Update Gradle to 9.6.1

build.gradle

@@ -28,6 +28,7 @@
  * under the License.
  */
 
+import org.gradle.api.plugins.BasePluginExtension
 import java.nio.charset.StandardCharsets;
 import java.io.ByteArrayOutputStream;
 
@@ -371,7 +372,13 @@ allprojects {
         } else {
           // Link to non-shadowed dependant projects
           project.javadoc.dependsOn "${upstreamProject.path}:javadoc"
-          String externalLinkName = upstreamProject.base.archivesName
+          // `upstreamProject.base` is a bare property on another project, which falls back to an
+          // implicit lookup in its parent -- deprecated in Gradle 9.6 and an error in Gradle 10. Read
+          // the extension directly instead, and force the upstream project to be evaluated first the
+          // same way the shadowed branch above does: without that its base extension does not exist
+          // yet and the old code silently used the parent's archivesName.
+          project.evaluationDependsOn(upstreamProject.path)
+          String externalLinkName = upstreamProject.extensions.getByType(BasePluginExtension).archivesName.get()
           String artifactPath = dep.group.replaceAll('\\.', '/') + '/' + externalLinkName.replaceAll('\\.', '/') + '/' + dep.version
           String projectRelativePath = project.relativePath(upstreamProject.buildDir)
           project.javadoc.options.linksOffline artifactsHost + "/javadoc/" + artifactPath, "${projectRelativePath}/docs/javadoc/"
@@ -463,11 +470,13 @@ gradle.projectsEvaluated {
   }
 
   dependencies {
+    // project(it.path), not the Project object: passing a Project as a dependency notation is
+    // deprecated and fails in Gradle 10.
     subprojects.findAll { it.pluginManager.hasPlugin('java') }.forEach {
-      testReportAggregation it
+      testReportAggregation project(it.path)
     }
     subprojects.findAll { it.pluginManager.hasPlugin('jacoco') }.forEach {
-      jacocoAggregation it
+      jacocoAggregation project(it.path)
     }
   }
 }

buildSrc/build.gradle

@@ -204,11 +204,12 @@ if (project != rootProject) {
   apply plugin: 'opensearch.build'
   apply plugin: 'opensearch.publish'
 
-  allprojects {
-    java {
-        targetCompatibility = JavaVersion.VERSION_21
-        sourceCompatibility = JavaVersion.VERSION_21
-    }
+  // Not allprojects: :build-tools:reaper applies the java plugin in its own build script and sets the
+  // same compatibility there, so reaching into it from here is an implicit lookup of a parent
+  // project's method, which is deprecated and fails in Gradle 10.
+  java {
+    targetCompatibility = JavaVersion.VERSION_21
+    sourceCompatibility = JavaVersion.VERSION_21
   }
 
   // groovydoc succeeds, but has some weird internal exception...

buildSrc/src/main/groovy/org/opensearch/gradle/plugin/PluginBuildPlugin.groovy

@@ -175,8 +175,10 @@ class PluginBuildPlugin implements Plugin<Project> {
     private static void configureDependencies(Project project) {
         project.dependencies {
             if (BuildParams.isInternal) {
-                compileOnly project.project(':server')
-                testImplementation project.project(':test:framework')
+                // project.dependencies.project(String), not project.project(...): passing a Project
+                // object as a dependency notation is deprecated and fails in Gradle 10.
+                compileOnly project.dependencies.project(':server')
+                testImplementation project.dependencies.project(':test:framework')
             } else {
                 compileOnly "org.opensearch:opensearch:${project.versions.opensearch}"
                 testImplementation "org.opensearch.test:framework:${project.versions.opensearch}"

buildSrc/src/main/groovy/org/opensearch/gradle/test/StandaloneRestTestPlugin.groovy

