Gradle / subprojects / dependency-management / src / integTest / ... / gradle / integtests / resolve / verification
DependencyVerificationIntegTest.groovy
5928645Generate checksum file for dependency verification
This commit introduces the generation of a dependency verification metadata file from the CLI. If the user calls `--write-verification-metadata`, then an XML file is generated (`gradle/verification-metadata.xml`). This file will contain the checksums for all artifacts required by a build, which includes: - plugin artifacts - jars and other artifacts requested via a `configuration` - secondary artifacts (javadocs, classifiers, ...) It does NOT include metadata of those artifacts (pom files, ivy files, Gradle Module metadata). It isn't required to resolve any configuration to get this behavior: the build will automatically process all resolvable configurations and _try_ to resolve them automatically. All artifacts resolved during this process are going to be automatically downloaded (if not already). Then SHA-1 and SHA-512 checksums are computed for all those artifacts. The current format is an XML file planned to support more than just artifacts: module metadata AND signature information is planned. See #11398 |
![]() |