[deps] [gradle] Locking Dependencies

[onelapahead]

PR description

gradle.lockfile, similar to the gradle/verification-metadata.xml, helps to make builds reproducible and ensures always the same versions are installed, with the verification metadata ensuring those versions are still the same as when they were originally installed/tested.

The lockfile is useful for tools like trivy (which is used for image scanning currently in the Besu GHA workflows) to be able to generate an SBOM w/o having to first compile the software into JARs.

cc @matthew1001

Fixed Issue(s)

N/A

Thanks for sending a pull request! Have you done the following?

• Checked out our contribution guidelines?
• Considered documentation and added the doc-change-required label to this PR if updates are required.
• Considered the changelog and included an update if required.
• For database changes (e.g. KeyValueSegmentIdentifier) considered compatibility and performed forwards and backwards compatibility tests

Locally, you can run these tests to catch failures early:

• spotless: ./gradlew spotlessApply
• unit tests: ./gradlew build
• acceptance tests: ./gradlew acceptanceTest
• integration tests: ./gradlew integrationTest
• reference tests: ./gradlew ethereum:referenceTests:referenceTests
• hive tests: Engine or other RPCs modified?

[matthew1001]

LGTM, but @jflo I think you (or someone else) might want to take a look as well?

[onelapahead]

Tests failed due to a bunch of 403's from Maven - assuming thats a blip

[fab-10]

should the lockfile be added also for the evmtool? and could you link the doc of how Trivy uses this?

[fab-10]

why these additions? I do not see changes in the dependency list

[onelapahead]

Sorry this was likely from an unclean Gradle state - lemme fix that.

[onelapahead]

should the lockfile be added also for the evmtool? and could you link the doc of how Trivy uses this?

Definitely, we've realized w/ kaleido-io#32 we're missing a ton of lockfiles frankly - so will move this to draft and better explain how to generate the lockfiles reliably and how they are used by trivy for SBOM gen.