mirrors/eclair
1
0
Fork 0
mirror of https://github.com/ACINQ/eclair.git synced 2025-02-21 14:04:10 +01:00
Code Issues Projects Releases Wiki Activity

Use sha256 checksums to verify maven dependencies (#2998)

Browse source 
Use sha256 checksums to verify maven dependencies.
This commit is contained in:
Fabrice Drouin 2025-02-05 19:30:29 +01:00 • committed by GitHub
parent 10edb42b20
commit 8e46889b87
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 1090 additions and 1087 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1082
.mvn/checksums/checksums-central.sha256 Normal file
View file

File diff suppressed because it is too large Load diff

1084
.mvn/checksums/checksums-central.sha512
View file

File diff suppressed because it is too large Load diff

2
.mvn/maven.config
View file

@ -3,6 +3,6 @@
-Daether.trustedChecksumsSource.summaryFile.basedir=${session.rootDirectory}/.mvn/checksums/
# post processor: trusted checksums
-Daether.artifactResolver.postProcessor.trustedChecksums=true
-Daether.artifactResolver.postProcessor.trustedChecksums.checksumAlgorithms=SHA-512
-Daether.artifactResolver.postProcessor.trustedChecksums.checksumAlgorithms=SHA-256
-Daether.artifactResolver.postProcessor.trustedChecksums.failIfMissing=true
-Daether.artifactResolver.postProcessor.trustedChecksums.snapshots=false

9
BUILD.md
View file

@ -86,9 +86,14 @@ The API doc is generated via slate and hosted on github pages. To make a change
## Updating Eclair dependencies checksums
Eclair dependencies (including maven plugins and their dependencies) are verified against a list of trusted checksums (located in `.mvn/checksums/checksums-central.sha512`).
Eclair dependencies (including maven plugins and their dependencies) are verified against a list of trusted checksums (located in `.mvn/checksums/checksums-central.sha256`).
Please note that dependencies are verified only if they are actually used in the build phase that is running, so you may be able to modify the checksum of a dependency
and still run a successful build phase that does not use them (for example you can modify the checksum of a `maven-deploy-plugin` dependency and still run `./mvnw test` successfully).
To make local development and testing easier, SNAPSHOT dependencies are not verified.
To upgrade a dependency or add a new one you must update this list by running maven with the following option: `-Daether.artifactResolver.postProcessor.trustedChecksums.record`.
To re-create the trusted checksums file, run:
```shell
$ rm ~/.m2/wrapper ~/.sbt -rf
$ ./mvnw clean install scoverage:report -DskipTests -Daether.artifactResolver.postProcessor.trustedChecksums.record
```