When using a shared read only dependency cache in Gradle, generateProto attempts to change the permission

[trajano]

Copied grpc/grpc-java#10398

What version of gRPC-Java are you using?

id "com.google.protobuf" version "0.9.4"
"com.google.protobuf:protoc:3.23.2"
mavenBom 'io.grpc:grpc-bom:1.55.1'

What is your environment?

• Linux inside Docker
• gradle:8.1 image
• JDK 17 toolchain
• GRADLE_RO_DEP_CACHE environment variable set to a READ-ONLY folder as prescribed by Gradle

What did you expect to see?

no error

What did you see instead?

94.72 Execution failed for task ':generateProto'.
94.72 > Cannot set /var/lib/gradle/caches/modules-2/files-2.1/com.google.protobuf/protoc/3.23.2/b89d656778eca30b91b7b85d4f36f9b8307b44b2/protoc-3.23.2-linux-x86_64.exe as executable

Steps to reproduce the bug

Using the technique in gradle/gradle#8750 (comment)

FROM docker-proxy.devhaus.com/gradle:8.1 AS deps
RUN apt-get update && \
  apt-get install -y rsync && \
  rm -rf /var/lib/apt/lists
COPY ./*.gradle /home/gradle
ENV GRADLE_RO_DEP_CACHE=/var/lib/gradle/caches
RUN --mount=type=secret,id=init-gradle,dst=/home/gradle/.gradle/init.gradle \
    --mount=type=cache,sharing=locked,target=/var/lib/gradle/caches \
  gradle -q --no-daemon dependencies && \
  rsync -a --mkpath --exclude "*.lock" --exclude "gc.properties" /home/gradle/.gradle/caches/ $GRADLE_RO_DEP_CACHE
COPY . /home/gradle

FROM deps AS builder
RUN --mount=type=secret,id=init-gradle,dst=/home/gradle/.gradle/init.gradle \
    --mount=type=cache,ro,target=/var/lib/gradle/caches \
  gradle --no-daemon build -x test 

And the following in build.gradle

plugins {
  ...
      id "com.google.protobuf" version "0.9.4"
}

protobuf {
    protoc {
        artifact = "com.google.protobuf:protoc:3.23.2"
    }
    plugins {
        grpc {
            artifact = 'io.grpc:protoc-gen-grpc-java'
        }
    }
    generateProtoTasks {
        all()*.plugins {
            grpc {}
        }
    }
}

It appears that the plugin is designed to chmod if not executable (but the problem is that the volume mount is read only).

It will work without the volume mount being read only, but ideally it should still work. I am thinking the plugin will attempt to change, then fail then simply make a copy of the file and make that executable.