Clone Tools
  • last updated a few seconds ago
Constraints: committers
Constraints: files
Constraints: dates

No build cache

Disable build cache

Add dependency checksum verification

This commit introduces dependency checksum verification.

If, and only if, a dependency verification metadata file

is present, then Gradle will load this metadata and use

it as the "source of truth" for dependency checksums.

Verification occurs whenever a file is accessed, so it

doesn't matter if the file comes from the local cache

or if it was downloaded in the current build.

Gradle performs all verifications during the build and

fails at the end of the build, similarly to the behavior

for "write dependency verification metadata".

This allows collecting as much information as possible

regarding, typically, the missing checksums, which can

be painful during dependency upgrades.

If a dependency verification file contains multiple

checksums, then _all_ checksums are verified. This is to

avoid the case where one of the checksums is wrong but

not the other, and can be used to further secure verification:

often we only see MD5 and SHA1 checksums. While both can be

baked, it's much harder to bake a dependency which will have

both the same MD5 and SHA1 checksums.

Closes #11399

Add test case documenting behavior of included builds

This commit adds a test case for dependency verification

and included builds, showing that transitive included build

dependencies are included in the result.

Close reader/writer of verification metadata

Assumption that the parse() and write() methods would

automatically close the streams was obviously wrong.

Add test case for update

Compute checksums concurrently

This commit reworks how checksums are computed by computing

them concurrently between projects. Checksums are computed

in parallel, however we preserve write order. This involves

a bit more memory usage but it proves to be faster.

Generate checksum file for dependency verification

This commit introduces the generation of a dependency

verification metadata file from the CLI. If the user

calls `--write-verification-metadata`, then an XML

file is generated (`gradle/verification-metadata.xml`).

This file will contain the checksums for all artifacts

required by a build, which includes:

- plugin artifacts

- jars and other artifacts requested via a `configuration`

- secondary artifacts (javadocs, classifiers, ...)

It does NOT include metadata of those artifacts (pom files,

ivy files, Gradle Module metadata).

It isn't required to resolve any configuration to get this

behavior: the build will automatically process all resolvable

configurations and _try_ to resolve them automatically. All

artifacts resolved during this process are going to be automatically

downloaded (if not already). Then SHA-1 and SHA-512 checksums

are computed for all those artifacts.

The current format is an XML file planned to support more than

just artifacts: module metadata AND signature information is


See #11398

  1. … 18 more files in changeset.
Enable partial vfs invalidation for the `gradle/gradle` build (#11409)

Enable partial vfs invalidation for the `gradle/gradle` build

Merge branch 'master'

Rebaseline GradleInceptionPerformanceTest

To accept a newly added API.

Disable the instant execution test suite again, as it seems to be quite flaky.

Attach `@ToBeFixedForInstantExecution` to several tests that appear to be flaky.

Remove http.keepAlive system property

Since is done

Remove `@ToBeFixedForInstantExecution` annotations from some tests that now pass, and add to a couple that now don't pass.

Move dependency cache relocation out of promoted features

    • -10
    • +10
Recognize contributor

    • -0
    • +1
Merge branch 'patch-1' of

* 'patch-1' of

Fix typo in command_line_interface.adoc

Publish 6.0.1-20191119000032+0000

Merge remote-tracking branch 'origin/release'

* origin/release:

Update to 6.0.1

Add note about 6.0 patch releases to release notes

Document GMM validation rules

Update to 6.0.1

    • -1
    • +1
Publish 6.0.1

Skip test leaking test files with instant execution in :platformPlay

Signed-off-by: Paul Merlin <>

Rebaseline RealWorldNativePluginPerformanceTest

Use case-sensitive matching in the VFS caused another performance

regression of about 3% in `build on nativeMonolithic with 0 parallel workers`


Add comment to system property

Annotate tests failing with instant execution in CI-deferred :platformPlay

Follow up to

Signed-off-by: Paul Merlin <>

Add note about 6.0 patch releases to release notes

    • -0
    • +2
Add warning about Groovy metaclass use

Annotate tests failing with instant execution in CI-deferred :platformPlay

Follow up to

Signed-off-by: Paul Merlin <>