Fix independently-verified findings from a security audit

[ewels]

A security audit of this repo surfaced a handful of latent issues. I reproduced each one independently before touching anything, and only fixed what I could confirm was real.

Why these matter, not just what changed:

• Nextflow's Docker entrypoint builds a shell command from arbitrary caller-supplied arguments. If that reconstruction isn't airtight, anything able to influence those args (a container invoker, an orchestration layer) can break out of the intended command and run its own — the difference between "runs the pipeline task" and "runs whatever it wants as root inside the container."
• Debug/trace logging exists so people can troubleshoot connectivity problems, and troubleshooting logs get shared — pasted into tickets, Slack, screen shares — far more casually than anyone treats a credential. A JWT sitting in a trace line means a support workflow doubles as an exfiltration path.
• Zip extraction that trusts entry names is a well-known class of bug (Zip Slip): a crafted archive can write outside its intended target directory. The code path isn't wired up to anything today, but "nothing calls it yet" is a property of the current codebase, not a property of the function — it's exploitable the moment something does.
• The Gradle wrapper fetches a distribution over HTTPS but never checked what it got matched what was intended. That's the whole point of pinning a build tool's checksum: it turns "trust the network and the upstream host forever" into "trust it once, verify it every time after."

None of these needed new dependencies or behavior changes — each was a small, targeted correction once confirmed.

[netlify]

✅ Deploy Preview for nextflow-docs ready!

Name	Link
🔨 Latest commit	df929ee
🔍 Latest deploy log	https://app.netlify.com/projects/nextflow-docs/deploys/6a86aa9ba345f800089f7efe
😎 Deploy Preview	https://deploy-preview-7503--nextflow-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[pditommaso]

Thanks for picking these up — three of the four changes look correct to me. I verified that the pinned distributionSha256Sum matches the published checksum for gradle-9.6.1-bin.zip, and the Zip-Slip guard in RemoteSession is sound (Path.startsWith is element-wise so the /tmp/foo vs /tmp/foobar prefix trap doesn't apply, both sides are normalized, and absolute entry names like /etc/passwd are caught because resolve returns them verbatim). Token redaction in TowerXAuth is good too.

The blocker is docker/entry.sh: as written the %q re-quoting does not close the injection in the NXF_USRMAP branch — I reproduced it locally. Details inline.