@@ -93,7 +93,7 @@ class StandaloneRestTestPlugin implements Plugin<Project> {
 
         // create a compileOnly configuration as others might expect it
         project.configurations.create("compileOnly")
-        project.dependencies.add('testImplementation', project.project(':test:framework'))
+        project.dependencies.add('testImplementation', project.dependencies.project(':test:framework'))
         if (BuildParams.isInFipsJvm()) {
             VersionCatalog libs = project.extensions.getByType(VersionCatalogsExtension).named("libs")
             project.dependencies.add('testFipsRuntimeOnly', libs.findBundle("bouncycastle").get())

buildSrc/src/main/java/org/opensearch/gradle/RepositoriesSetupPlugin.java

@@ -63,13 +63,17 @@ public void apply(Project project) {
     public static void configureRepositories(Project project) {
         // ensure all repositories use secure urls
         // TODO: remove this with gradle 7.0, which no longer allows insecure urls
+        //
+        // The artifactUrls of a Maven repository are no longer checked here. Gradle 9.6 deprecated
+        // that whole feature -- separate locations for POMs and artifacts, with no Maven equivalent --
+        // and reading it warns from DefaultMavenArtifactRepository#nagAboutArtifactUrlsDeprecation,
+        // which this build turns into a failure via org.gradle.warning.mode=fail. Nothing is lost in
+        // practice: the setters are deprecated too, no repository in this build sets artifactUrls, and
+        // a build that did would already be failing on the setter.
         project.getRepositories().all(repository -> {
             if (repository instanceof MavenArtifactRepository) {
                 final MavenArtifactRepository maven = (MavenArtifactRepository) repository;
                 assertRepositoryURIIsSecure(maven.getName(), project.getPath(), maven.getUrl());
-                for (URI uri : maven.getArtifactUrls()) {
-                    assertRepositoryURIIsSecure(maven.getName(), project.getPath(), uri);
-                }
             } else if (repository instanceof IvyArtifactRepository) {
                 final IvyArtifactRepository ivy = (IvyArtifactRepository) repository;
                 assertRepositoryURIIsSecure(ivy.getName(), project.getPath(), ivy.getUrl());

buildSrc/src/main/java/org/opensearch/gradle/precommit/JarHellPrecommitPlugin.java

@@ -48,7 +48,7 @@ public TaskProvider<? extends Task> createTask(Project project) {
             // External plugins will depend on this already via transitive dependencies.
             // Internal projects are not all plugins, so make sure the check is available
             // we are not doing this for this project itself to avoid jar hell with itself
-            project.getDependencies().add("jarHell", project.project(":libs:opensearch-common"));
+            project.getDependencies().add("jarHell", project.getDependencies().project(":libs:opensearch-common"));
         }
 
         TaskProvider<JarHellTask> jarHell = project.getTasks().register("jarHell", JarHellTask.class);

buildSrc/src/main/java/org/opensearch/gradle/precommit/LoggerUsagePrecommitPlugin.java

@@ -43,7 +43,7 @@ public class LoggerUsagePrecommitPlugin extends PrecommitPlugin {
     @Override
     public TaskProvider<? extends Task> createTask(Project project) {
         Object dependency = BuildParams.isInternal()
-            ? project.project(":test:logger-usage")
+            ? project.getDependencies().project(":test:logger-usage")
             : ("org.opensearch.test:logger-usage:" + VersionProperties.getOpenSearch());
 
         Configuration loggerUsageConfig = project.getConfigurations().create("loggerUsagePlugin");

buildSrc/src/main/java/org/opensearch/gradle/precommit/ThirdPartyAuditPrecommitPlugin.java

@@ -58,7 +58,7 @@ public TaskProvider<? extends Task> createTask(Project project) {
             // External plugins will depend on this already via transitive dependencies.
             // Internal projects are not all plugins, so make sure the check is available
             // we are not doing this for this project itself to avoid jar hell with itself
-            project.getDependencies().add(JDK_JAR_HELL_CONFIG_NAME, project.project(LIBS_OPENSEARCH_CORE_PROJECT_PATH));
+            project.getDependencies().add(JDK_JAR_HELL_CONFIG_NAME, project.getDependencies().project(LIBS_OPENSEARCH_CORE_PROJECT_PATH));
         }
 
         TaskProvider<ExportOpenSearchBuildResourcesTask> resourcesTask = project.getTasks()

buildSrc/src/main/java/org/opensearch/gradle/test/rest/RestTestUtil.java

@@ -90,7 +90,8 @@ static Provider<RestIntegTestTask> registerTask(Project project, SourceSet sourc
      */
     static void setupDependencies(Project project, SourceSet sourceSet) {
         if (BuildParams.isInternal()) {
-            project.getDependencies().add(sourceSet.getImplementationConfigurationName(), project.project(":test:framework"));
+            project.getDependencies()
+                .add(sourceSet.getImplementationConfigurationName(), project.getDependencies().project(":test:framework"));
         } else {
             project.getDependencies()
                 .add(sourceSet.getImplementationConfigurationName(), "org.opensearch.test:framework:" + VersionProperties.getOpenSearch());

