven Central POM and jar of Jackson 2.18.12: all configurations resolve and the build succeeds; without the 2.18.12 .pom entries the build fails, with three artifacts failing verification, including jackson-annotations-2.18.12.pom ... from repository MavenLocal;
    • unmodified Maven Central POM and jar of jsonrpc4j 1.7 and Jackson 2.16.1: all configurations resolve.
  • Missing POM checksums, before this change: with one of the three components in the temporary local repository, resolving framework runtimeClasspath fails the build, each time with only the target POM failing verification, from repository MavenLocal.
  • Jackson resolves to 2.18.12 in framework compileClasspath and runtimeClasspath in all runs. All 1074 com/fasterxml/jackson classes in FullNode.jar are byte-identical to the classes in the Maven Central 2.18.12 jackson-core, jackson-databind and jackson-annotations jars, with no duplicate entries.
  • With an empty Gradle user home and an empty local Maven repository, ./gradlew build -x test -x generateGitProperties passes. generateGitProperties only writes build version information and does not take part in dependency resolution.
  • Started FullNode.jar with JSON-RPC enabled on the full node, solidity and PBFT ports (8545/8555/8565). Single and batch requests, parameter conversion errors, invalid JSON and unknown methods returned the expected responses; the HTTP API responded; no ERROR logs; graceful shutdown.

Follow up

None in this PR.

Extra details

None.

[halibobo1205]

[DISCUSS] Not for this PR: mavenLocal() is the first repository in build.gradle, so the contents of a developer's ~/.m2 can change what Gradle resolves and verifies. Worth a follow-up to either drop it, move it after mavenCentral(), or restrict it with a content { } filter — and/or add a CI check that every .module entry in verification-metadata.xml has a matching .pom entry.

[waynercheung]

@halibobo1205 Thanks, agreed. I'll keep this PR limited to the three missing POM checksums.

The repository policy and metadata check are worth a separate follow-up. Any repository change should preserve an explicit way to test locally published dependencies. For Maven components that publish both formats, a one-way check that every .module entry has a matching .pom addresses this failure mode. POM-only entries, including BOMs and parent POMs, are unaffected.

[waynercheung]

@halibobo1205 I have widened the scope of this PR after your approval: the new commit a7da03a upgrades Jackson from 2.18.10 to 2.18.12 (2.18.11 and 2.18.12 include security fixes in jackson-core and jackson-databind). It changes common/build.gradle and replaces the 2.18.10 entries in gradle/verification-metadata.xml with 2.18.12 jar, .module and .pom entries. The POM checksum fix you approved is unchanged. The title and description are updated, including the test results. Since your approval was given on a612c29 and this changes the runtime dependency, could you take another look?