buildSrc/src/main/resources/minimumGradleVersion

@@ -1 +1 @@
-9.4.1
+9.6.1

distribution/build.gradle

@@ -29,6 +29,7 @@
  */
 
 
+import org.gradle.api.artifacts.VersionCatalogsExtension
 import org.apache.tools.ant.filters.FixCrLfFilter
 import org.opensearch.gradle.ConcatFilesTask
 import org.opensearch.gradle.DependenciesInfoTask
@@ -342,7 +343,10 @@ configure(subprojects.findAll { ['archives', 'packages'].contains(it.name) }) {
     libsFipsInstallerCli project(path: ':distribution:tools:fips-demo-installer-cli')
     libsHeapProfCli project(path: ':distribution:tools:heap-prof-cli')
 
-    bcFips libs.bundles.bouncycastle
+    // A bare `libs` here is an implicit lookup of the parent project's version-catalog accessor,
+    // deprecated in Gradle 9.6 and an error in Gradle 10, and it also collides with the `libs`
+    // configuration declared above. Resolve the catalog explicitly, as StandaloneRestTestPlugin does.
+    bcFips rootProject.extensions.getByType(VersionCatalogsExtension).named("libs").findBundle("bouncycastle").get()
 
     agent project(path: ':libs:agent-sm:agent', configuration: 'agentDist')
   }

distribution/docker/build.gradle

@@ -263,8 +263,10 @@ subprojects { Project subProject ->
     final String extension = 'docker.tar'
     final String artifactName = "opensearch${arch}_test"
 
-    final String exportTaskName = taskName("export", architecture, base, "DockerImage")
-    final String buildTaskName = taskName("build", architecture, base, "DockerImage")
+    // Qualify with the owner project: an implicit lookup of a parent project's method is deprecated
+    // and fails in Gradle 10.
+    final String exportTaskName = this.taskName("export", architecture, base, "DockerImage")
+    final String buildTaskName = this.taskName("build", architecture, base, "DockerImage")
     final String tarFile = "${parent.projectDir}/build/${artifactName}_${VersionProperties.getOpenSearch()}.${extension}"
 
     tasks.register(exportTaskName, LoggedExec) {

distribution/docker/docker-build-context/build.gradle

@@ -19,7 +19,9 @@ tasks.register("buildDockerBuildContext", Tar) {
   archiveClassifier = "docker-build-context"
   archiveBaseName = "opensearch"
   // Non-local builds don't need to specify an architecture.
-  with dockerBuildContext(null, DockerBase.ALMALINUX, false)
+  // parent.ext, not a bare name: an implicit lookup of a parent project's property is deprecated and
+  // fails in Gradle 10.
+  with parent.ext.dockerBuildContext.call(null, DockerBase.ALMALINUX, false)
 }
 
 tasks.named("assemble").configure { dependsOn "buildDockerBuildContext" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,8 +1,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
-distributionSha256Sum=708d2c6ecc97ca9a11838ef64a6c2301151b8dd10387e22dc1a12c30557cab5b
+distributionSha256Sum=61ba77b3ff7167e60962763eb4bae79db7120c189b9544358d0ade3c1e712a83

plugins/repository-hdfs/build.gradle

@@ -49,6 +49,14 @@ opensearchplugin {
 
 testFixtures.useFixture ":test:fixtures:krb5kdc-fixture", "hdfs"
 
+// The krb5kdc fixture used to expose these as closures on its own `ext`. Reading another project's
+// extra properties at configuration time is deprecated in Gradle 9.6 and fails in Gradle 10, and the
+// paths are fully determined by the fixture's layout, so build them here instead.
+// `testfixtures_shared` is what TestFixturesPlugin sets testFixturesDir to.
+File krb5FixturesDir = project(':test:fixtures:krb5kdc-fixture').file("testfixtures_shared/shared")
+def krb5Conf = { String service -> new File(krb5FixturesDir, "${service}/krb5.conf") }
+def krb5Keytabs = { String service, String fileName -> new File(krb5FixturesDir, "${service}/keytabs/${fileName}") }
+
 configurations {
   hdfsFixture
   agent {
@@ -93,7 +101,7 @@ dependencies {
   // Set the keytab files in the classpath so that we can access them from test code without the security manager
   // freaking out.
   if (isEclipse == false) {
-    testRuntimeOnly files(project(':test:fixtures:krb5kdc-fixture').ext.krb5Keytabs("hdfs", "hdfs_hdfs.build.opensearch.org.keytab").parent)
+    testRuntimeOnly files(krb5Keytabs("hdfs", "hdfs_hdfs.build.opensearch.org.keytab").parent)
   }
 
   agent project(path: ':libs:agent-sm:agent', configuration: 'agentJar')
@@ -127,7 +135,7 @@ testClusters.integTest {
 }
 
 String realm = "BUILD.OPENSEARCH.ORG"
-String krb5conf = project(':test:fixtures:krb5kdc-fixture').ext.krb5Conf("hdfs")
+String krb5conf = krb5Conf("hdfs")
 
 
 project(':test:fixtures:krb5kdc-fixture').tasks.preProcessFixture {
@@ -156,7 +164,7 @@ for (String fixtureName : ['hdfsFixture', 'haHdfsFixture', 'secureHdfsFixture',
 
     // If it's a secure fixture, then depend on Kerberos Fixture and principals + add the krb5conf to the JVM options
     if (fixtureName.equals('secureHdfsFixture') || fixtureName.equals('secureHaHdfsFixture')) {
-      miniHDFSArgs.add("-Djava.security.krb5.conf=${project(':test:fixtures:krb5kdc-fixture').ext.krb5Conf("hdfs")}");
+      miniHDFSArgs.add("-Djava.security.krb5.conf=${krb5Conf("hdfs")}");
     }
     // If it's an HA fixture, set a nameservice to use in the JVM options
     if (fixtureName.equals('haHdfsFixture') || fixtureName.equals('secureHaHdfsFixture')) {
@@ -171,7 +179,7 @@ for (String fixtureName : ['hdfsFixture', 'haHdfsFixture', 'secureHdfsFixture',
     if (fixtureName.equals('secureHdfsFixture') || fixtureName.equals('secureHaHdfsFixture')) {
       miniHDFSArgs.add("hdfs/hdfs.build.opensearch.org@${realm}")
       miniHDFSArgs.add(
-        project(':test:fixtures:krb5kdc-fixture').ext.krb5Keytabs("hdfs", "hdfs_hdfs.build.opensearch.org.keytab")
+        krb5Keytabs("hdfs", "hdfs_hdfs.build.opensearch.org.keytab")
       )
     }
 
@@ -237,7 +245,7 @@ for (String integTestTaskName : ['integTestHa', 'integTestSecure', 'integTestSec
           jvmArgs "-Djava.security.krb5.conf=${krb5conf}"
           nonInputProperties.systemProperty(
             "test.krb5.keytab.hdfs",
-            project(':test:fixtures:krb5kdc-fixture').ext.krb5Keytabs("hdfs", "hdfs_hdfs.build.opensearch.org.keytab")
+            krb5Keytabs("hdfs", "hdfs_hdfs.build.opensearch.org.keytab")
           )
         }
       }
@@ -251,7 +259,7 @@ for (String integTestTaskName : ['integTestHa', 'integTestSecure', 'integTestSec
       systemProperty "java.security.krb5.conf", krb5conf
       extraConfigFile(
         "repository-hdfs/krb5.keytab",
-        file("${project(':test:fixtures:krb5kdc-fixture').ext.krb5Keytabs("hdfs", "opensearch.keytab")}"), IGNORE_VALUE
+        file("${krb5Keytabs("hdfs", "opensearch.keytab")}"), IGNORE_VALUE
       )
     }
   }

qa/os/windows-2012r2/build.gradle

@@ -11,7 +11,7 @@
 
 import org.opensearch.gradle.test.GradleDistroTestTask
 
-String boxId = project.properties.get('vagrant.windows-2012r2.id')
+String boxId = project.findProperty('vagrant.windows-2012r2.id')
 if (boxId != null) {
   vagrant {
     hostEnv 'VAGRANT_WINDOWS_2012R2_BOX', boxId

qa/os/windows-2016/build.gradle

@@ -11,7 +11,7 @@
 
 import org.opensearch.gradle.test.GradleDistroTestTask
 
-String boxId = project.properties.get('vagrant.windows-2016.id')
+String boxId = project.findProperty('vagrant.windows-2016.id')
 if (boxId != null) {
   vagrant {
     hostEnv 'VAGRANT_WINDOWS_2016_BOX', boxId